SSL VPN
termsecuritynetworking
Remote access carried inside a TLS session on port 443, either through a browser portal or an agent, so that it crosses networks that permit little else.
The appeal was always practical rather than cryptographic: a hotel or airport network that blocks almost everything still allows outbound 443, so a tunnel disguised as web traffic gets through where IPsec does not. The cost is the shape of what has to listen. A concentrator terminates TLS, parses attacker-controlled input through an HTTP stack and often a web application, must be reachable from the whole internet, and usually sits inside the firewall itself - which is why the same class of pre-authentication flaw has recurred across unrelated vendors' products for a decade. Fortinet removed tunnel mode entirely in FortiOS 7.6.3, keeping browser access under the name Agentless VPN, and other vendors have retired product lines or hardware generations. The industry is not abandoning TLS or remote access; it is abandoning the full-tunnel, appliance-terminated form as the default, in favour of brokered per-application access.
Also known as: ssl vpn, ssl-vpn, tls vpn, agentless vpn