Virtual Private Virtual Private Networking (VPN)Networking (VPN)

Roll No.- 45-49Roll No.- 45-49Group VIIGroup VII

IntroIntro To VPNTo VPN

• Vi rtual Pr ivat e N etw orkVi rtual Pr ivat e N etw ork as name as name suggests, safely and securely transfers suggests, safely and securely transfers information from one network to another information from one network to another system.system.

• Organizations which are connected by a Organizations which are connected by a single logical network via Routers & WAN single logical network via Routers & WAN technologiestechnologies

• They are inter-connected to do PRIVATE They are inter-connected to do PRIVATE data sharing. data sharing.

• Supports telecommuters, branch offices, & Supports telecommuters, branch offices, & off site partners, hence most vital part of off site partners, hence most vital part of corporate IT world.corporate IT world.

Need Of VPNNeed Of VPN

• In this world internet is the most essential In this world internet is the most essential thing to do communication & data thing to do communication & data transfers.transfers.

• But for some organizations which are But for some organizations which are spreading over the world need one thing, a spreading over the world need one thing, a way to maintain fast, reliable & secured way to maintain fast, reliable & secured communication.communication.

• WAN has fast speed, High performance but WAN has fast speed, High performance but less security, reliability & too expensive.less security, reliability & too expensive.

• For that For that Vi rtual Pri vate NetworkVi rtual Pri vate Network is the is the best possible solutionbest possible solution..

In short, a VPN is a private network that In short, a VPN is a private network that uses a public network (usually the uses a public network (usually the Internet) to connect remote sites or Internet) to connect remote sites or users together. Instead of using a users together. Instead of using a dedicated, real-world connection such dedicated, real-world connection such as leased line, a VPN uses "virtual" as leased line, a VPN uses "virtual" connections routed through the Internet connections routed through the Internet from the company's private network to from the company's private network to the remote site or employee.the remote site or employee.

Features OFFeatures OF VPNVPN

• Security Security • Reliability Reliability • Scalability Scalability • Network management Network management • Policy managementPolicy management

Connections in VPNConnections in VPN

• Remote Access-Remote Access-

Better known as Better known as Virtu al P rivate Dial-up N etworkVirtu al P rivate Dial-up N etwork

(VPDN)(VPDN) This is Remote user-to-LAN connectionThis is Remote user-to-LAN connection Mostly Organizations outsource ESP (Enterprise Mostly Organizations outsource ESP (Enterprise

Service Provider) which sets Network Access Server Service Provider) which sets Network Access Server (NAS) & provides the remote users with desktop client (NAS) & provides the remote users with desktop client software for their computers. The telecommuters can software for their computers. The telecommuters can then dial a toll-free number to reach the NAS and use then dial a toll-free number to reach the NAS and use their VPN client software to access the corporate their VPN client software to access the corporate network. (e.g. Call Center)network. (e.g. Call Center)

Remote-access VPNs permit secure, encryptedRemote-access VPNs permit secure, encrypted connections between a company's private network and connections between a company's private network and remote users through a third-party service provider. remote users through a third-party service provider.

Intranet BasedIntranet Based

Single Private Single Private network between network between Company’s Company’s remote locations.remote locations.

Connection can Connection can

be LAN - LAN be LAN - LAN

Extranet BasedExtranet Based Network between Network between

two companies (ie two companies (ie Partner, Customer Partner, Customer etc) so that working etc) so that working is in shared is in shared environmentenvironment

Connection can be Connection can be

LAN - LANLAN - LAN

• Site to Site- Connection b/w multiple site via Internet

It is divided in two parts

Requirements of VPNRequirements of VPN

• User Authenticatio n-User Authenticatio n- VPN accessed VPN accessed should be restricted to authorized users should be restricted to authorized users onlyonly

• Address Management-Address Management- Ensuring that Ensuring that the private address are kept privatethe private address are kept private..

• Data encryptio n- Data encryptio n- Data carried must be Data carried must be unreadable to unauthorized users.unreadable to unauthorized users.

• Mu lti p rotocol SupportMu lti p rotocol Support : : The The solution must be able to handle common solution must be able to handle common protocols used in the public network. protocols used in the public network. These include Internet Protocol (IP), These include Internet Protocol (IP), internet packet exchange (IPX) and so on.internet packet exchange (IPX) and so on.

How does VPN work??How does VPN work??• A VPN works by using shared public A VPN works by using shared public

infrastructure while maintaining privacy infrastructure while maintaining privacy through security procedures and tunneling through security procedures and tunneling protocols.protocols.

• In effect, by encoding data at the sending In effect, by encoding data at the sending

end and decoding it at the receiving end, the end and decoding it at the receiving end, the protocols send the data through a 'tunnel' protocols send the data through a 'tunnel' that cannot be 'entered' by data that is not that cannot be 'entered' by data that is not properly encrypted.properly encrypted.

• An additional level of security involves An additional level of security involves encoding not only the data, but also the encoding not only the data, but also the originating and receiving network addresses.originating and receiving network addresses.

TunnelingTunneling • TunnelingTunneling is the process of placing is the process of placing

an entire packet within another packet an entire packet within another packet and sending it over a network, its and sending it over a network, its noting but point-point topologynoting but point-point topology

• At At Tunnel i nterfacesTunnel i nterfaces, the packet , the packet enters and exits the networkenters and exits the network

• It Requires three protocols- It Requires three protocols- 1. Carrier protocol 1. Carrier protocol 2. Encapsulating protocol 2. Encapsulating protocol 3. Passenger protocol 3. Passenger protocol

• Carrier pro tocolCarrier pro tocol - The protocol - The protocol used by the network that the used by the network that the information is traveling over. information is traveling over.

• Encapsu lati ng p rotocolEncapsu lati ng p rotocol - The - The protocol that is wrapped around the protocol that is wrapped around the original data. original data.

• Passenger p ro tocolPassenger p ro tocol - The original - The original data being carried. data being carried.

Tunneli ng: R emote AccessTunneli ng: R emote Access

The truck is the carrier protocol, the box is the encapsulating protocol and the computer is the passenger protocol.

• Tunneling: Site - SiteTunneling: Site - Site GRE (g eneric rou ting encapsula tion): GRE (g eneric rou ting encapsula tion): Normally encapsulating protocol that provides Normally encapsulating protocol that provides

the framework for how to package the passenger the framework for how to package the passenger protocol for transport over the carrier protocol, IP protocol for transport over the carrier protocol, IP based. information on what type of packet you are based. information on what type of packet you are encapsulating and information about the connection encapsulating and information about the connection between the client and server. between the client and server.

IPSe c (IP S ecurit y):IPSe c (IP S ecurit y): Sometimes instead of GRE IPSec is used. It is Sometimes instead of GRE IPSec is used. It is

the encapsulating protocol, IPSec works well on both the encapsulating protocol, IPSec works well on both remote-access and site-to-site VPN. remote-access and site-to-site VPN.

Tunnel in g: Si te- Si teTunnel in g: Si te- Si te

• Tunnel in g: Remote AccessTunnel in g: Remote Access

Tunneling normally takes place using PPP (carrier Tunneling normally takes place using PPP (carrier for other IP protocols when communicating over for other IP protocols when communicating over the network between the host and a remote the network between the host and a remote system)system)

L2FL2F (Layer 2 Forwarding): L2F will use any (Layer 2 Forwarding): L2F will use any

authentication scheme supported by PPP. authentication scheme supported by PPP. PPTP PPTP (Point-to-Point Tunneling Protocol): (Point-to-Point Tunneling Protocol):

supports 40-bit and 128-bit encoding and will use supports 40-bit and 128-bit encoding and will use any authentication scheme supported. any authentication scheme supported.

L2T PL2T P (Layer 2 Tunneling Protocol): Combining (Layer 2 Tunneling Protocol): Combining features of both PPTP and L2F, L2TP also fully features of both PPTP and L2F, L2TP also fully supports IPSec. supports IPSec.

Types Of VPN ServicesTypes Of VPN Services

• L1 Serv ices :L1 Serv ices : 1. VPWS1. VPWS• L2 Serv ices:L2 Serv ices: 1. VPLS1. VPLS 2. Pseudo Wire (PW) 2. Pseudo Wire (PW) 3. IPLS3. IPLS• L3 Serv ices:L3 Serv ices: 1. BGP/MPLS VPN1. BGP/MPLS VPN 2. Virtual Router VPN2. Virtual Router VPN

• Layer 1 Servic e:Layer 1 Servic e: VPW SVPW S: The provider does not offer a full : The provider does not offer a full

routed or bridged network, but components routed or bridged network, but components from which the customer can build customer-from which the customer can build customer-administered networks. VPWS are point-to-administered networks. VPWS are point-to-point. They can be Layer 1 emulated circuits point. They can be Layer 1 emulated circuits with no data link structure.with no data link structure.

• Layer 2 Se rvices:Layer 2 Se rvices: PW (Pseudo Wi ring) : PW (Pseudo Wi ring) : PW is similar to VPWS, PW is similar to VPWS,

but it can provide different L2 protocols at but it can provide different L2 protocols at both ends. both ends.

Vi rtual Pr ivat e LA N S ervi ces (VPLS) : Vi rtual Pr ivat e LA N S ervi ces (VPLS) : Allow multiple tagged LANs to share Allow multiple tagged LANs to share common Data. Not useful for customer-common Data. Not useful for customer-owned facilities. emulates the full owned facilities. emulates the full functionality of a traditional LAN. The functionality of a traditional LAN. The remote LAN segments behave as one single remote LAN segments behave as one single LAN.LAN.

• L3 Services:L3 Services: BG P/ MPLS VPN : BG P/ MPLS VPN : PE disambiguates PE disambiguates

duplicate addresses in a single routing duplicate addresses in a single routing instance. Extensions are used to advertise instance. Extensions are used to advertise routes. which are of the form of 12-byte routes. which are of the form of 12-byte strings, beginning with an 8-byte and ending strings, beginning with an 8-byte and ending with a 4-byte IPv4 address. with a 4-byte IPv4 address.

Vir tual LAN : Vir tual LAN : The PE contains a virtual The PE contains a virtual router instance per VPN. Opposed to router instance per VPN. Opposed to BGP/MPLS techniques as multiple virtual BGP/MPLS techniques as multiple virtual routers belong to one and only one VPN.routers belong to one and only one VPN.

VPN SecurityVPN Security

• A well-designed VPN uses several A well-designed VPN uses several methods for keeping the connection methods for keeping the connection and data secure:and data secure:

1. Firewalls 1. Firewalls 2. Encryption 2. Encryption 3. IPSec 3. IPSec 4. AAA servers4. AAA servers

Fire wa ll sFire wa ll s : :

A firewall provides a strong barrier between A firewall provides a strong barrier between the private network and the Internet. We the private network and the Internet. We can set firewalls to restrict the number of can set firewalls to restrict the number of open ports, what type of packets is passed open ports, what type of packets is passed through and which protocols are allowed through and which protocols are allowed through. through.

2. Encrypti on2. Encrypti on ::

Encryption is the process of taking all the data Encryption is the process of taking all the data

that one computer is sending to another and that one computer is sending to another and encoding it into a form that only the other encoding it into a form that only the other computer will be able to decode. Most computer computer will be able to decode. Most computer encryption systems belong in one of two encryption systems belong in one of two categories: categories:

– Symmetric-key encryption Symmetric-key encryption – Public-key encryption Public-key encryption

• In symmetric-key encryption, each computer In symmetric-key encryption, each computer has a secret key (code) that it can use to encrypt has a secret key (code) that it can use to encrypt a packet of information before it is sent over the a packet of information before it is sent over the network to another computer. network to another computer.

• Symmetric-key requires that you know which Symmetric-key requires that you know which computers will be talking to each other so you can computers will be talking to each other so you can install the key on each one. install the key on each one.

• Symmetr ic-keySymmetr ic-key encryption is essentially the encryption is essentially the same as a secret code that each of the two same as a secret code that each of the two computers must know in order to decode the computers must know in order to decode the information. information.

• The code provides the key to decoding the The code provides the key to decoding the message.message.

• The sending computer encrypts the The sending computer encrypts the document with a symmetric key, then encrypts document with a symmetric key, then encrypts the symmetric key with the public key of the the symmetric key with the public key of the receiving computer. receiving computer.

• The receiving computer uses its private key The receiving computer uses its private key to decode the symmetric key. It then uses the to decode the symmetric key. It then uses the symmetric key to decode the document. symmetric key to decode the document.

• Public-key encryption Public-key encryption uses a combination of a uses a combination of a private key and a public key. private key and a public key.

• The private key is known only to your The private key is known only to your computer, while the public key is given by your computer, while the public key is given by your computer to any computer that wants to computer to any computer that wants to communicate securely with it.communicate securely with it.

• To decode an encrypted message, a To decode an encrypted message, a computer must use the public key, provided by the computer must use the public key, provided by the originating computer, and its own private key.originating computer, and its own private key.

• A very popular public-key encryption utility is A very popular public-key encryption utility is called called Pretty Good Privacy Pretty Good Privacy (PGP), which allows (PGP), which allows you to encrypt almost anything. you to encrypt almost anything.

3. Internet Prot ocol Secur it y 3. Internet Prot ocol Secur it y Prot ocol ( IPS ec) :Prot ocol ( IPS ec) :

• IPSec provides enhanced security features such as IPSec provides enhanced security features such as better encryption algorithms and more better encryption algorithms and more comprehensive authentication. comprehensive authentication.

• IPSec has two encryption modes: IPSec has two encryption modes: tunnel tunnel and and tr ansporttr ansport . .

• Tunnel encrypts the header and the Tunnel encrypts the header and the payload of each packet while transport only payload of each packet while transport only encrypts the payload. Only systems that are IPSec encrypts the payload. Only systems that are IPSec compliant can take advantage of this protocol. compliant can take advantage of this protocol. Also, all devices must use a common key and the Also, all devices must use a common key and the firewalls of each network must have very similar firewalls of each network must have very similar security policies set up. security policies set up.

• IPSec can encrypt data between various devices, IPSec can encrypt data between various devices, such as: such as:

• Router to router Router to router • Firewall to router Firewall to router • PC to router PC to router • PC to server PC to server

Benefits of VPNBenefits of VPN

A well-designed VPN can greatly benefit a A well-designed VPN can greatly benefit a company. For example, it can:company. For example, it can: • • Extend geographic connectivity Extend geographic connectivity • • Improve security Improve security • • Reduce operational costs versus traditional Reduce operational costs versus traditional

WAN WAN • • Reduce transit time and transportation costs for Reduce transit time and transportation costs for

remote users remote users • • Improve productivity Improve productivity • • Simplify network topology Simplify network topology • • Provide global networking opportunities Provide global networking opportunities • • Provide telecommuter support Provide telecommuter support • • Provide broadband networking compatibility Provide broadband networking compatibility • • Provide faster ROI (return on investment) than Provide faster ROI (return on investment) than

traditional WAN traditional WAN

How VPN differ from How VPN differ from ordinary networks ordinary networks

• Virtual Private Networks allow any valid Virtual Private Networks allow any valid remote user to become part of a corporate remote user to become part of a corporate central network, using the same network central network, using the same network scheme and addressing as users on this scheme and addressing as users on this central network. central network.

• Each Corporate central network can Each Corporate central network can also be responsible for validating their own also be responsible for validating their own users, despite the fact that they are users, despite the fact that they are actually dialing into a public network. actually dialing into a public network.

• The Internet Service Provider The Internet Service Provider can give each of their customer's a can give each of their customer's a unique dial-up telephone number, unique dial-up telephone number, which will distinguish their service which will distinguish their service from any other. But this is depends from any other. But this is depends on the software that will be used by on the software that will be used by the remote user. the remote user.

Other FeaturesOther Features• Mobile VPNs are designed for mobile and wireless Mobile VPNs are designed for mobile and wireless

users. They integrate standards-based users. They integrate standards-based authentication and encryption technologies to authentication and encryption technologies to secure data transmissions to and from devices and secure data transmissions to and from devices and to protect networks from unauthorized users. to protect networks from unauthorized users. Designed for wireless environments, Mobile VPNs Designed for wireless environments, Mobile VPNs are designed as an access solution for users that are designed as an access solution for users that are on the move and require secure access to are on the move and require secure access to information and applications over a variety of wired information and applications over a variety of wired and wireless networks. Mobile VPNs allow users to and wireless networks. Mobile VPNs allow users to roam seamlessly across IP-based networks and in roam seamlessly across IP-based networks and in and out of wireless coverage areas without losing and out of wireless coverage areas without losing application sessions or dropping the secure VPN application sessions or dropping the secure VPN session. session.

VPN ChallengesVPN Challenges

• Sett ing up th e in frastructu re Sett ing up th e in frastructu re befo re deployin g VPN:befo re deployin g VPN:

Many of the branch offices Many of the branch offices operated on dial-up connections, operated on dial-up connections, which were slow and often which were slow and often unreliable. unreliable.

So the first step was to get So the first step was to get 24x7 connectivity using DSL or 24x7 connectivity using DSL or similar technology. similar technology.

• Pauci ty of I T staf f at rem ote Pauci ty of I T staf f at rem ote locati onslocati ons : :

Since many of the branch offices Since many of the branch offices were small and/or recently set up, there were small and/or recently set up, there was no dedicated IT staff at remote was no dedicated IT staff at remote locations. locations.

The challenge was to build a The challenge was to build a solution that was literally 'plug-and-play' solution that was literally 'plug-and-play' -that could be easily setup, deployed and -that could be easily setup, deployed and managed ,with an option for remote managed ,with an option for remote manageability as well in case advanced manageability as well in case advanced troubleshooting was required.troubleshooting was required.

• Rel iabi lit y of the ISP connecti on and Rel iabi lit y of the ISP connecti on and suppor t for di al- up backupsuppor t for di al- up backup ::

In many locations, if the main ISP In many locations, if the main ISP connection was down, the connectivity to connection was down, the connectivity to the head office was maintained via dial-the head office was maintained via dial-up. up.

It was a prerequisite that the VPN It was a prerequisite that the VPN solution work not just on the regular ISDN solution work not just on the regular ISDN or DSL connection, but also on the dial-up, or DSL connection, but also on the dial-up, so that application uptime could be so that application uptime could be maintained.maintained.

• Response t im eResponse t im e: :

Since this was a real-time application, Since this was a real-time application, the end users would have to get a the end users would have to get a reasonable response time, or else they reasonable response time, or else they might abandon the use of the application. might abandon the use of the application. The response time depends on several The response time depends on several factors besides the VPN solution, such factors besides the VPN solution, such as the coding in the software application, as the coding in the software application, the quality of the ISP connection, the the quality of the ISP connection, the volume of data being transferred by the volume of data being transferred by the application and the general level of application and the general level of congestion on the Internet pipe itself. congestion on the Internet pipe itself.

Keeping all these factors in mind Keeping all these factors in mind and yet providing an interface, which and yet providing an interface, which would not cause the user to lose would not cause the user to lose patience with it, was one of the foremost patience with it, was one of the foremost issues that needed to be addressed.issues that needed to be addressed.

• No provi si on for a separat e f irewal l No provi si on for a separat e f irewal l sol ut ion:sol ut ion:

Since the implementation of the VPN Since the implementation of the VPN involved opening up the IT infrastructure involved opening up the IT infrastructure of the branches to the Internet, a firewall of the branches to the Internet, a firewall solution to protect the branch network solution to protect the branch network was also required. But as there was no was also required. But as there was no budgetary provision for a separate budgetary provision for a separate firewall, the VPN appliance was required firewall, the VPN appliance was required to provide firewall functionality as well.to provide firewall functionality as well.

The firewall had to be simple The firewall had to be simple to configure and manage, that is, meet all to configure and manage, that is, meet all the requirements of the VPN solution.the requirements of the VPN solution.

User acceptanceUser acceptance:: A major challenge faced during the A major challenge faced during the

implementation of this IT and security implementation of this IT and security project was to gain the acceptance of project was to gain the acceptance of remote users throughout the country to remote users throughout the country to switch from a decentralized, batch switch from a decentralized, batch process-oriented manual system to a process-oriented manual system to a centrally administered and managed real-centrally administered and managed real-time system.time system.

This was achieved by educating end This was achieved by educating end users about the use and benefits of VPN users about the use and benefits of VPN and training.and training.

Conclusion Conclusion

• Thus VPN is an outgrowth of the Internet Thus VPN is an outgrowth of the Internet technology, which will transform the daily technology, which will transform the daily method of doing business faster than any method of doing business faster than any other technology. A Virtual Private other technology. A Virtual Private Network, or VPN, typically uses theNetwork, or VPN, typically uses the

• Internet as the transport backbone to Internet as the transport backbone to establish secure links with business establish secure links with business partners, extend communications to partners, extend communications to regional and isolated offices, and regional and isolated offices, and significantly decrease the cost of significantly decrease the cost of communications for an increasingly communications for an increasingly mobile workforce. VPNs serve as private mobile workforce. VPNs serve as private network overlays on public IP network network overlays on public IP network infrastructures such as the Internet.infrastructures such as the Internet.

• Today, VPNs are equally appealing to companies of all Today, VPNs are equally appealing to companies of all sizes. Even small businesses are finding compelling sizes. Even small businesses are finding compelling reasons to implement VPNs.reasons to implement VPNs.

• The pr ima ry purposes of the V PNC areThe pr ima ry purposes of the V PNC are : : Promote the products of its members to the press Promote the products of its members to the press

and to potential customers and to potential customers Increase interoperability between members by Increase interoperability between members by

showing where the products interoperate showing where the products interoperate Serve as the forum for the VPN manufacturers Serve as the forum for the VPN manufacturers

throughout the world throughout the world Help the press and potential customers understand Help the press and potential customers understand

VPN technologies and standardsVPN technologies and standards

BIBLIOGRAGHYBIBLIOGRAGHY

• www.scribd.comwww.scribd.com• www.wikipedia.orgwww.wikipedia.org• www.howstuffworks.comwww.howstuffworks.com• www.google.comwww.google.com