All right, what is a VPN?
Vpns, again, give us virtual private access used to securely communicate
with different computers over insecure channels.
So they're going to use a tunneling protocol and most likely an encryption
protocol to protect your data and encapsulate the packets for the journey.
Vpn architecture can vary from purpose to
model, to protocols, to SSL, to IPSec, SSH, etc.
So couple of things to consider.
The VPN needs to encapsulate the packets and also encrypt the packets.
So the VPN would work
by using authorization and encryption to connect the external host security.
Now, a lot of this stuff is sent through a
VPN Concentrator, which they actually introduced in the previous slide.
A VPN Concentrator is typically going to
have better performance for your VPN connections.
Anything that's hardware based is meant to accelerate performance.
Otherwise, you have individual connections
being established and processed on the servers themselves, and that can
definitely lead to overuse of resources and processing loads.
Our VPN Concentrator. There you go.
Used to create secure VPN connections, acts as a router, which is generally used
to create a remote access or site to site VPN.
Uses tunneling protocols to negotiate
security parameters, create managed tunnels, encapsulate transmitter receive
packets through the tunnel and de encapsulate them.
Okay, really quickly, encapsulation
is my packet, header, and payload put in the payload of another packet.
When you encapsulate, you put a protocol inside of another protocol.
We actually have lots of different examples of encapsulation.
As a matter of fact, any HTTP connection or TCP base connection
has multiple layers of encapsulation and de encapsulation.
But in this case, the whole packet goes in
the payload of another packet, it's used to route from one gateway to another.
On the receiving end, the packet is then taken out and sent back on the network.
The encapsulation makes the internal packet unaware of the
journey it's taking from endpoint to endpoint.
That's tunneling, encapsulation.
Encryption is encrypting the data so that it can't be decoded.
Just by tunneling, that's still clear text.
Again, that puts a smile on the attacker's face.
When I encrypt it, that puts a frown on the attacker's face
and turns that smile upside down because now they can't read it.
I guess we could do throw a brow for that.
You want to do both to
secure your connections across an untrusted network segment.
Client to site or remote access VPNs allow individual hosts or clients such as
telecommutors and mobile users to establish connection.
While you're on the road, you get to connect to the main office.
That's just really cool.
Wherever we are on planet Earth, especially with high speed connectivity
these days, we can be on the company network.
We can work 24 7 from anywhere, which is either a good thing or a bad thing.
Each host contains the VPN client software or uses a web based client.
The VPN encrypts the data packets, forwards it to the gateway.
The gateway receives the packets and then
closes the connection to the VPN after the transfer is complete.
All right, so client to site remote access.
All my individual clients calling to the home office.
Site to site VPNs classified in two types.
You have intranet based and extranet based.
Intranet based connectivity between sites of a single organization.
Extranet based between different organizations like
business partners, business and its clients.
Whenever you see the term extranet, it's
customers and partners but not necessarily fully trusted, right?
Because don't ever 100 % trust our partners or customers.
So again, an extranet is a portion of your network that acts like a DMZ but typically
has a higher level of trust, some degree of authentication.
So when we're communicating with our
business partners and customers, extranet based, we're communicating between
intranets or multiple sites, it's intranet based.
All right, so site to site is a nice replacement for dedicated or leased lines.
Prior to VPNs, we would use metropolinary networks or wide array networks, ATM,
frame relay, I almost said TS1 lines, T1 lines, and so forth.
Back when I first got into IT, as a
career, we were really cool at benchmark computer learning.
Shout out to the benchmark, because we had a full T1 line.
Oh, yeah, that's right. We paid like 900 bucks a month for that
thing, but it was a full 1.544 megabits of connectivity.
It's dedicated line.
We had other remote sites that we tied in with lease lines as well.
But then once the internet bandwidth became way higher than it was back then,
you can just put everything in your internet connection.
That's another discussion for another day.
The evolution of technologies and the bandwidth has increased
incredibly since 1999 when I first got into this as a career.
Prior to that, the old 300 baud modems, that thing.
Hardware VPNs.
Dedicated hardware VPN appliance is used
to connect routers and gateways to ensure communication over an insecure channel.
Again, VPNs secure channel over an insecure, untrusted network.
Designed to serve as a VPN endpoint and can connect to multiple lands.
Software VPNs installed and configured on routers, servers and firewalls.
Software never performs as well as hardware.
That's the reason you implement hardware is because the performance is much better.
But no extra devices need to be installed.
It's an easy and low cost way to deploy VPN.
Does not change the target network.
But again, depending on the volume, you
might be better served to install hardware accelerators.
Encapsulation. I gave this away already, but
encapsulation is accomplished through point to point tunneling protocol, layer
two tunneling protocol, secure shell, or SOx, or IPSec.
So encapsulation, again, is just putting
the packet inside of another packet and PPTP, L2TP, these are probably the two
most notable VPN protocols from the Microsoft days.
We do have secure shell, which I come from a Microsoft background, so the two we
always harped on the most were PPTP and L2TP.
You can throw IP second there as well
because tunnel mode does give you encapsulation.
Ssh on your Linux variety host, and of course, you got socks.
Encryption.
Common VPN encryption technologies.
You got DES and Triple DES.
Secure Sockets layer, which again uses symmetric encryption, and then Open VPN.
Packets sent over VPN are encrypted to
maintain confidentiality of the information.
Packets are read by decrypting with the encryption key from the center.
And there is a little bit of a discussion of certificate authorities, which again,
we might use certificates for authentication.
For authentication, you should definitely authenticate your VPN users.
Users are authenticated to access the VPN and its resources.
You may use digital certificates.
You may also use authentication protocols, pre shared key, Kerberos, IPSec, MS CHAP.
Digital certificates are one of the most secure.
Shared key authentication, that stuff can be cracked.
Kerberos, if you've got a trust
relationship with a target environment, is definitely an option as well.
The different topologies.
Hub and Spoke, for example.
In a hub and Spoke, each individual spoke is connected to the remote office is
communicated securely with the central hub.
So each of these guys is connected to the hub.
A persistent connection is established between the organization's main offices
and their branch offices using a third party network and the internet.
You have a separate and secure tunnel
established between the hub and each individual spoke.
All right, pretty straightforward.
All right, now point to point.
Unlike hub and spoke, offices at different locations can
communicate directly with each other without any IPSec failover.
So now you got dedicated connections between the different sites.
Point to point is dedicated, and you can
actually create a full mesh topology out of this.
The topology creates two endpoints as two
peer devices participating in communication, so direct connections.
Only regular IPSec or generic routing encapsulation is
assigned for the tunnel, and the peer devices can initiate the connection.
On a full mesh, you've got a combination of hub and spoke and point to point.
So in a full mesh, you have redundant pathways.
Topology is suitable for complicated
networks where all peers communicate with one another.
Okay, device to device communication takes place with a unique IPsec tell...
I said hub and spoke, didn't I? The internet.
So direct connection between all.
That way, if one link goes down, the other can be established.
The peer to peer connection is established between each device, preventing a
bottleneck at the VPN gateway, saving encryption, decryption, overhead.
Great for redundancy and reliability.
Then the Star topology
allows remote branches to securely communicate with corporate headquarters.
Interconnection between branches is not allowed as in the hub and spoke.
They all communicate with the mother ship, but not each other.
Jmp servers, also referred to as a JMP box
or JMP Host, is an intermediate gateway inside a secure environment that basically
portals you to the remote side and a network that's used to connect or
access hosts or devices located in another security zone such as a DMZ.