- So I'd like to introduce you to some concepts about VPNs
and some terminology that you need to be familiar with
for the CCNA Exam
and just moving forward into your life
as a network admin or network engineer.
You're gonna hear these terms VPNs
and some of these other terms quite a lot.
So it helps to know what we're dealing with.
So what is a VPN?
So the acronym, VPN stands for Virtual Private Network
and it's really a compilation of two separate
overall themes,
a private network and a virtualized network.
What does that mean?
Well, let's take a look at
this whiteboard drawing here for a moment.
Imagine that you are the network administrator in charge
of company A and you have two sites.
Maybe they're cross the country from each other.
Site one and site two.
So as the network administrator of company A
first of all, you want all of this to be private.
In other words,
you want to make sure that when packets leave your network
that they go along your private connections
from one site to the other.
They don't possibly, they couldn't possibly end up
at your competitor's network
or somewhere where they're not supposed to be.
So you're packets are private.
Only seen by your network.
Travelling across your network connections.
Also, another thing is,
maybe these same packets in order to make them private
you want them to be encrypted
so that if anybody happens to sniff them
or catch them along the way, they can't see what's in there.
They don't know what kind of data that packet is holding.
So the privacy is that the packets go
from point A to point B,
site one to site two.
There's no other path it could possibly take.
You're in control.
The routing, the routing paths will never lead you astray
and lead your packets somewhere they shouldn't go.
And you probably also want some sort of privacy
on top of that as far as encrypting your data,
making sure that the data is authenticated,
that it's going to the right location.
So that's the private network here.
This is all yours, it's private.
Now what about a virtual private network?
Well imagine for a moment,
that this section here in the middle
is actually not owned by you.
This is not your network.
This is somebody else's network.
And as such there are other companies,
not your own company,
that are connected to that exact same section of routers
and switches and cables and everything like that
and their packets are going through
that exact same
red area
that your packets are going through.
But from the perspective of your routers
at site one and site two, they don't know that.
In other words, if we take a look at this router right here,
these routers on the edge,
they believe that they are connected to a private network.
Those routers have no idea
that the network they're connected to
is being shared with other companies.
They don't have to take any special precautions about that.
They trust that this network in the middle
is providing them privacy.
It looks like it's their network.
It looks like it's just an end to end network
connecting site one to site two.
It just looks like one big long network.
But in reality, the part in the middle is not yours.
It's sort of, providing you this virtual end to end network
when in reality you don't have an end to end network
that's fully in your control.
You are leasing or using the services
of somebody else's network in the middle
to give you that sort of end to end connectivity.
So that's why we say say virtual private network.
Because even though it looks like it's all yours,
this is just for you
and its private, just for you.
In reality, the section in the middle
could be also transporting lots and lots
of other customer's data.
But it looks like it's just for you.
That's why we call it a virtual private network.
So we're using or leasing another's network,
typically the public internet to connect two
or more of your sites together.
Now, before VPNs existed
how do we get this privacy?
How do we connect these various spoke sites to our hub
and maintain privacy and confidentiality?
Well, in order to do that,
we had to have point to point connections
between pretty much everything.
Each spoke would have to have
some sort of point to point connection to the hub.
And if you wanted the spokes to talk to each other
they'd have to have point to point connections between them.
You basically had to maintain a lot
of point to point connections.
And each one of those was a T-1
or a frame relay circuit or something.
That was very pricey.
But it was all yours.
Each one of those black lines there,
each one of these connections represented
your privacy.
So what you would have here is these grey lines
are what you're using for your internet connectivity.
There's no privacy here.
This is just what you went to the internet.
But if you want privacy between your spokes and your hubs,
that's what the black lines represented right here,
what I'm coloring in blue right now.
These were your point to point connections.
So you'd had to have not only connections to the internet,
that you were paying for or maintaining,
in addition to that every single month
you'd had to have these additional connections,
these point to point connections to give you privacy
between each of the spokes.
Or between the spokes and the hubs.
Another problem with this was that
a lot of subnets were in use right here.
For example,
look at just spoke number one.
There was some sort of IP subnet in use along this link,
give you a connection to the internet.
There was a second IP subnet that had to be used
for it's point to point connection with the hub.
A third subnet used
for it's point to point connection with spoke four.
And another one for spoke three.
And another one for spoke two.
So to maintain all of these connections
we had to have one, two, three, four, five subnets
just on one spoke one alone.
And as we know IP subnets come at a premium.
They are very,
they're rare.
There's, there's... They're running out.
And so this was not really a scalable situation.
But after VPNS were invented, then we could actually use
our existing connections to the internet.
And those connections to the internet
could actually do two things.
We could use that connection to the internet,
to actually send this normal data to the internet
to a web browsing or you know Google,
or amazon.com or whatever it was.
But we could use those same connections
to build these tunnels from one router to the other.
Now what do I mean by tunnel?
What I mean by tunnel is that there were IP packets,
we could have IP packets sent
from spoke one as an example
to this hub, to the hub.
Here's a tunnel.
The source of these packets would be spoke one.
The destination of these packets would be spoke two
but inside the packets themselves would be our data.
So whatever spoke one needed to send to hub one,
let's say there was some file server over here,
that the hub was connected to,
and there was some PC siting over here
in the office of spoke one.
Well, that PC when it sent data to the internet,
like just doing web browsing or whatever it was,
that information would just go
through the regular internet connection,
unencrypted, just normal.
But if that PC sent some data that was destined
for this server right here,
the spoke router would say, "Oh okay,
"I need to take that packet,
"put it inside of another packet, encrypt the body of it
"and then send it to the hub."
So even though, both packets are going through the internet
one packet's destined for an internet destination,
Google.com, CNN.com, BankofAmerica.com, whatever.
That's a regular unecrypted packet destined
for a point on the internet.
The other packet leaving this exact same physical interface
is destined for a server within your own company
at a different location.
And that s going through a tunnel
meaning we're protecting that packet.
We're adding privacy to that packet.
We're probably encrypting that packet
so somebody can't see what's inside of it.
So that's what,
that's how a VPN would give us that connectivity.
So now when it comes to VPNs,
there's two major types of
VPNS we need to be familiar with,
and just a couple more terms.
One type of VPN is called a Peer-to-Peer VPN.
So in a peer-to-peer VPN you can see
these dashed red lines in this particular case
indicate peerings of routing protocols
like EIGRP or OSPF
or maybe even BGP.
So in a peer-to-peer VPN
you are actually exchanging routes
with your service provider.
So you at the spoke would actually send
you know whatever your subnets are here
at your spoke location would send those subnets
to your service provider via some sort of routing protocol.
That would be something that you
and your service provider would work out.
Could be RIPv, could be OSPF, could be anything.
And then your service provider would have to have
some sort of routing protocol running
between their own routers
and then eventually, that route would pop out here
and this service provider,
remember we call it a provider edge router
or a provider edge would send it to the hub router.
So in peer-to-peer, we're really talking
about routing protocol Peering.
Who are you Peering with?
In some types of VPNs your router,
your customer premises router is actually forming
a routing relationship, an EIGRP neighbor relationship,
an OSBF neighbor relationship with the ISP's router.
And then the two of you are exchanging routes,
and you are relying on the ISP
to really get heavily involved here
to transfer those routes all the way
to the other end to your other site.
So that's called a Peer-to-Peer router.
So in this particular case,
the service provider is not only giving you
your physical and data link layer connectivity to the VPN
It's also providing you layer three connectivity
because you're doing routing with them,
with the service provider.
The other type of VPN,
is something called an overlay VPN.
This is the type of VPN where the service provider
all they're doing is giving you connectivity to their cloud.
You're not actually doing routing with them.
So with the service provider,
they're providing you like your physical
and your data link layer connectivity.
They're setting up your physical circuits
from one point to the other.
But as far as actual routing protocols are concerned
your router in
spoke location one
is actually forming an EIGRP
or an OSPF neighbor relationship
with your hub router which is hundreds
or maybe even thousands of miles away.
And so the VPN is just being overlayed,
or laid on top of whatever transport mechanism
the ISP address is actually giving you.
So they're just giving you the physical path,
they're providing like the street,
but you're the one who's actually driving the car
across the street.
So that would be like an overlay VPN.
And a couple of additional terms
Client-side or Site-side VPN.
So all the examples I've given you so far,
are called are called site-to-site VPNS.
What's that mean?
Well that means that there is some networking device
typically a router or some sort of security appliance
and that device sitting at the edge of your customer network
is the one that's implementing the tunnel.
That's the one that's encrypting
and de-encrypting all the traffic.
It's implementing all the VPN policies.
So the laptops, the PCs, the tablets and your company
they don't have to know anything
about what's getting involved.
All they're doing is just generated ethernet frames,
just generating IP packets and forwarding into the network.
Eventually those packets reach that edge router
that does all the encryption,
that does all the tunneling.
So from one site to another site,
everything from one site to another site
is being encrypted by these network infrastructure devices.
That's called a site-to-site VPN.
A Client VPN is like it says here,
something typically initiated by a client.
For example,
for those of you who are watching this video
who might be able to telecommute.
Maybe you work from home.
A lot of times, what companies will do
is if you work from home,
they'll install on your laptop some VPN software,
which might look something like this.
Where this an example of Cisco's
Anyconnect Secure Mobility Client.
This is an example of VPN software.
So on your laptop,
you actually double click this, you open it up.
You type in your credentials.
Whatever your company has given you
and now that tunnel, that security,
is actually being implemented from your laptop.
Your laptop is one end of the tunnel
going all the way to probably a router
or something at your corporate headquarters
and that's termining the tunnel on the other side.
So now the VPN is extending all the way to you,
the client.
You are one end of that VPN.
And so that is called a Client-Side VPN.
So what are some typical expectations of an VPN?
You know, why would people use these?
What are they hoping to get out of a VPN?
Well, number one, route exchange privacy.
In other words, if I'm doing routing in this VPN,
whether I'm peering with my service provider
and I'm sending them my routes,
or my service provider is just providing me the pathway
and I'm peering with my own router at the other end
of that tunnel that might be 300 miles away.
Either way,
when I send routes into that cloud that I don't own,
that network infrastructure that I'm renting,
I need some assurances that my routes
will not go to anybody else.
My routes will only go to where they're supposed to go.
That I won't accidentally learn
of routes from somebody else.
If you watch the video I did before this one on MPLS VPNs,
I mentioned how one of the primary benefits of MPLS VPNS
from a service provider's perspective,
is that they could have two different customers,
and give the customers the exact same networks.
This customer could be the 20-20 network
and this customer could be the 20-20 network.
Well the only way that's gonna work
is if we have route privacy.
In other words,
if the service provider somehow has some mechanisms
in place that he knows that packets from customer A
should only go to customer A,
and packets from customer B should only go to customer B.
Even if they're using the same subnet,
their service provider, the VPN has to have some way
of keeping those separated from each other.
That's what we mean by route exchange privacy.
And path determination for packets.
Same type of thing.
We wanna make sure that when I put a packet into my VPN,
there is no way that packet could end up
on my competitors network.
There's no way that packet could accidentally be leaked out
into the internet for everybody to see.
It should only go to one place.
The other end of this VPN
and the other end of the VPN is, belongs to me.
It's my site.
It's my secure site.
So I want some assurance that my packets will go
where they're supposed to go.
And then lastly, data security.
You know, if heavens forbid,
someone's able to actually to intercept my packet,
I don't want them to be able to tell what's inside of it.
And this is where we would typically use something called
IPSec, IP security,
which I'll look at in a real high level in just one second
after this slide.
But data security says, "I want to encrypt this packet,
"so that only the actually intended recipient,
"the person who's really supposed to get it,
"will actually be able to read it and understand it.
"If anybody else sees that packet who it is not meant for,
"they won't be able to tell what's inside of it,
"they won't know what it is."
So I want data security.
So typically, IPSec,
which stands for IP Security is what's used for this.
So IP security is sort of like an umbrella term
for a whole bunch of protocols.
And you sort of get to pick and choose
which of these security protocols,
that fall under the umbrella of IPSec,
that you actually want to use to secure your network,
to secure your VPN.
So depending on which protocols you choose,
IPSec can provide any or all
of these four things right here.
So all these protocols within IPSec are defined
in a wide variety of RFCs.
There's not just one RFC that says here's how you do IPSec.
Because we're talking about literally dozens
of different protocols that can do these types of things.
Each one has its own RFC,
and a lot of times there's multiple versions of the RFC.
So IPSec is just the umbrella term.
So depending on what protocols you select,
you might get confidentiality.
So confidentiality is like what I was talking about,
that's typically what we mean by when we say
data encryption, the data is confidential.
Someone can't see what's in the body of that packet
unless they are the intended recipient.
That packet is confidential.
Integrity.
Integrity means we have some way
of checking to see if anything in that packet
has been changed in transit.
You know, when someone was sending a bank transfer
and trying to do a deposit.
Is there someway that a zero was lost
and they're trying to deposit $1,000
and it showed up at the bank as $100?
That would be an example a loss of integrity.
So some IP set protocols can detect that.
They can say, "Wait a second here.
"This packet isn't exactly the same
"as when it first left the originator.
"Something's been changed.
"I've checked the integrity.
"Something's wrong here."
Integrity checking.
Authentication.
This is like what we talked about
when we talked about the point-to-point protocol.
Authentication simply means,
"Hey, before I send something to you,
"I need to make sure you are,
"who you really say you are.
"How do I know that you're the person
"I'm supposed to be talking to?"
So there's IP set protocols that can do that,
do that verification of authentication.
And the last one is anti-replay.
Anti-replay would be something like, okay,
let's say that somebody was watching our conversation.
And maybe they can't see the body of the packet,
but they get enough information that they can spoof me,
and now they can get free internet access
because they send packets to you
that look like they were coming from me,
when in reality, they weren't.
They just took my packets, copied them,
and resent them to you.
So you're actually getting duplicate copies of packets.
Packets are being replayed to you.
So anti-replay says how do we prevent that?
How do we prevent people from capturing packets
and replaying them back into the network?
How do we detect that that's happening?
So there's various collections
of security standards within IPSec
that can prevent that kind of thing
or detect that kind of thing from happening.
So that concludes this video on An Overview
and An Introduction of Virtual Private Networks.