An Introduction to VPN

Technology
QTS Ongoing Education
Series

1
 Agenda
 What is a Virtual Private Network (VPN)?
• VPN deployment situations
• Why use VPNs?
• Types of VPN protocols
 IPSec VPNs
• Components
• A sample session
 Deployment questions

2
 What is VPN?
 Virtual Private Network is a type of private
network that uses public
telecommunication, such as the Internet,
instead of leased lines to communicate.

 Became popular as more employees

worked in remote locations.

 Terminologies to understand how VPNs

work.

3
 What is a VPN?
Acme Corp
 A VPN is a private
connection over an
open network VPN

 A VPN includes
authentication and Internet
encryption to
protect data
integrity and
VPN
confidentiality
Acme Corp
Site 2
4
 Private Networks
vs.
Virtual Private Networks
 Employees can access the network (Intranet) from
remote locations.

 Secured networks.

 The Internet is used as the backbone for VPNs

 Saves cost tremendously from reduction of

equipment and maintenance costs.

 Scalability
5
Remote Access Virtual Private
Network

6
 Brief Overview of How it Works
 Two connections – one is made to
the Internet and the second is made
to the VPN.
 Datagrams – contains data,
destination and source information.
 Firewalls – VPNs allow authorized
users to pass through the firewalls.
 Protocols – protocols create the VPN
tunnels.
7
 Tunneling
A virtual point-to-point connection
made through a public network. It
transports
encapsulated datagrams.
Original Datagram

Encrypted Inner Datagram

Datagram Header Outer Datagram Data Area

Two types of end points:Data Encapsulation [From Comer]

 Remote Access
 Site-to-Site
8
 Four Protocols used in VPN
 PPTP -- Point-to-Point Tunneling
Protocol

 L2TP -- Layer 2 Tunneling Protocol

 IPsec -- Internet Protocol Security

 SOCKS – is not used as much as the

ones above
9
VPN Encapsulation of Packets

10
 Types of Implementations
 What does “implementation” mean in
VPNs?

 3 types
Intranet – Within an organization
Extranet – Outside an organization
Remote Access – Employee to Business

11
Virtual Private Networks (VPN)
Basic Architecture

12
 Types of VPNs
Corporate
 Remote Access VPN Site
• Provides access to
internal corporate
network over the
Internet
• Reduces long distance,
modem bank, and
technical support costs Internet

13
 Types of VPNs
Corporate
Site

 Remote Access VPN

 Site-to-Site VPN
• Connects multiple
offices over Internet
• Reduces dependencies
on frame relay and
Internet
leased lines

Branch
Office
14
 Types of VPNs
Corporate
 Remote Access VPN Site

 Site-to-Site VPN
 Extranet VPN
• Provides business
partners access to
critical information
(leads, sales tools, etc) Internet
• Reduces transaction
and operational costs
Partner #2
Partner #1

15
 Types of VPNs
 Remote Access VPN Database
 Site-to-Site VPN Server

 Extranet VPN
 Client/Server VPN LAN
clients Internet
• Protects sensitive
internal
communications
• Most attacks originate
within an organization
LAN clients with
sensitive data

16
 Why Use Virtual Private
Networks?
 More flexibility
• Leverage ISP point of presence
• Use multiple connection types (cable,
DSL, T1, T3)

17
 Why Use Virtual Private
Networks?
 More flexibility
 More scalability
• Add new sites, users quickly
• Scale bandwidth to meet demand

18
 Why Use Virtual Private
Networks?
 More flexibility
 More scalability
 Lower costs
• Reduced frame relay/leased line costs
• Reduced long distance
• Reduced equipment costs (modem
banks,CSU/DSUs)
• Reduced technical support

19
 Components of a VPN
 Encryption
 Message authentication
 Entity authentication
 Key management

20
 Point-to-Point Tunneling
Protocol
 Layer 2 remote access VPN distributed with Windows
product family
• Addition to Point-to-Point Protocol (PPP)
• Allows multiple Layer 3 Protocols
 Uses proprietary authentication and ancryption
 Limited user management and scalability
 Known security vulnerabilities
Corporate Network
Remote PPTP Client
PPTP RAS Server

Internet

ISP Remote Access

21
Switch
 Layer 2 Tunneling Protocol
(L2TP)
 Layer 2 remote access VPN protocol
• Combines and extends PPTP and L2F (Cisco supported
protocol)
• Weak authentication and encryption
• Does not include packet authentication, data integrity,
or key management
• Must be combined with IPSec for enterprise-level
security Corporate Network
Remote L2TP Client

L2TP Server

Internet

22
ISP L2TP Concentrator
 Internet Protocol Security
(IPSec)
 Layer 3 protocol for remote access,
intranet, and extranet VPNs
• Internet standard for VPNs
• Provides flexible encryption and
message authentication/integrity
• Includes key management

23
 Components of an IPSec VPN
 Encryption  DES, 3DES, and more
 Message  HMAC-MD5, HMAC-
Authentication SHA-1, or others
 Entity  Digital Certificates,
Authentication Shared Secrets,Hybrid
Mode IKE
 Key Management  Internet Key Exchange
(IKE), Public Key
Infrastructure (PKI)

All managed by security associations (SAs)

24
 Security Associations
 An agreement between two parties
about:
• Authentication and encryption algorithms
• Key exchange mechanisms
• And other rules for secure communications
 Security associations are negotiated at
least once per session – possibly more
often for additional security

25
 Encryption Explained
 Used to convert data to a secret code
for transmission over an untrusted
network

Clear Text Encrypted Text

“The cow jumped Encryption “4hsd4e3mjvd3sd

over the moon” Algorithm a1d38esdf2w4d”

26
 Symmetric Encryption
 Same key used to encrypt and decrypt
message
 Faster than asymmetric encryption
 Used by IPSec to encrypt actual message data
 Examples: DES, 3DES, RC5, Rijndael

Shared Secret Key

27
 Asymmetric Encryption
 Different keys used to encrypt and decrypt
message (One public, one private)
 Provides non-repudiation of message or
message integrity
 Examples include RSA, DSA, SHA-1, MD-5
Bob Alice

Alice Public Key Alice Private Key

Encrypt Decrypt
28
 Key Management
 Shared Secret
• Simplest method; does not scale
• Two sites share key out-of-band (over
telephone, mail, etc)
 Public Key Infrastructure
• Provides method of issuing and managing
public/private keys for large deployments
 Internet Key Exchange
• Automates the exchange of keys for scalability
and efficiency

29
 What are Keys?
 An Encryption Key is:
• A series of numbers
and letters…
• …used in conjunction
with an encryption
algorithm…
• …to turn plain text into
encrypted text and
back into plain text
 The longer the key, the

stronger the encryption

30
 What is Key Management?
 A mechanism for
distributing keys
either manually or
automatically
 Includes:
• Key generation
• Certification
• Distribution
• Revocation

31
 Internet Key Exchange (IKE)
 Automates the exchange of security
associations and keys between two VPN
sites
 IKE provides:
• Automation and scalability
• Improved security
 Encryption keys be changed frequently
 Hybrid IKE
• Proposed standard designed by Check Point
• Allows use of existing authentication methods
32
Different Types of VPN/Firewall
Topologies
VPN device is vulnerable to
Firewall VPN Internet attack eg. denial of service

Two connections to the

firewall for every
VPN Firewall Internet
Internet communication request

VPN Bypasses security policy

Internet Denial of service

Firewall

33
Different Types of VPN/Firewall
Topologies
VPN device is vulnerable to
Firewall VPN Internet attack eg. denial of service

Only integrated VPN/firewall solutions

can deliver full accessTwo connections to the
control
firewall for every
VPN Firewall Internet
Internet
and consistent security policy enforcement
communication request

VPN Bypasses security policy

Internet Denial of service

Firewall

34
 Protecting Remote Access
VPNs
 The Problem:
• Remote access VPN clients can be “hijacked”
 Allows attackers into internal network
 The Solution:
• Centrally managed personal firewall on VPN
clients Attacker

Cable or xDSL

Internet

35
 Advantages
VS.
Disadvantages

36
 Advantages: Cost Savings
 Eliminating the need for expensive long-
distance leased lines
 Reducing the long-distance telephone
charges for remote access.
 Transferring the support burden to the
service providers
 Operational costs

37
 Advantages: Scalability
 Flexibility of growth

 Efficiency with broadband technology

38
 Disadvantages
VPNs require an in-depth understanding of
public network security issues and proper
deployment of precautions

Availability and performance depends on

factors largely outside of their control

Immature standards

VPNs need to accommodate protocols

other than IP and existing internal
network technology
39
Applications: Site-to-Site VPNs
Large-scale encryption between
multiple fixed sites such as remote
offices and central offices

Network traffic is sent over the

branch office Internet connection

This saves the company hardware

and management expenses
40
Site-to-Site VPNs

41
Applications: Remote Access
 Encrypted connections between mobile or
remote users and their corporate networks
 Remote user can make a local call to an
ISP, as opposed to a long distance call to
the corporate remote access server.
 Ideal for a telecommuter or mobile sales
people.
 VPN allows mobile workers &
telecommuters to take advantage of
broadband connectivity.
i.e. DSL, Cable 42
 Industries That May Use a VPN
 Healthcare: enables the transferring of confidential patient
information within the medical facilities & health care provider

 Manufacturing: allow suppliers to view inventory & allow clients

to purchase online safely

 Retail: able to securely transfer sales data or customer info

between stores & the headquarters

 Banking/Financial: enables account information to be

transferred safely within departments & branches

 General Business: communication between remote employees

can be securely exchanged

43
Some Businesses using a VPN
CVS Pharmaceutical Corporation upgraded
their frame relay network to an IP VPN

ITW Foilmark secured remote location

orders, running reports, & internet/intranet
communications w/ a 168-bit encryption by
switching to OpenReach VPN

Bacardi & Co. Implemented a 21-country,

44-location VPN

44
 Where Do We See VPNs
Going in the Future?
VPNs are continually being enhanced.
Example: Equant NV
As the VPN market becomes larger, more
applications will be created along with
more VPN providers and new VPN types.
Networks are expected to converge to
create an integrated VPN
Improved protocols are expected, which
will also improve VPNs.
45
 Summary
 Virtual Private Networks have become
mission-critical applications
 IPSec is the leading protocol for creating
enterprise VPNs
• Provides encryption, authentication, and data
integrity
 Organizations should look for:
• Integrated firewalls and VPNs
• Centralized management of VPN client security
• A method to provide VPN QoS

46
 Pop Quiz!
Q.1
VPN stands for…
a) Virtual Public Network b) Virtual Private Network
d)
c) Virtual Protocol Network
Virtual Perimeter Network

47
 Pop Quiz!
A.1
VPN stands for…

b) Virtual Private Network

VPN stands for "Virtual Private Network" or "Virtual Private Networking." A VPN is a
private network in the sense that it carries controlled information, protected by various
security mechanisms, between known parties. VPNs are only "virtually" private,
however, because this data actually travels over shared public networks instead of fully
dedicated private connections.

48
 Pop Quiz!

Q.2
What are the acronyms for the 3 most common VPN
protocols?

49
 Pop Quiz!
A.2
3 most common VPN protocols are…

• PPTP
• L2TP
• IPsec
PPTP, IPsec, and L2TP are three of today's most popular VPN tunneling protocols. Each
one of these is capable of supporting a secure VPN connection.

50
 Pop Quiz!

Q.3
What does PPTP stand for?

51
 Pop Quiz!
A.3

PPTP = Point-to-Point Tunneling Protocol !

52
 Pop Quiz!

Q.4
What is the main benefit of VPNs compared to
dedicated networks utilizing frame relay, leased
lines, and traditional dial-up?

a) better network performance b) less downtime on average

c) reduced cost d) improved security

53
 Pop Quiz!
A.4
The main benefit of VPNs is…

c) reduced cost

The main benefit of a VPN is the potential for significant cost savings compared to
traditional leased lines or dial up networking. These savings come with a certain amount
of risk, however, particularly when using the public Internet as the delivery mechanism
for VPN data.

54
 Pop Quiz!

Q.5
In VPNs, the term "tunneling" refers to

a) an optional feature b) the encapsulation of packets inside

that increases network packets of a different protocol to
performance if it is create and maintain the virtual circuit
turned on

c) the method a system d) a marketing strategy that involves

administrator uses to selling VPN products for very low
detect hackers on the prices in return for expensive service
network contracts

55
 Pop Quiz!
A.5
In VPNs, the term "tunneling" refers to…

b) the encapsulation of packets inside packets

of a different protocol to create and
maintain the virtual circuit

56