VPN and IPsec Concepts

VPN and IPsec Concepts

1. VPN Technology

   • Virtual Private Networks
     • organizations use virtual private networks (VPNs) to create end-to-end private network connections
   • VPN Benefits
     • Modern VPNs now support encryption features, such as Internet Protocol Security (IPsec) and Secure Sockets Layer (SSL) VPNs to secure network traffic between sites.
   • Site-to-Site and Remote-Access VPNs
     • Enterprise VPNs - Enterprise-managed VPNs are a common solution for securing enterprise traffic across the internet. Site-to-site and remote access VPNs are created and managed by the enterprise using both IPsec and SSL VPNs. Service Provider VPNs
   • Enterprise and Service Provider VPNs

2. Types of VPNs

   • Remote-Access VPNs
     • VPNs have become the logical solution for remote-access connectivity for many reasons.
   • SSL VPNs
     • TLS is the newer version of SSL and is sometimes expressed as SSL/TLS.
   • Site-to-Site IPsec VPNs
     • Site-to-site VPNs are used to connect networks across another untrusted network such as the internet.
   • GRE over IPsec
     • Generic Routing Encapsulation (GRE) is a non-secure site-to-site VPN tunneling protocol.
   • Dynamic Multipoint VPNs
     • DMVPN simplifies the VPN tunnel configuration and provides a flexible option to connect a central site with branch sites
   • IPsec Virtual Tunnel Interface
     • IPsec VTI configurations are applied to a virtual interface instead of static mapping the IPsec sessions
   • Service Provider MPLS VPNs
     • Traffic is forwarded through the MPLS backbone using labels that are previously distributed among the core routers

3. IPsec

   • IPsec Technologies
     • Confidentiality Integrity Origin authentication Methods of authentication Diffie-Hellman
   • IPsec Protocol Encapsulation
     • IPsec encapsulates packets using Authentication Header (AH) or Encapsulation Security Protocol (ESP).
   • Confidentiality
     • The degree of confidentiality depends on the encryption algorithm and the length of the key used in the encryption algorithm
   • Integrity
     • Data integrity means that the data that is received is exactly the same data that was sent
   • Authentication
     • The same is true of VPN networks
   • Secure Key Exchange with Diffie-Hellman
     • Encryption algorithms require a symmetric, shared secret key to perform encryption and decryption.