An Introduction to VPN
Technology
QTS Ongoing Education
Series
1
Agenda
What is a Virtual Private Network (VPN)?
• VPN deployment situations
• Why use VPNs?
• Types of VPN protocols
IPSec VPNs
• Components
• A sample session
Deployment questions
2
What is VPN?
Virtual Private Network is a type of private
network that uses public
telecommunication, such as the Internet,
instead of leased lines to communicate.
Became popular as more employees
worked in remote locations.
Terminologies to understand how VPNs
work.
3
What is a VPN?
Acme Corp
A VPN is a private
connection over an
open network VPN
A VPN includes
authentication and Internet
encryption to
protect data
integrity and
VPN
confidentiality
Acme Corp
Site 2
4
Private Networks
vs.
Virtual Private Networks
Employees can access the network (Intranet) from
remote locations.
Secured networks.
The Internet is used as the backbone for VPNs
Saves cost tremendously from reduction of
equipment and maintenance costs.
Scalability
5
Remote Access Virtual Private
Network
6
Brief Overview of How it Works
Two connections – one is made to
the Internet and the second is made
to the VPN.
Datagrams – contains data,
destination and source information.
Firewalls – VPNs allow authorized
users to pass through the firewalls.
Protocols – protocols create the VPN
tunnels.
7
Tunneling
A virtual point-to-point connection
made through a public network. It
transports
encapsulated datagrams.
Original Datagram
Encrypted Inner Datagram
Datagram Header Outer Datagram Data Area
Two types of end points:Data Encapsulation [From Comer]
Remote Access
Site-to-Site
8
Four Protocols used in VPN
PPTP -- Point-to-Point Tunneling
Protocol
L2TP -- Layer 2 Tunneling Protocol
IPsec -- Internet Protocol Security
SOCKS – is not used as much as the
ones above
9
VPN Encapsulation of Packets
10
Types of Implementations
What does “implementation” mean in
VPNs?
3 types
Intranet – Within an organization
Extranet – Outside an organization
Remote Access – Employee to Business
11
Virtual Private Networks (VPN)
Basic Architecture
12
Types of VPNs
Corporate
Remote Access VPN Site
• Provides access to
internal corporate
network over the
Internet
• Reduces long distance,
modem bank, and
technical support costs Internet
13
Types of VPNs
Corporate
Site
Remote Access VPN
Site-to-Site VPN
• Connects multiple
offices over Internet
• Reduces dependencies
on frame relay and
Internet
leased lines
Branch
Office
14
Types of VPNs
Corporate
Remote Access VPN Site
Site-to-Site VPN
Extranet VPN
• Provides business
partners access to
critical information
(leads, sales tools, etc) Internet
• Reduces transaction
and operational costs
Partner #2
Partner #1
15
Types of VPNs
Remote Access VPN Database
Site-to-Site VPN Server
Extranet VPN
Client/Server VPN LAN
clients Internet
• Protects sensitive
internal
communications
• Most attacks originate
within an organization
LAN clients with
sensitive data
16
Why Use Virtual Private
Networks?
More flexibility
• Leverage ISP point of presence
• Use multiple connection types (cable,
DSL, T1, T3)
17
Why Use Virtual Private
Networks?
More flexibility
More scalability
• Add new sites, users quickly
• Scale bandwidth to meet demand
18
Why Use Virtual Private
Networks?
More flexibility
More scalability
Lower costs
• Reduced frame relay/leased line costs
• Reduced long distance
• Reduced equipment costs (modem
banks,CSU/DSUs)
• Reduced technical support
19
Components of a VPN
Encryption
Message authentication
Entity authentication
Key management
20
Point-to-Point Tunneling
Protocol
Layer 2 remote access VPN distributed with Windows
product family
• Addition to Point-to-Point Protocol (PPP)
• Allows multiple Layer 3 Protocols
Uses proprietary authentication and ancryption
Limited user management and scalability
Known security vulnerabilities
Corporate Network
Remote PPTP Client
PPTP RAS Server
Internet
ISP Remote Access
21
Switch
Layer 2 Tunneling Protocol
(L2TP)
Layer 2 remote access VPN protocol
• Combines and extends PPTP and L2F (Cisco supported
protocol)
• Weak authentication and encryption
• Does not include packet authentication, data integrity,
or key management
• Must be combined with IPSec for enterprise-level
security Corporate Network
Remote L2TP Client
L2TP Server
Internet
22
ISP L2TP Concentrator
Internet Protocol Security
(IPSec)
Layer 3 protocol for remote access,
intranet, and extranet VPNs
• Internet standard for VPNs
• Provides flexible encryption and
message authentication/integrity
• Includes key management
23
Components of an IPSec VPN
Encryption DES, 3DES, and more
Message HMAC-MD5, HMAC-
Authentication SHA-1, or others
Entity Digital Certificates,
Authentication Shared Secrets,Hybrid
Mode IKE
Key Management Internet Key Exchange
(IKE), Public Key
Infrastructure (PKI)
All managed by security associations (SAs)
24
Security Associations
An agreement between two parties
about:
• Authentication and encryption algorithms
• Key exchange mechanisms
• And other rules for secure communications
Security associations are negotiated at
least once per session – possibly more
often for additional security
25
Encryption Explained
Used to convert data to a secret code
for transmission over an untrusted
network
Clear Text Encrypted Text
“The cow jumped Encryption “4hsd4e3mjvd3sd
over the moon” Algorithm a1d38esdf2w4d”
26
Symmetric Encryption
Same key used to encrypt and decrypt
message
Faster than asymmetric encryption
Used by IPSec to encrypt actual message data
Examples: DES, 3DES, RC5, Rijndael
Shared Secret Key
27
Asymmetric Encryption
Different keys used to encrypt and decrypt
message (One public, one private)
Provides non-repudiation of message or
message integrity
Examples include RSA, DSA, SHA-1, MD-5
Bob Alice
Alice Public Key Alice Private Key
Encrypt Decrypt
28
Key Management
Shared Secret
• Simplest method; does not scale
• Two sites share key out-of-band (over
telephone, mail, etc)
Public Key Infrastructure
• Provides method of issuing and managing
public/private keys for large deployments
Internet Key Exchange
• Automates the exchange of keys for scalability
and efficiency
29
What are Keys?
An Encryption Key is:
• A series of numbers
and letters…
• …used in conjunction
with an encryption
algorithm…
• …to turn plain text into
encrypted text and
back into plain text
The longer the key, the
stronger the encryption
30
What is Key Management?
A mechanism for
distributing keys
either manually or
automatically
Includes:
• Key generation
• Certification
• Distribution
• Revocation
31
Internet Key Exchange (IKE)
Automates the exchange of security
associations and keys between two VPN
sites
IKE provides:
• Automation and scalability
• Improved security
Encryption keys be changed frequently
Hybrid IKE
• Proposed standard designed by Check Point
• Allows use of existing authentication methods
32
Different Types of VPN/Firewall
Topologies
VPN device is vulnerable to
Firewall VPN Internet attack eg. denial of service
Two connections to the
firewall for every
VPN Firewall Internet
Internet communication request
VPN Bypasses security policy
Internet Denial of service
Firewall
33
Different Types of VPN/Firewall
Topologies
VPN device is vulnerable to
Firewall VPN Internet attack eg. denial of service
Only integrated VPN/firewall solutions
can deliver full accessTwo connections to the
control
firewall for every
VPN Firewall Internet
Internet
and consistent security policy enforcement
communication request
VPN Bypasses security policy
Internet Denial of service
Firewall
34
Protecting Remote Access
VPNs
The Problem:
• Remote access VPN clients can be “hijacked”
Allows attackers into internal network
The Solution:
• Centrally managed personal firewall on VPN
clients Attacker
Cable or xDSL
Internet
35
Advantages
VS.
Disadvantages
36
Advantages: Cost Savings
Eliminating the need for expensive long-
distance leased lines
Reducing the long-distance telephone
charges for remote access.
Transferring the support burden to the
service providers
Operational costs
37
Advantages: Scalability
Flexibility of growth
Efficiency with broadband technology
38
Disadvantages
VPNs require an in-depth understanding of
public network security issues and proper
deployment of precautions
Availability and performance depends on
factors largely outside of their control
Immature standards
VPNs need to accommodate protocols
other than IP and existing internal
network technology
39
Applications: Site-to-Site VPNs
Large-scale encryption between
multiple fixed sites such as remote
offices and central offices
Network traffic is sent over the
branch office Internet connection
This saves the company hardware
and management expenses
40
Site-to-Site VPNs
41
Applications: Remote Access
Encrypted connections between mobile or
remote users and their corporate networks
Remote user can make a local call to an
ISP, as opposed to a long distance call to
the corporate remote access server.
Ideal for a telecommuter or mobile sales
people.
VPN allows mobile workers &
telecommuters to take advantage of
broadband connectivity.
i.e. DSL, Cable 42
Industries That May Use a VPN
Healthcare: enables the transferring of confidential patient
information within the medical facilities & health care provider
Manufacturing: allow suppliers to view inventory & allow clients
to purchase online safely
Retail: able to securely transfer sales data or customer info
between stores & the headquarters
Banking/Financial: enables account information to be
transferred safely within departments & branches
General Business: communication between remote employees
can be securely exchanged
43
Some Businesses using a VPN
CVS Pharmaceutical Corporation upgraded
their frame relay network to an IP VPN
ITW Foilmark secured remote location
orders, running reports, & internet/intranet
communications w/ a 168-bit encryption by
switching to OpenReach VPN
Bacardi & Co. Implemented a 21-country,
44-location VPN
44
Where Do We See VPNs
Going in the Future?
VPNs are continually being enhanced.
Example: Equant NV
As the VPN market becomes larger, more
applications will be created along with
more VPN providers and new VPN types.
Networks are expected to converge to
create an integrated VPN
Improved protocols are expected, which
will also improve VPNs.
45
Summary
Virtual Private Networks have become
mission-critical applications
IPSec is the leading protocol for creating
enterprise VPNs
• Provides encryption, authentication, and data
integrity
Organizations should look for:
• Integrated firewalls and VPNs
• Centralized management of VPN client security
• A method to provide VPN QoS
46
Pop Quiz!
Q.1
VPN stands for…
a) Virtual Public Network b) Virtual Private Network
d)
c) Virtual Protocol Network
Virtual Perimeter Network
47
Pop Quiz!
A.1
VPN stands for…
b) Virtual Private Network
VPN stands for "Virtual Private Network" or "Virtual Private Networking." A VPN is a
private network in the sense that it carries controlled information, protected by various
security mechanisms, between known parties. VPNs are only "virtually" private,
however, because this data actually travels over shared public networks instead of fully
dedicated private connections.
48
Pop Quiz!
Q.2
What are the acronyms for the 3 most common VPN
protocols?
49
Pop Quiz!
A.2
3 most common VPN protocols are…
• PPTP
• L2TP
• IPsec
PPTP, IPsec, and L2TP are three of today's most popular VPN tunneling protocols. Each
one of these is capable of supporting a secure VPN connection.
50
Pop Quiz!
Q.3
What does PPTP stand for?
51
Pop Quiz!
A.3
PPTP = Point-to-Point Tunneling Protocol !
52
Pop Quiz!
Q.4
What is the main benefit of VPNs compared to
dedicated networks utilizing frame relay, leased
lines, and traditional dial-up?
a) better network performance b) less downtime on average
c) reduced cost d) improved security
53
Pop Quiz!
A.4
The main benefit of VPNs is…
c) reduced cost
The main benefit of a VPN is the potential for significant cost savings compared to
traditional leased lines or dial up networking. These savings come with a certain amount
of risk, however, particularly when using the public Internet as the delivery mechanism
for VPN data.
54
Pop Quiz!
Q.5
In VPNs, the term "tunneling" refers to
a) an optional feature b) the encapsulation of packets inside
that increases network packets of a different protocol to
performance if it is create and maintain the virtual circuit
turned on
c) the method a system d) a marketing strategy that involves
administrator uses to selling VPN products for very low
detect hackers on the prices in return for expensive service
network contracts
55
Pop Quiz!
A.5
In VPNs, the term "tunneling" refers to…
b) the encapsulation of packets inside packets
of a different protocol to create and
maintain the virtual circuit
56
