8.3

provides authentication features.

Authentication Header

Host-to-host communications within a LAN. VPN communications through the Internet, either by itself or in conjunction with the L2TP VPN protocol. Any traffic supported by the IP protocol including Web, e-mail, Telnet, file transfer, and SNMP traffic as well as countless others.

IPSec

provides authentication and encryption, and can be used in conjunction with L2TP or by itself as a VPN solution.

IPSec

uses either digital certificates or pre-shared keys.

IPSec

negotiates the connection. As two end points are securing an IPSec network, they have to negotiate what is called a Security Association (SA). An inbound and outbound SA is necessary for each connection with a remote endpoint.

Internet Key Exchange

Is not supported by older operating systems.

L2TP

Supports multiple protocols (not just IP).

L2TP

Uses IPSec for encryption.

L2TP

Uses TCP port 1701 and UDP port 500.

L2TP

is an open standard for secure multi-protocol routing.

L2TP

Encapsulates other LAN protocols and carries the data securely over an IP network.

PPTP

Is supported by most operating systems and servers.

PPTP

Supports TCP/IP only.

PPTP

Uses Microsoft's MPPE for data encryption.

PPTP

Uses TCP port 1723.

PPTP

Uses standard authentication protocols, such as Challenge Handshake Authentication Protocol (CHAP) or Password Authentication Protocol (PAP).

PPTP

was one of the first VPN protocols. Developed by Microsoft

PPTP

use the unencrypted packet headers to deliver the packet to the destination device.

Routers

Authenticates the server to the client using public key cryptography and digital certificates.

SSL

Encrypts the entire communication session.

SSL

The SSL protocol has long been used to secure traffic generated by other IP protocols such as HTTP, FTP, and e-mail. SSL can also be used as a VPN solution, typically in a remote access scenario.

SSL

Uses port 443, a port that is often already opened in most firewalls.

SSL

are devices that can encrypt and decrypt packets.

Tunnel endpoints

can be used over a local area network, across a WAN connection, over the Internet, and even between a client and a server over a dial-up connection through the Internet.

VPN

is a network that uses encryption to allow IP traffic to travel securely over the TCP/IP network.

VPN

is used primarily to support secured communications over an untrusted network.

VPN

work by using a tunneling protocol that encrypts packet contents and wraps them in an unencrypted packet.

VPN

routers on the edge of each site establish a VPN with the router at the other location. Data from hosts within the site are encrypted before being sent to the other site. With this configuration, individual hosts are unaware of the VPN.

site-to-site VPN

IKE uses the following functions:Internet Security Association Key Management Protocol (ISAKMP) establishes a framework for the negotiation. The Diffie-Hellman key exchange generates symmetric keys used for the encryption of the negotiation of the SA.

...

If you use only AH, data is not encrypted.

...

Implementations that use SSL for VPN tunneling include Microsoft's SSTP and Cisco's SSL VPN.

...

Intermediate routers along the path cannot (and do not) read the encrypted packet contents.

...

Use AH to enable authentication with IPSec. AH provides a message integrity check with the Hashed Keyed Message Authentication Code (HMAC). With HMAC, a symmetric key is embedded into a message before the message is hashed. When the message is received, the recipient's symmetric key is added back into the message before hashing the message. If the hash values match, message integrity is proven. AH uses SHA-1 (Secure Hashing Algorithm 1) or MD5 (Message Digest v5) for integrity validation.

...

Use ESP to encrypt data.

...

You should be aware that ports must be opened in firewalls to allow VPN protocols. For this reason, using SSL for the VPN often works through firewalls when other solutions do not. In addition, some NAT solutions do not work well with VPN connections.

...

hen you create a VPN, you establish a security association between the two tunnel endpoints. These endpoints create a secure, virtual communication channel. Only the destination tunnel endpoint can unwrap packets and decrypt the packet contents.

...

provides data encryption.

Encapsulating Security Payload

two hosts establish a secure channel and communicate directly. With this configuration, both devices must be capable of creating the VPN connection.

host-to-host VPN

a server on the edge of a network (called a VPN concentrator) is configured to accept VPN connections from individual hosts in a client-to-site configuration. Hosts that are allowed to connect using the VPN connection are granted access to resources on the VPN server or the private network.

remote access VPN