In this application-layer access model, the SSL VPN gateway uses a built-in screen-scraping protocol that splits the emulation and display processing so that only the application’s display is sent to the remote user’s Web browser. The gateway supports this capability through a browser enhancement (a small Java applet) that is downloaded to the user’s browser upon the first login. As a result, the user experiences the application with optimal performance over any connection, just as if the application was installed and running on the user’s local machine.

Secure Intranet Access to Web-based Applications and Portals

Even as they continue to rely on legacy applications as part of their application strategy, enterprises are also developing applications intended for direct Web browser access. These may be “Webified” versions of legacy applications such as Microsoft Outlook or proprietary intranet applications. However, sharing such information over the Web can lead to security risks that must be carefully addressed. IT departments given the task of extending Web-based applications to remote users and business partners face significant challenges. For example, Web-enabled resources typically reside on a company's secure intranet, and use internal Domain Name System (DNS) that cannot be resolved by the public Internet.

Leading SSL VPN appliances, however, overcome these obstacles and can safely extend these intranet resources to authorized users. This is accomplished by providing clientless, browser-based access to Web-based resources using HyperText Transfer Protocol (HTTP) reverse-proxy technology. Unlike a forward proxy, which operates between a corporate intranet user and an Internet Web site, a reverse proxy operates between a remote user on the Internet and an enterprise Web site. With this approach, a single point of entry over the Internet – the SSL VPN gateway – lets remote users access back-end Web servers securely through a Web browser.


This approach delivers fast, secure, on-demand access to Web-based information, with a highly scalable solution that can easily grow to authorize users on a global scale. The security benefits are clear: corporate Web servers remain safe behind the firewall, in a highly secure portion of the private network, without the cost and maintenance of locking each server down for public access. Additionally, administrators gain granular access control to directories, servers, and paths on a user or group basis.

Desktop Application Access: Client/Server over SSL Tunneling

The two clientless remote access methods described above meet the access needs of most remote users. However, some end-users may need to use local client/server applications, such as email or CRM programs, already installed on their computers. These are typically local applications that exchange data with with backend host servers, while also supporting offline usage (an example is Microsoft’s Outlook client and Exchange server for email). These applications often reside on company-owned computers that are managed by MIS staff. In these case, a network-layer type access somewhat similar to IPSec VPNs is appropriate. This can be provided via SSL tunneling technology.

SSL Tunneling: The Technology and its Benefits