Module 8: VPN and IPsec

What is the difference between a site-to-site and remote-access VPN?

Hosts has no idea of the existence of the site to site VPN, hosts configure and connect to a VPN concentrator/gateway

What are 2 different ways to deploy and manage VPNs?

Enterprise, service provider VPNs

What do service providers use to provide VPN services?

MPLS

What 2 protocols can be used for VPNs?

SSL, IPsec

What 2 ways can remote-access VPNs be established?

Clientless, client

What are the benefits/negatives of SSL/TLS VPNs?

Only need a web browser, strong encryption, low config complexity, only supports web applications

What are the benefits/negatives of IPsec VPNs?

Supports all IP applications, strong authentication, complex config, only specific devices can connect

What is GRE?

Non-secure site-to-site VPN tunneling protocol

Why is GRE used with IPsec?

IPsec only supports unicast traffic and GRE supports multicast and broadcast traffic but is unsecure.

What terms are used to describe IPsec encapsulation?

Passenger protocol, carrier protocol, transport protocol

What solution does Cisco provide for creating multiple VPNs in a easy and scalable manner?

Dynamic Multipoint VPN (DMVPN)

What topology does DMVPN use?

Hub and spoke

What is special about DMVPNs?

They can create spoke to spoke connections

What non-Cisco solution can be used for creating multiple VPNs easily and scalable?

IPsec VTI

What is IPsec VTI?

Uses virtual interfaces for VPN connections and supports multicast and broadcast traffic

What are the 2 types of MPLS that a service provider might provide?

Layer 2/3 MPLS

What 4 security functions does IPsec provide?

Confidentiality, integrity, authentication, diffie hellman

What 2 IPsec protocols exist?

Authentication Header, Encapsulation Security Protocol

What does confidentiality and integrity provide?

Encryption and hashing

What does IPsec use for authentication?

RSA, PSKs

What layers does IPsec protect?

Layers 4-7