Virtual Private Networks (VPNs) Simplified

1 2008 Cisco Systems, Inc. All rights PublicBRK-134 TVPNs Simplified1 Virtual Private Networks ( vpns ) SimplifiedErich SpenglerCSSIA CATC Moraine Valley Community College2008 60 Minute SessionBRK-134 TVPNs Simplified2 2008 Cisco Systems, Inc. All rights PublicAgenda Demonstration Introduction to vpns VPN Security (IPSec, PPTP, SSL) VPN Technology Comparison VPN Group ExerciseBRK-134 TVPNs Simplified3 2008 Cisco Systems, Inc. All rights PublicDemonstration Remote network Access via VPNC orporate ServersVPN Server/GatewayInternet/ Unsecure NetworkVPN Tunnel Encrypted Traffic to the Corporate ServerRemote UserBRK-134 TVPNs Simplified4 2008 Cisco Systems, Inc. All rights PublicVPNs Simplified 2008 Cisco Systems, Inc. All rights to VPNsBRK-134 TVPNs Simplified5 2008 Cisco Systems, Inc.

2 All rights PublicWhat Is a Virtual Private network (VPN)?A Remote Access VPN secures connections for remote users, such as mobile users or telecommuters, to corporate LANs over shared service provider networksHomeworker with VPN Client SoftwareHomeworker with VPN RouterBranch Office with VPN RouterTeleworker with VPN Client SoftwareDial-Up User with VPN Client SoftwareCorporate HQWireless Client with VPN Client SoftwarePublic Telephone NetworkInternetWireless HotspotBRK-134 TVPNs Simplified6 2008 Cisco Systems, Inc. All rights PublicWireless: A New Big Driver for vpns An access point (AP) is a shared device Remember the performance issues of shared hubs Bridges, and other devices allow for interconnection Protocols and applications work seamlesslyInternetBRK-134 TVPNs Simplified7 2008 Cisco Systems, Inc.

3 All rights PublicBasic VPN TermsInternetRouter to Router VPN Gateway (Extranet)VPN Client to Router VPN via Dial-Up (Access VPN)InternetOther Vendors to Router VPN (Extranet)InternetRouter to VPN Firewall Gateway (Extranet)VPN Client to Router VPN network (Intranet)BRK-134 TVPNs Simplified8 2008 Cisco Systems, Inc. All rights PublicUsing Site-to-Site VPNsCentral SiteIntranetBranch/Remote OfficeExtranetBusiness-to-BusinessVPNVPN VPNVPNF rame RelayWAN NetworkInternet VPNPSTN/ISDNB roadbandBRK-134 TVPNs Simplified9 2008 Cisco Systems, Inc. All rights PublicCentral SiteRouterOrOrUsing Remote-Access VPNsRemote Access Client Cisco VPN Clients (IPSec) Microsoft Win 9x/NT/2000/XP (LTTPP) Thire-party VPN client (PPTP)Remote Access Gateway Cisco WAN Router Cisco Secure PIX Firewall Or IPSec or PPTP aware device to provide firewall/VPN Tunnel TerminationMobileRemote Access ClientTelecommuterPOPPOPI nternetExtranet Consumer-to-ConsumerDSL CableBRK-134 TVPNs Simplified10 2008 Cisco Systems, Inc.

4 All rights PublicVPN ComponentsGREL2 TPMPLSPPTPTCP Checksum AH in IPSecPrevent TamperingIntegrityIncrease ProtectionEncryptionSeparate DataTunnelingIdentify SourceAuthenticationIPSecDES, 3 DESMPPEPKIRSARSABRK-134 TVPNs Simplified11 2008 Cisco Systems, Inc. All rights PublicVPNs Simplified 2008 Cisco Systems, Inc. All rights SecurityBRK-134 TVPNs Simplified12 2008 Cisco Systems, Inc. All rights PublicWhat a VPN Must ProvideConfidentialityAvailabilityIntegr ityBRK-134 TVPNs Simplified13 2008 Cisco Systems, Inc. All rights PublicNetwork Security ModelConfidentialityData Security Assurance Model (CIA) BenefitEnsures data is unaltered during transit ShunsAlterationReplay BenefitEnsures identity of originator or recipient of data ShunsImpersonationReplayIntegrityAuthent icationData Confidentiality and Data Integrity Depend on Encryption and Encapsulation Benefit Ensures data privacy Shuns Sniffing ReplayBRK-134 TVPNs Simplified14 2008 Cisco Systems, Inc.

5 All rights PublicVPN Technology OptionsApplication Layer (5 7)Transport/ network Layer (3 4)Link/Physical Layer (1 2)GRE PPTP L2TP MPLSIPSEC MPPELink-Layer EncryptionLink-Layer EncryptionApplication LayerSSLSSHN etwork LayerBRK-134 TVPNs Simplified15 2008 Cisco Systems, Inc. All rights PublicWhat Is an IPSec VPN?Internet Protocol Security A set of security protocols and algorithms used to secure IP data at the network layer IPSec provides data confidentiality(encryption), integrity(hash), authentication(signature/certificates) of IP packets while maintaining the ability to route them through existing IP networksBRK-134 TVPNs Simplified16 2008 Cisco Systems, Inc. All rights PublicAdvantages of IPSec Access vpns Classic site-to-site managed vpns Trusted MPLS VPNsBusiness PartnerRemote OfficeRegional OfficeMain OfficeHome OfficePOPS ervice ProviderMobile WorkerMobile WorkerBRK-134 TVPNs Simplified17 2008 Cisco Systems, Inc.

6 All rights PublicIPSec Key Points IPSec can ensure the confidentiality and/or the authenticity of IP packets The key points areTwo modes of propagation (transport and tunnel)Security associations (SAs)Two types of header (ESP and AH)IP HeaderAH HeaderESP HeaderIP Data (Encrypted)BRK-134 TVPNs Simplified18 2008 Cisco Systems, Inc. All rights PublicIPSec FrameworkESP Encapsulating Security PayloadAH Authentication Header AES Advanced Encryption StandardMD5, SHA Authentication DH Diffie-Hellman Identifier to Derive the Share Secret IPSec FrameworkIPSec ProtocolEncryptionAuthenticationDHMD5 SHADH1DH2DH5 ESPESP + AHAHDES3 DESAESC hoicesBRK-134 TVPNs Simplified19 2008 Cisco Systems, Inc. All rights PublicTwo Types of IPSec Security Protocols Ensures data integrity Provides origin authentication ensures packets definitely came from peer router Uses keyed-hash mechanism Does notprovide confidentiality (no encryption) Provides optional replay protectionRouter ARouter BAll Data in CleartextAuthentication Header Data confidentiality (encryption) Limited traffic flow confidentiality Data integrity Optional data origin authentication Anti-replay protection Does not protect IP headerRouter ARouter BData Payload Is EncryptedEncapsulating Security PayloadBRK-134 TVPNs Simplified20 2008 Cisco Systems, Inc.

7 All rights PublicIP Header with IPSec InformationIP HeaderAH HeaderESP HeaderIP Data (Encrypted)IP HeaderAH HeaderESP HeaderIP DataBRK-134 TVPNs Simplified21 2008 Cisco Systems, Inc. All rights PublicIPSec in a Standards WorldStandards-Based Cryptography IKE, IPSec, 3 DES Equipment/vendor interoperabilityHeadquartersFirewallRout erFirewallRemote OfficePeriodic Re-KeyInternet/IP VPNCERTIFICATEBRK-134 TVPNs Simplified22 2008 Cisco Systems, Inc. All rights PublicIKE Benefits an IPSec Environment Ensure confidential communications in an unsecured network Also known as the Key Management Nightmare!!!UNIVERSITYBRK-134 TVPNs Simplified23 2008 Cisco Systems, Inc. All rights PublicIPSec: Building a Connection Two-phase protocol:Phase 1 exchange: two peers establish a secure, authenticated channel with which to communicate; Main mode or Aggressive mode accomplishes a Phase 1 exchangePhase 2 exchange: security associations are negotiated on behalf of IPSec services; Quick mode accomplishes a Phase 2 exchange Each phase has its SAs: ISAKMP SA(Phase 1) and IPSec SA(Phase 2)DataIKE (Phase 2)IKE (Phase 1)BRK-134 TVPNs Simplified24 2008 Cisco Systems, Inc.

8 All rights PublicHow Does IKE/IPSec Work?Quick ModeQuick ModePhase I SA (ISAKMP SA)Phase II SA(IPSec SA)Phase II SA(IPSec SA)New IPSec Tunnel or RekeyMain Mode(6 Messages)Aggressive Mode(3 Messages)A Protected Data BC Protected Data DBRK-134 TVPNs Simplified25 2008 Cisco Systems, Inc. All rights PublicISAKMP Main, Quick and Aggressive Modes123 HeaderHashSA[Key]HashHeaderSA[Key]Header HashNonceID/IDNonceID /IDISAKMPMain Mode(Phase 1)ISAKMPQ uick Mode(Phase 2)HeaderSASAH eaderHeaderKeyHeaderIDKeyHeaderIDHeaderN onceNonce[ Cert ]Sig[ Cert ]Sig123456 RESPONDERINITIATORH eaderSA[Key]NonceIDHeaderSA[Key]NonceID1 23 Header[Cert][Cert]SigSigISAKMPA ggressive Mode(Phase 1)BRK-134 TVPNs Simplified26 2008 Cisco Systems, Inc. All rights PublicWhat Is a Web/SSL VPN?

9 Uses certificates for identification Private key used to prove identity SSL server provides all encryption keys Originally for HTTP/Web applicationsCertificateCertificateBRK-13 4 TVPNs Simplified27 2008 Cisco Systems, Inc. All rights PublicWireless LANWeb/SSL VPN FeaturesFeature Access to internal web sites (HTTP/HTTPS) including filtering Access to internal Windows (CIFS) File Shares TCP port forwarding for legacy application support Access to e-mail via POP, SMTP, and IMAP4 over SSLC orporate NetworkBroadband ProviderISPA ccess PointBroadband ModemASA FirewallWebVPNWebVPNBRK-134 TVPNs Simplified28 2008 Cisco Systems, Inc. All rights PublicWeb/SSL VPN and IPSec ComparisonWebVPN Uses a standard web browser to access the corporate network SSL encryption native to browser provides transport security Application accessed through browser portal Limited client/server application accessed using appletsIPSEC VPN Uses purpose built client software for network access Client provides encryption and desktop security Client establishes seamless connection to network All application are accessible through their native interfaceBRK-134 TVPNs Simplified29 2008 Cisco Systems, Inc.

10 All rights PublicWhat Is a PPTP VPN?Point to Point Tunneling Protocol PPTP is a network protocol used in the implementation of Virtual Private Networks (VPN); RFC 2637is the PPTP technical specification PPTP works on a client server model; PPTP clients are included by default in Microsoft Windows and also available for both Linux and Mac OS X; newer VPN technologies like L2TP and IPSec may replace PPTP someday, but PPTP/MPPE remains a popular network protocol especially on Windows computers BRK-134 TVPNs Simplified30 2008 Cisco Systems, Inc. All rights PublicVPN Technology OptionsApplication Layer (5 7)Transport/ network Layer (3 4)Link/Physical Layer (1 2)GRE PPTP L2TP MPLSIPSEC MPPELink-Layer EncryptionLink-Layer EncryptionApplication LayerSSLSSHN etwork LayerBRK-134 TVPNs Simplified31 2008 Cisco Systems, Inc.