[ITS164L] Chapter 7 - Securing Site-to-Site Connectivity

Security

is a concern when using the public Internet to conduct business.

Virtual Private Networks (VPNs)

are used to ensure the security of data across the Internet.

VPN

is used to create a private tunnel over a public network

VPNs

used to create an end-to-end private network connection over third-party networks such as the Internet or extranets.

tunnel

eliminates the distance barrier and enables remote users to access central site network resources

VPN

a private network created via tunneling over a public network, usually the Internet.

VPN

communications environment in which access is strictly controlled to permit peer connections within a defined community of interest.

first VPNs

were strictly IP tunnels that did not include authentication or encryption of the data.

Generic Routing Encapsulation (GRE)

a tunneling protocol developed by Cisco that can encapsulate a wide variety of network layer protocol packet types inside IP tunnels.

• Cost savings

• Scalability

• Compatibility with broadband technology

• Security

Benefits of a VPN

Cost savings

VPNs enable organizations to use cost-effective, third-party Internet transport to connect remote offices and remote users to the main site; therefore, eliminating expensive, dedicated WAN links and modem banks.

Scalability

VPNs enables organizations to use the Internet infrastructure within ISPs and devices, which makes it easy to add new users

Compatibility with broadband technology

VPNs allow mobile workers and telecommuters to take advantage of high-speed, broadband connectivity, such as DSL and cable, to access to their organizational networks.

Security

VPNs can include security mechanisms that provide the highest level of security by using advanced encryption and authentication protocols that protect data from unauthorized access.

• Site-to-Site VPN

• Remote access VPN

Two types of VPNs

Site-to-Site VPN

is created when devices on both sides of the VPN connection are aware of the VPN configuration in advance.

site-to-site VPN

In a [blank], end hosts send and receive normal TCP/IP traffic through a VPN gateway

VPN gateway

is responsible for encapsulating and encrypting outbound traffic for all traffic from a particular site

site-to-site VPN

an extension of a classic WAN network.

site-to-site VPN

connect entire networks to each other, for example, they can connect a branch office network to a company headquarters network.

Remote-access VPN

is used to connect entire networks

Remote-access VPN

supports the needs of telecommuters, mobile users, and extranet, consumer-to-business traffic

Remote-access VPN

is created when VPN information is not statically set up, but instead allows for dynamically changing information, and can be enabled and disabled.

Remote-access VPN

support a client/server architecture, where the VPN client (remote host) gains secure access to the enterprise network via a VPN server device at the network edge.

IP Sec VPN

offer flexible and scalable connectivity.

IP Sec VPN

with an [blank], the information from a private network is securely transported over a public network.

IPsec VPN

This forms a virtual network instead of using a dedicated Layer 2 connection

• Confidentiality (Encryption)

• Data Integrity

• Authentication

• Anti-Replay Protection

Four critical functions of IP Security

Confidentiality (encryption)

This is the process of taking all the data that one computer is sending to another and encoding it into a form that only the other computer will be able to decode.

Data Integrity

IPsec has a mechanism to ensure that the encrypted portion of the packet, or the entire header and data portion of the packet, has not been changed.

Authentication

verify the identity of the source of the data that is sent. This is necessary to guard against a number of attacks that depend on spoofing the identity of the sender.

Authentication

ensures that the connection is made with the desired communication partner. The receiver can authenticate the source of the packet by certifying the source of the information.

Anti-Replay Protection

this is the ability to detect and reject replayed packets and helps prevent spoofing

Anti-Replay Protection

verifies that each packet is unique and not duplicated.