12-sep-15 virtual private network. why the need to transmit files securely without disclosing...
TRANSCRIPT
Apr 21, 2023
Virtual Private Network
Why the need
To transmit files securely without disclosing sensitive information to others in the Internet
Each LAN an island
How to communicate with other islands?
LANs in an Internet sea
Communication in the Internet
Using of Lease Line
Using VPN
Using VPN
Secure communication at different levels
Using the TCP/IP model Application: PGP, SSH Transport level: SSL VPN Network level: IPSec Datalink level: PPTP, L2TP
Protection at the lower level is usually more flexible and more simple.
WAN Technology
PPP X.25 Frame Relay ATM
Point to Point Protocol
Data link protocol commonly used to establish a direct connection between two nodes over serial cable or phone line
Most Internet service providers use PPP for customers' dial-up access to the Internet
Other versions PPPoE and PPPoA
Point to Point Protocol
Negotiation of IP address, address of name server
Provide authentication (use of CHAP) Encryption might be used (DES or RC4) Support multiple protocols on the same link
What is a Virtual Private Network
A virtual private network (VPN) is the extension of a private network that encompasses links across shared or public networks like the Internet.
A VPN enables you to send data between two computers across a shared or public internetwork in a manner that emulates the properties of a point-to-point private link.
What is a Virtual Private Network
Secure private communications over public internet
Private IP packets encapsulated within public packets (tunnel)
Additional header added Authentication required Packets are usually encrypted
Advantages of using VPN
Cost saving, use of public network instead of private lease line
Flexibility, user can connect anywhere Confidentiality of packets by encryption Integrity of packets by use of IPSec
Elements of VPN
Authentication Tunneling Encryption (including key exchange)
VPN Components
Authentication
User authentication using passwords and certificates
Machine authentication using certificates Authentication Protocols
Password Authentication Protocol Challenge Handshake Authentication Protocol MS-CHAP Version 1 and 2 Extensible Authentication Protocol (EAP)
Tunneling
To emulate a point-to-point link, data is encapsulated, or wrapped, with a header that provides routing information allowing it to traverse the shared or public transit internetwork to reach its endpoint.
The tunnel needs to be created, controlled, and terminated.
Tunnel and VPN
The portion of the connection in which the private data is encapsulated is known as the tunnel.
The portion of the connection in which the private data is encrypted is known as the virtual private network (VPN)
VPN connection
Tunneling
Tunneling Protocol
Point-to-Point Tunneling Protocol (PPTP) Layer Two Tunneling Protocol (L2TP) IPSec tunnel mode
Encryption
The data being sent is encrypted for confidentiality to emulate a private link,
Original IP header information are also hidden Usual encryption protocol:
Microsoft Point to Point Encryption (MPPE) – RC4
Advanced Encryption Standard (AES) Encapsulated Security Payload (ESP) –
choose among many protocols
Types of VPN connection
Gateway to Gateway Connecting network of 2 sites
Host to Gateway Mobile worker to connect company server
Host to Host To administer network remotely
Type of VPN connection
Remote access VPN Mobile worker to access company network Requires VPN client Dial-in connection when necessary
Site-to-Site VPN To connect LAN of 2 sites together Requires router with special function May be persistent for 24 hours a day
Remote Access to Intranet
Site to Site connection
Tunneling Protocol
The encapsulation can be done at layer 2 or layer 3.
Layer 2: Point to Point Tunneling Protocol (PPTP) Layer 2 Tunneling Protocol (L2TP)
Layer 3: IP Security
PPTP
PPTP
PPTP establishes the tunnel but does not provide encryption.
It is used in conjunction with the Microsoft Point-to-Point Encryption (MPPE) protocol to create a secure VPN.
PPTP has relatively low overhead, making it faster than some other VPN methods.
L2TP
L2TP
The Layer 2 Tunneling Protocol (L2TP) was developed in cooperation between Cisco and Microsoft, combining features of PPTP with those of Cisco’s proprietary Layer 2 Forwarding (L2F) protocol.
L2TP/IP Sec
The Encapsulation Security Payload (ESP) header and trailer of IP Sec encapsulate the L2TP payload for authentication and encryption and provides better security
Authentication Header (AH) provides authentication and data security without encryption
PPTP VS L2TP
L2TP/IPSec connections provide stronger authentication by requiring both computer-level authentication through certificates and user-level authentication through a PPP authentication protocol
With PPTP, data encryption begins after the PPP connection process. With L2TP/IPSec, data encryption begins before the PPP connection process by negotiating an IPSec security association
PPTP VS L2TP
Both PPTP and L2TP can be used with IP, IPX/SPX, and NETBUI,
L2TP can be used on non-IP networks such as ATM, frame relay and X.25.
Performance of PPTP is better than L2TP because of less overhead.
L2TP is more secure and is the preferred method.
PPTP VS L2TP
PPTP L2TP/IP Sec
Tunnel Authentication
Yes
Encryption method
MPPE IP Sec
(more secure)
Transit media support
IP IP, X.25, ATM, Frame Relay
Datagram supported
IP, IPX, NETBUI IP, IPX, NETBUI
PPTP VS L2TP
PPTP L2TP/IP Sec
Support older client
Yes No
Pass thro’ NAT Yes Might
Requires PKI Yes
Computer Authentication
Yes
Speed Faster Slower
RADIUS
The Remote Authentication Dial-in User Service (RADIUS) protocol is a popular method for managing remote user authentication and authorization
It is a lightweight, UDP-based protocol. RADIUS servers can be located anywhere on the Internet and provide authentication
Secure Network Technologies
PPTP: Free from Microsoft
PPTP: Security
Link Layer: L2TP
Network Layer: IPSEC VPNs3 parts
IPSec Authentication
IPSec Encryption
Terminology
MPPE: Microsoft Point-to-Point Encryption MPLS: Multi-Protocol Label Switching AH: Authentication Header ESP: Encapsulation Security Payload GRE: Generic Routing Encapsulation