4 ms·
“Set up a new service and migrate all your clients” sounds _worse_ than “update the centrally managed config for existing clients” though? I’m only dealing with
by Shish2k 5y ago
“Set up a new service and migrate all your clients” sounds _worse_ than “update the centrally managed config for existing clients” though? I’m only dealing with double-digit numbers of devices, and this “non-problem” sounds like a nightmare...
- tptacek 5y agoYou are in fact unlikely to ever have to upgrade the WireGuard protocol under any kind of duress. But ciphersuite negotiation has itself been a source of protocol vulnerabilities, and those are vulnerabilities you'll never have to think about with WireGuard.
- whoknowswhat11 5y agoNot for larger enterprises - simply because this is how they ALREADY do things. You setup new thing on new place, and 5 years later hope you can turn off version 1. You would be surprised at how LITTLE updating and reconfiguring of systems that are working big enterprises want to do. And this is doubly so in the VPN space which is a mindfield already of troubleshooting when users call and complain (98% user error, but the 2% config / ip exhaustion or whatever bites you and so once folks have a working setup they really don't want to mess with it).
- knorker 5y agoIf you have triple-digit clients then you need automation anyway. What's so hard about rolling out a config change? And it's not like you don't have this with IPSec. It's just a different config change, maybe enabling PFS, or changing the allowed crypto list, etc.