Chapter 5.5 Virtual Private Networks

VPN Tunneling Protocol

A VPN uses a Tunneling Protocol that encrypts packet contents and wraps them in an unencrypted packet. The Tunneling Protocol (also referred to as the VPN Protocol) identifies the methods that devices use to establish the VPN connection and encrypt the data. The three types of protocols used by VPNs are: Carrier Protocol (such as IP). Tunneling Protocol (such as PPTP or L2TP). Passenger Protocol (for the data being transmitted). Many networks make use of a piece of hardware called a VPN concentrator. VPN concentrators are advanced routers that can create and maintain many secure connections to the network through VPN tunnels.

Point-to-Point Tunneling Protocol(PPTP)

A early tunneling protocol developed by Microsoft. PPTP does the following: Uses standard authentication protocols, such as Challenge-Handshake Authentication Protocol (CHAP) or Password Authentication Protocol (PAP) Supports TCP/IP only Encapsulates other LAN protocols and carries the data securely over an IP network Uses Microsoft's MPPE for data encryption Is supported by most operating systems and servers Uses TCP port 1723

Transport Layer Security(TLS)

A protocol that evolved from SSL and provides privacy and data integrity between two communicating applications. When securing a connection with a VPN, TLS: Authenticates the server to the client, using public key cryptography and digital certificates Encrypts the entire communication session Uses port 443 or port 30

Virtual Private Network (VPN)

A remote access connection that uses encryption to securely send data over an untrusted network.

Layer 2 Tunneling Protocol(L2TP)

An open standard for secure multi-protocol routing. L2TP does the following: Operates at the Data Link layer (Layer 2) Supports multiple protocols (not just IP) Uses IPsec for encryption. Combining L2TP with IPsec (called L2TP/IPsec) provides:Per-packet data-origin authentication (non-repudiation)Replay protectionData confidentiality Is not supported by older operating systems Uses TCP port 1701 and UDP port 500

SSL does the following:

Authenticates the server to the client using public key cryptography and digital certificates Encrypts the entire communication session Uses port 443, which is a port that is often already open in most firewalls Implementations that use SSL for VPN tunneling include Microsoft's SSTP and Cisco's SSL VPN.

Tunneling

Communication method that encrypts packet contents and encapsulates them for routing though a public network.

IPsec can be used to secure communications such as:

Host-to-host communications within a LAN VPN communications through the internet, either by itself or in conjunction with the L2TP VPN Protocol Any traffic supported by the IP protocol, including web, email, Telnet, file transfer, SNMP traffic, and countless others

Be aware of the following additional characteristics of IPsec:

It functions at the Network layer (Layer 3) of the OSI model It uses either digital certificates or pre-shared keys It generally can't be used when a NAT proxy is deployed

Which VPN protocol typically employs IPsec as its data encryption mechanism? PPTP L2TP L2F PPP

L2TP

Which of the following VPN protocols is no longer considered secure? SSL IPsec TLS PPTP

PPTP

Which VPN implementation uses routers on the edge of each site? Always-on VPN Site-to-site VPN Remote access VPN Host-to-host VPN

Site-to-site VPN

Which VPN tunnel style routes only certain types of traffic? Full Site-to-site Split Host-to-host

Split

A VPN is primarily used for which of the following purposes? Allow remote systems to save on long-distance charges Allow the use of network-attached printers Support secured communications over an untrusted network Support the distribution of public web documents

Support secured communications over an untrusted network

Which statement BEST describes IPsec when used in tunnel mode? The identities of the communicating parties are not protected IPsec in tunnel mode may not be used for WAN traffic The entire data packet, including headers, is encapsulated Packets are routed using the original headers, and only the payload is encrypted

The entire data packet, including headers, is encapsulated

IPSec has Two modes of operation

They are based on the relationship of the communicating devices to each other. Transport Mode is used for end-to-end encryption of data. The packet data is protected, but the header is left intact, allowing intermediary devices (such as routers) to examine the packet header and use the information in routing packets. Tunnel Mode is used for link-to-link communications. Both the packet contents and the header are encrypted.

VPN and Wireless Networks

VPNs can also be used to help secure connections made over open wireless networks. Many establishments, such as airports, hotels, and restaurants, provide unsecured public Wi-Fi access. Because encryption is not used to secure the wireless connection, many users are hesitant to use these networks. In most cases, this hesitancy is warranted. However, it is generally considered acceptable to use a VPN connection to securely transfer data over an open Wi-Fi network. As long as strong tunneling ciphers and protocols are used, the VPN provides sufficient encryption to secure the connection even though the wireless network itself is not encrypted. It is recommended that you use IPsec or SSL to secure the VPN because these protocols are relatively secure. Avoid using PPTP with MS-CHAPv2 as this configuration setup is no longer considered secure. If you are using a VPN over an open wireless network and need to access a secure website, be sure your browser's HTTPS requests go through the VPN connection. To conserve VPN bandwidth and improve latency, many VPN solutions automatically reroute web browsing traffic through the client's default network connection instead of through the VPN tunnel. This behavior would result in HTTP/HTTPS traffic being transmitted over the insecure open wireless network instead of through the secure VPN tunnel.

Internet Protocol Security(IPsec)

A set of protocols that provides security for Internet Protocol (IP) that can be used in conjunction with L2TP or to set up a VPN solution. IPsec includes two protocols that provide different features. Authentication Header (AH) provides authentication features. Use AH to enable authentication with IPsec. Encapsulating Security Payload (ESP) provides data encryption. Use ESP to encrypt data.If you use AH alone, data is not encrypted.

Layer 2 Forwarding(L2F)

A tunneling protocol developed by Cisco to establish virtual private network connections over the internet. Operates at the Data Link layer (Layer 2) Offers mutual authentication Does not encrypt data Merged with PPTP to create L2TP

VPN Basics

A virtual private network (VPN) is a remote-access connection that uses encryption to securely send data over an untrusted network. By using a VPN, you can take advantage of an existing internet connection to securely communicate between devices. When working with VPNs, consider the following: A VPN provides an alternative to:WAN connectionsConnections that use telephone lines and a remote access server VPNs work by using a Tunneling Protocol that encrypts packet contents and encapsulates those packets.The encapsulated packets are routed through the internet using the information in the packet header.When the packet reaches the destination device, the outer wrapping encapsulating the packets and the encryption is removed.Only the destination device is allowed to remove the wrapping and restore the packet to its original form. The following are two styles of VPN tunnels commonly used:Full tunnel, which routes all of a user's network traffic through the VPN tunnel. This can sometimes send traffic that is not necessary.Split tunnel, which routes only certain types of traffic, usually determined by destination IP address, through the VPN tunnel. All other traffic is passed through the normal internet connection. VPNs can be implemented in the following ways:A host-to-host VPN allows an individual host connected to the internet to establish a VPN connection to another host on the internet. Both devices must be configured for a VPN connection and have the software to encrypt and encapsulate the packets.A site-to-site VPN uses routers on the edge of each site. The routers are configured for a VPN connection and encrypt and decrypt the packets being passed between the sites. With this configuration, individual hosts are unaware of the VPN.A remote-access VPN uses a server (called a VPN concentrator) configured to accept VPN connections from individual hosts.The VPN concentrator is located on the edge of a network.The VPN concentrator establishes multiple connections with multiple hosts.The individual hosts must be able to establish a VPN connection.The hosts can access resources on the VPN server or the private network using the VPN connection.An always-on VPN employs the concept that a user is always on the VPN, whether physically within the LAN or remotely. There is no turning it on or off. All traffic is basically fully tunneled. Tunnel endpoints are devices that can encrypt and decrypt packets. When you create a VPN, you establish a security association between the two tunnel endpoints. These endpoints create a secure virtual communication channel. Only the destination tunnel endpoint can unwrap packets and decrypt the packet contents. Routers use the decrypted packet headers to deliver the packet to the destination device. Intermediate routers along the path cannot read the encrypted packet contents. When implementing a VPN, be sure to:Select a protocol that is supported by all devices that need to encrypt and encapsulate packets.Open the appropriate ports to allow VPN traffic through the firewall.

Secure Sockets Layer(SSL)

A well-established protocol to secure IP protocols, such as HTTP and FTP.The Secure Sockets Layer (SSL) Protocol has long been used to secure traffic generated by other IP protocols, such as HTTP, FTP, and email. SSL can also be used as a VPN solution, typically in a remote-access scenario.

A salesperson in your organization spends most of her time traveling between customer sites. After a customer visit, she must complete various managerial tasks, such as updating your organization's order database. Because she rarely comes back to your home office, she usually accesses the network from her notebook computer using Wi-Fi access provided by hotels, restaurants, and airports. Many of these locations provide unencrypted public Wi-Fi access, and you are concerned that sensitive data could be exposed. To remedy this situation, you decide to configure her notebook to use a VPN when accessing the home network over an open wireless connection. Which key steps should you take when implementing this configuration? (Select two.) Configure the browser to send HTTPS requests directly to the Wi-Fi network without going through the VPN connection Configure the VPN connection to use PPTP Configure the browser to send HTTPS requests through the VPN connection Configure the VPN connection to use MS-CHAPv2 Configure the VPN connection to use IPsec

Configure the browser to send HTTPS requests through the VPN connection Configure the VPN connection to use IPsec

Which IPSec subprotocol provides data encryption? SSL AES AH ESP

ESP

In addition to Authentication Header (AH), IPsec is comprised of what other service? Extended Authentication Protocol (EAP) Encapsulating Security Payload (ESP) Advanced Encryption Standard (AES) Encryption File System (EFS)

Encapsulating Security Payload (ESP)

A group of salesmen would like to remotely access your private network through the internet while they are traveling. You want to control access to the private network through a single server. Which solution should you implement? IDS VPN concentrator DMZ IPS

VPN concentrator