Setting Up a Virtual Private Network

1. Setting Up a Virtual Private Network Chapter 9

2. Learning Objectives • Understand the components and essential operations of virtual private networks (VPNs) • Describe the different types of VPNs • Create VPN setups such as mesh or hub-and-spoke configurations • Choose the right tunneling protocol for your VPN • Enable secure remote access for individual users via a VPN • Observe best practices for configuring and maintaining VPNs effectively

3. VPNs • Goal: Provide a cost-effective and secure way to connect businesses to one another and remote workers to office networks • Encapsulate and encrypt data being transmitted • Use authentication to ensure that only approved users can access the VPN • Provide a means of secure point-to-point communications over the public Internet

4. VPN Components and Operations • Essential components that make up a VPN • How VPNs enable data to be accessed securely • Advantages and disadvantages of using VPNs compared to leased lines • How VPNs extend network boundaries

5. Components within VPNS • Hardware devices • Can have two endpoints or terminators • Can have a (virtual) tunnel • Software that performs security-related activities

9. Devices That Form the Endpoints of the VPN • Server running on a tunneling protocol • VPN appliance • A firewall/VPN combination • A router-based VPN

10. Essential Activities of VPNs • IP encapsulation • Data payload encryption • Encrypted authentication

11. IP Encapsulation • Provides a high degree of protection • VPN encapsulates actual data packets within packets that use source and destination addresses of VPN gateway • Source and destination information of actual data packets are completely hidden • Because a VPN tunnel is used, source and destination IP addresses of actual data packets can be in private reserved blocks not usually routable over the Internet

12. Data Payload Encryption • Transport method • Tunnel method

13. Encrypted Authentication • Hosts are authenticated by exchanging long blocks of code (keys) that are generated by complex formulas (algorithms) • Types of keys that can be exchanged • Symmetric keys • Asymmetric keys

14. Advantages and Disadvantages of VPNs

15. VPNs Extend a Network’s Boundaries • To deal with the increased risk caused by VPN connections • Use two or more authentication tools to identify remote users • Integrate virus protection • Set usage limits

16. Types of VPNs • Site-to-site VPN • Links two or more networks • Client-to-site VPN • Makes a network accessible to remote users who need dial-in access

17. VPN Appliances • Hardware devices specially designed to terminate VPNs and join multiple LANs • Permit connections, but do not provide other services (eg, file sharing, printing) • Enable connections of more tunnels and users than software systems • Examples • SonicWALL series • Symantec Firewall/VPN appliance

18. Advantage of Using Hardware Systems

19. Software VPN Systems • Generally less expensive than hardware systems • Tend to scale better for fast-growing networks • Examples • F-Secure VPN+ • Novell BorderManager VPN services • Check Point FireWall-1

20. VPN Combinations of Hardware and Software • Cisco 3000 Series VPN Concentrator • Gives users the choice of operating in: • Client mode, or • Network extension mode

21. VPN Combinations of Different Vendors’ Products • Challenge: Get all pieces to talk to and communicate with one another successfully • Pick a standard security protocol that is widely used and that all devices support(eg, IPSec)

22. VPN Setups • If two participants • Configuration is relatively straightforward in terms of expense, technical difficulty, and time • If three or more, several options • Mesh configuration • Hub-and-spoke arrangement • Hybrid setup

23. Mesh Configuration • Connects multiple computers that each have a security association (SA) with all other machines in the VPN

25. Hub-and-Spoke Configuration • A single VPN router maintains records of all SAs • Any device that wishes to participate in the VPN need only connect to the central router • Easy to increase size of the VPN • The requirement that all communications flow into and out of the central router slows down communications

27. Hybrid Configuration • Benefits from the strengths of each—scalability of hub-and-spoke option and speed of mesh option • Use mesh for most important branches of the network and critical communications • Use hub-and-spoke for overseas branches and for new new branch offices

28. Configurations and Extranet and Intranet Access • Extranet • Enable firewalls and anti-virus software for each remote user or business partner • Intranet • Establish usage limits • Set up anti-virus and firewall protection

29. Configurations and Extranet and Intranet Access

30. Tunneling Protocols Used with VPNs • IPSec/IKE • PPTP (Point-to-Point Tunneling Protocol) • L2TP (Layer 2 Tunneling Protocol) • PPP over SSL (Point-to-Point Protocol over Secure Sockets Layer) • PPP over SSH (Point-to-Point Protocol over Secure Shell)

31. IPSec/IKE • IPSec provides: • Encryption of the data part of packets • Authentication • Encapsulation between two VPN hosts • Two security methods (AH and ESP) • Capability to work in two modes (transport and tunnel) • IKE provides: • Exchange of public and private keys • Ability to determine which encryption protocols should be used to encrypt data that flows through VPN tunnel

32. PPTP • Developed by Microsoft for granting VPN access to remote users over dial-up connections • Uses Microsoft Point-to-Point Encryption (MPPE) to encrypt data • Useful if support for older clients is needed • Compatible with Network Address Translation (NAT) • Replaced by L2TP

33. L2TP • Extension to PPP that enables dial-up users to establish a VPN connection to a remote access server • Uses IPSec to encrypt data • Incompatible with NAT but provides a higher level of encryption and authentication

34. PPP Over SSL andPPP Over SSH • Two UNIX based methods for creating VPNs • Both combine existing tunnel system (PPP) with a way of encrypting data in transport (SSL or SSH) • SSL • Public key encryption system used to provide secure communications over the Web • SSH • UNIX secure shell that uses secret key encryption (pre-shared key) to authenticate participants

35. When to Use Different VPN Protocols

36. Enabling Remote Access Connections within VPNs • Issue the user VPN client software • Make sure user’s computer is equipped with anti-virus software and a firewall • May need to obtain a key for the remote user if you plan to use IPSec to make VPN connection as well

37. Configuring the Server • Major operating systems include ways of providing secure remote access • Linux • IP Masquerade feature • Windows XP and 2000 • Network Connections Wizard

38. Configuring the Server

39. Configuring the Server

40. Configuring Clients • Involves either installing and configuring VPN client software or using the Network Connection Wizard • Client workstation must be protected by a firewall

41. VPN Best Practices • Security policy rules that specifically apply to the VPN • Integration of firewall packet filtering with VPN traffic • Auditing the VPN to make sure it is performing acceptably

42. The Need for a VPN Policy • Identify who can use the VPN • Ensure that all users know what constitutes proper use of the VPN • Whether and how authentication is to be used • Whether split tunneling is permitted • How long users can be connected at any one session • Whether virus protection is included

43. Packet Filtering and VPNs • Encryption and decryption of data can be performed either outside the packet-filtering perimeter or inside it

46. PPTP Filter Rules

47. L2TP and IPSecPacket-Filtering Rules

48. Auditing and Testing the VPN • Time consuming • Choose client software that is easy for end users to install on their own to save you time and effort

49. Chapter Summary • Configuration and operations of VPNs