virtual private networks (vpns) vpns allow secure, remote, connections… but they don’t protect...

Virtual Private Networks (VPNs)

VPNs allow secure, remote, connections… but they don’t

protect you from a compromised remote PC.

Objectives (1 of 2)

Explain the reasons organizations implement VPNs.

Describe the VPNs core functions. Describe some of the issues

associated with implementing VPNs. Describe the four main functions of

IPSec.

Objectives (2 of 2)

Describe the difference between AH and ESP.

Explain the difference between Transport Mode and Tunnel Mode.

Implement a VPN solution using Cisco’s ASA solution.

Reasons for Implementing (1 of 1)

The need for secure business transactions.

Many organizations have adopted VPNs for the following purposes: E-commerce solutions Government/legal/financial reporting Remote user (road warrior) access Budgetary considerations

VPN Core Functions (1 of 3)

Core Activity #1: Encapsulation Data encapsulation means that a

packet is enclosed within another one that has a different IP Addressing to provide a higher degree of security.

Data packets are encapsulated within packets that contain the source and destination of the VPN gateway.


Core Activity #2: Encryption Encryption is the process of rendering

information unreadable by all but the intended receiver.

VPN endpoints encrypt and decrypt data by exchanging keys, or blocks of encoded data.

The key is a part of an electronic document called a digital signature.


Core Activity #3: Authentication Authentication is the process of

identifying a user or computer as being authorized to access a network or network resource.

Authentication uses digital certificates The tunnel protocol used determines the

type of authentication protocol used.

Issues with Implementing (1 of 6)

VPNs provide a high level of security but…

Depending on how they are implemented it may require opening up ports at the perimeter. If the central VPN device is located in

the DMZ and IPSec is used as the VPN tunneling protocol TCP ports 50 and 51 may need to be opened, or the VPN “pass-through” option needs to be turned on.


VPNs can be complex and expensive to implement and troubleshoot.

Central VPN devices can be relatively expensive and are often priced based on user and bandwidth capacity. The organization may also have to pay

for each client license that is used. Single or multiple point-of-entry

greatly alters the implementation design complexity and cost.


Complexity and Expense cont. Encryption of the packet’s header and

data makes it difficult to, and requires greater time to troubleshoot problems.

Encryption can result in higher bandwidth utilization and slower transfer rates.

Organizations may also be limited to a specific vendor as compatibility between vendor hardware and software is not guaranteed.


Poor configuration can result in weakened or bypassed security. Unattended or automated installations

may result in weaker security. While these may lower the administrator's

workload it does nothing for ensuring the systems base security setup.

Often these installations place a “point-and-click” icon on the user’s desktop for ease of use.


Remote user rights and changes can result in weakened or bypassed security. If the remote user has full rights on

their system/laptop they may: Disable vital system security features such

as personal firewalls and anti-malware applications.

Allow the installation of virus/worm infected files, trojans or other spyware.


Compromised systems (especially those with the “point-and-click” icons) allow the system to become a “secure and authenticated” entry point for the hacker to attack through.

IPSec’s AH Header does not work with NAT. If NAT needs to be performed it must

be done before the AH Header is applied.

IPSec (1 of 11)

IPSec is a framework of open standards

It has gone through a standardization processes and is supported by most vendors.

It operates on the network layer, protecting packets between network devices.

IPSec (2 of 11)

IPSec provides four main functions: Confidentiality (Encryption) Data Integrity Origin Authentication Anti-replay Protection

IPSec (3 of 11)

Confidentiality (Encryption) The sender encrypts the packets

before transmitting them across the network, to prevent anybody except the intended recipient from reading the data. IPSec can be configured to use both

symmetric or asymmetric keys.

IPSec (4 of 11)

Most often a Preshared Key or a RSA public/private key pair is used.

Preshared keys used the same key on all the VPN clients and devices to encrypt and decrypt.

RSA public/private key pair is more secure and requires each end-point to have its own private and public key combination.

IPSec (5 of 11)

Data Integrity This ensures the receiver can detect

if the data has been altered during transmission. To guard against interception and

alteration each message is sent with an hash digest.

The receiver calculates a hash digest on each message it receives and compares it to the sent hash digest.

IPSec (6 of 11)

IPSec uses the “Hashed Message Authentication Codes” (HMAC) protocol to calculate the hash digest. Currently there are two different hash

algorithms that are commonly used: HMAC-MD5: uses a 128-bit shared key and the

message to produce a 128-bit hash digest. MHAC-SHA1: Uses a 160-bit shared key and

the message to produce a 160-bit hash digest.

IPSec (7 of 11)

Origin Authentication This allows the receiver to verify

and authenticate the source of the packet. To do this the sender must attach some type of

digital signature to the message to allow for “peer” authentication.

Each end of the VPN tunnel must authenticate through this process before the transmission path is considered secure.

IPSec (8 of 11)

There are three common “peer” authentication methods: Preshared keys

Each peer has the same secret key entered into it manually.

This preshared key is combined with other information to form an “authentication” key.

This authentication key information is sent through a hash algorithm to create a hash digest that is sent to the other site/client.

If the remote peer is able to generate the same hash, the local peer is authenticated.

IPSec (9 of 11)

RSA signatures Uses a digital certificate that is also

digitally signed. Like the Preshared Key an authentication key

is created using the public/private key pair and other information and is then used to create a hash digest.

The hash digest is then encrypted with the sender’s private key to form the digital signature.

Both the digital certificate and digital signature are forwarded to the remote site.

The public key that is used to decrypt the signature is included in the digital certificate.

IPSec (10 of 11)

RSA encryption nonce Each peer generates a random number,

encrypts it and then exchanges it with the other peer.

Each peer then takes both nonce's and combines then with other information to make the authentication key.

All of this is then run through a hash algorithm to create the hash digest.

Remainder of the process is the same as RSA signatures.

IPSec (11 of 11)

Anti-replay Protection This allows the receiver to verify that

the packet is unique (the original) and has not been duplicated. This is done by comparing the sequence

number of the received packet with the sliding window’s expected sequence on the destination host.

If the sequence number is prior to the sliding window’s sequence number the packet is considered to be late or duplicated and it is dropped.

IPSec Protocols (1 of 10)

IPSec relies on existing technology (DES, 3DES and AES for example) to secure communications, however it provides two main framework protocols.

Authentication Header (AH) Encapsulation Security Payload (ESP)


Authentication Header Used when confidentiality is not

required. It provides data authentication (verifies

packets origin) and integrity (verifies data is not modified).

It does not encrypt the data so text is sent as is - clear, readable text.


Authentication Header con’t Authentication is achieved by using a

one-way hash algorithm to create a message digest based on the message data and the use of a symmetric key known to both systems.

Message data only uses fields in the datagram that remain static throughout transmission. i.e. Fields such as TTL are not used as part of the message data.


Authentication Header con’t Once calculated the message digest is

then combined with the message data and sent to the receiving end.

The receiver performs the same hash calculation and compares the received message digest with its own calculated message digest.

If the results are the same then the authenticity of the packet is verified.


Encapsulation Security Payload Used to provide encryption and

authentication. It provides confidentiality by

performing encryption at the IP packet layer.

Like AH it also provides data authentication (verifies packets origin) and integrity (verifies data is not modified).


Encapsulation Security Payload con’t

ESP supports several symmetric encryption algorithms including DES, 3DES and AES. If used between two VPN gateways the

entire IP Packet (IP Header and payload) are encrypted.



When performing encryption an ESP Header and a trailer are added to the encrypted payload. If we are not performing authentication

a new IP Header would need to be inserted in front of the ESP header to send the now encrypted packet to the receiver.



If we include authentication as part of our ESP scenario it is performed in a similar process to the AH method, however the ESP Header, trailer and encrypted IP Header are all now included in the hashing process.



Once the authentication hashing digest has been calculated, the message digest is appended to the packet behind the ESP trailer and then the new IP Header is appended to the front of the packet.



If ESP encryption and authentication are both used the encryption is performed first then the authentication. This facilitates faster detection and

rejection of incorrect and duplicate packets at the receiving end.

Tunnel and Transport Modes (1 of 7)

ESP and AH can be applied in two different modes.

Tunnel Mode Used between two VPN gateways.

Transport Mode Used between hosts or devices acting

as hosts and gateways.


Tunnel Mode In this mode the original IP header is

copied and is used as the packet’s new IP header. This keeps the original IP datagram (IP Header

and payload) intact. The AH and/or ESP header is appended in

front of the original IP datagram and then the new IP header is inserted at the front of the packet.


Tunnel Mode con’t When using the AH protocol only the

original IP datagram is kept intact. Both the original and new IP Headers now

become part of the authentication process. This becomes a bit of a problem if we are using

NAT as the new IP Header cannot be changed by NAT or it will destroy the hashing digest calculation.

Therefore NAT must be performed first, then the VPN processes can be performed.


Tunnel Mode con’t When using both ESP and AH, the

encryption process of ESP has to be performed first. ESP supports NAT in both Tunnel and

Transport Modes. It allows the entire original datagram to

be encrypted and authenticated because the receiver can authenticate the datagram before decrypting it.


Transport Mode In this mode the IP Address in the

original IP Header is left intact and readable. It uses the existing IP Header as the

mechanism for routing the packet across the internet.

Again, if we are using AH only then we must perform NAT before applying our VPN protocols.


Transport Mode con’t To implement AH or ESP in this

mode the original IP datagram is split into two parts the IP Header and the payload. Transport mode only protects the

payload portion of the packet and doesn’t care if AH and/or ESP are used.


Transport Mode con’t Once the IP Header and payload are

separated the AH and ESP protocol information can be inserted. If only AH is used then it is inserted

between the original IP header and the payload of the datagram.

If ESP is used then the ESP trailer (and possibly the ESP message digest) are appended to the end of the datagram.

VPN LAB (1 of 1)

Your turn…

virtual private networks (vpns) vpns allow secure, remote, connections… but they don’t protect...

Documents

vpn core functions

vpns core functions

data packets

vpn solution

encryption encryption

vpn clients

vpn gateway

vpn endpoints