FIX Protocol using tunnel protocol.

, ,
1

Imported from previous forum

2

Hi,

We have a requirement to secure a FIX protocol session using an
tunnel protocol. Is there a preferred/standard tunnel protocol for
Sun Solaris ? Probably like IPSec, VPN or any. Please throw some light on this.

Who supports this?

Regards.
H.

3

Hi Hari,

We have a requirement to secure a FIX protocol session using an tunnel
protocol. Is there a preferred/standard tunnel protocol for Sun Solaris
? Probably like IPSec, VPN or any. Please throw some light on this.

You are mixing some terms: IPSec (and OpenVPN) are open source implementation of a VPN. In addition, there are proprietary VPN implementations both in software and hardware (ie Cisco PIX).

As “poor mans VPN” you could also use SSH or stunnel which relies on SSH:

http://www.stunnel.org

The advantage is that using a VPN you are virtually connect the both networks, while using SSH you have to specify every single link. With this regard, the VPN may be a security hole if you connect a provider and a client, since not all connections should be allowed.

The basic layout is as follows:

client – local network – vpn end-point – wan/internet
– vpn end-point – local network – server

If the application and the vpn end-point are on the same host, you can omit the local network.

The VPN is totally transparent to the client: Instead of connecting to a port on the server, it now connects to a port on the local network or the localhost. The TCP/IP packets are forwarded transparently over the WAN/Internet as payload in the VPN packets. The VPN also uses TCP/IP as a transport medium.

The simplest tunnel is using ssh:

ssh -L 4242:localhost:4242 remote-server.other.com

ssh connects to remote-server.other.com (where there must be a login account) and starts listening on the local port 4242. If you client connects to 4242 locally, ssh forwarded the connection over the encrypted ssh connection to ssh daemon on the remote server and contacts the host “localhost”, port 4242.

Using stunnel or VPN, you do not need any locals accounts and the setup is a bit easier.

Please check the tutorials on www.stunnel.org and referring links to ssh.

See also “Sending FIX messages across internet” in the Information Security forum. Actually this discussion belongs there. I did not check carefully – sorry.

Cheers, Jörg