VPNVPN

Virtual Private NetworksVirtual Private Networks

______________________________________________________________________________________________________

Raghavendra KN Rao

IntroductionIntroduction

In today's insecure world, there comes a need to gain ability to transfer information in a network that won't be seen, or intercepted by unauthorized people. The traditional way was to use a point to point lines where the lines were just for you and the people you need to pass covert information to. However, these lines were very expensive, and inflexible. What they needed was to the ability to communicate safely through a public network. Thus came the

Virtual Private Network ( VPN )

A VPN (virtual private network) is a private data network that uses public telecommunicating infrastructure (Internet),maintaining privacy using encryption and, tunneling protocol and security procedures to connect users securely.

What is VPN ? ( Definition )What is VPN ? ( Definition )

“virtual” implies that there is no physical connection between the two networks; Instead connections routed through the Internet

“private” implies that the transmitted data is kept confidential (encryption and secured tunneling)

“network” implies communication medium using private, public,wired, wireless, Internet or any resource available

Why VPN ?Why VPN ?

• Low-cost• Secured and reliable communication• Dynamic access to private networks• Such access would otherwise only be possible

Using expensive leased dedicated lines provided by telephone companies point to point dedicated digital circuit Dialing into the local area network (LAN)

How VPN works ? ( Example )How VPN works ? ( Example )

Fire wa ll / R o u te r / G a te wa y

Fire wa ll / R o u te r / G a te wa y

Home Comp

Office Computer

VPN Firewall / Router

VPN Firewall / Router

Typical VPN NetworkTypical VPN Network

When I' am sending a mail from my home computer to office computer thru VPN network ;

VPN enabled Firewall / Router will encapsulate / encrypt the mail

Mail will go thru Public network ( Internet ) encrypted

VPN enabled Firewall / Router will decrypt the mail and pass it

Types Of VPNsTypes Of VPNs

Remote AccessThis type of VPN is a user-to-LAN connection via a public or shared network. Many large companies have employees that have a need to connect to the corporate LAN from the field. These field agents will access the corporate LAN by using their remote computers and laptops. Their systems use special client-loaded software that enables a secure link between themselves and the corporate LAN.

Internet

Corporate Headquarters

Laptop

User from Home

Internet

Corporate HQ

Continued….

Site-to-site

A Site-to-site VPN connects fixed sites to a corporate LAN, thus extending it over a public or shared network.

There are two types of Site-to-site VPNs:

Intranet-based - This type of Site-to-site VPN is used to extend a company's existing LAN to other buildings and sites, so that these remote employees can utilize the same network services.Extranet-based- With an Extranet-based VPN two or more companies can establish a

secure network connection in order to enjoy a shared computing environment. A good example would be companies that work closely with suppliers and partners to achieve common goals such as supply and demand relationships. Such as, when one company has a demand for supplies and the supplier fulfills the demand based upon the company's needs. Working across an Extranet, these two companies can share information much faster.

Remote Access NetworkRemote Access Network

A remote access VPN is for home or traveling users who need to access their corporate network from a remote location. They dial their ISP and connect over the Internet to company’s internal WAN. This is made possible by installing client software program on the remote user’s laptop or PC that deals with the encryption and decryption of the VPN traffic between itself and the VPN gateway on the central LAN.

Site- to- Site Connection NetworkSite- to- Site Connection Network

A Fixed VPN is normally used between two or more sites allowing a central LAN to be accessed by remote LANs over the Internet of private communication lines using VPN Gateways. VPN Gateways (Normally a VPN- enabled router) are placed at each remote site and at the central site to allow all encryption and decryption and tunneling to be carried out transparently.

Design Goals and Features of VPNDesign Goals and Features of VPN

Security - Tunneling support between sites with at least 128 bit encryptions of the data.

Confidentiality – Protects Privacy

• Private key cryptography• Public key cryptography

Integrity - Ensures that the information being transmitted over the Internet is not being altered

• One-way hash functions• Message Authentication codes (encryption of hash)• Digital Signatures (Hash functions + Private Key)

Authentication - Ensures the identity of all communicating parties

• Password Authentication• Digital Certificates - is a file that binds an identity to the associated public key. This binding is validated by a trusted third party, the certification authority (CA)

Scalability - Extra users and bandwidth can be added easily to adapt new requirements.

Services

• QoS (Quality of Services)• Reports on user activity, management of user policies and monitoring of VPN.

VPN TunnelingVPN Tunneling

Voluntary Tunneling:

The VPN Client manages connection setup. The client first makes a connection to the carrier network provider (ISP) and then, the VPN Client application creates the tunnel to a VPN server over this live connection.

Compulsory Tunneling:

1. The carrier network provider manages VPN connection setup. When the client first makes an ordinary connection to the carrier, the carrier immediately brokers a VPN connection between the client and a VPN server. From the client point of view, VPN connections are setup in just one step compared to the two- step procedure for voluntary tunnels

2. Compulsory VPN tunneling authenticates clients and associates them with specific VPN server using logic built into the broker device. It also hides the details of VPN server connectivity from VPN client.

Tunneling is a way of forwarding multiprotocol packets from a remote user to a corporate network or a third-party Internet Service Provider (ISP) using an ISP that supports Virtual Private Networking (VPN).

VPN ProtocolsVPN ProtocolsLayer 2 - Data Link Layer:

PPTP - Point-to-Point Tunneling Protocol

L2F - Layer 2 Forwarding Protocol

L2TP - Layer 2 Tunneling Protocol

CHAP - Challenged Handshake Authentication Protocol

PAP - Password Authentication Protocol

MS-CHAP - Microsoft Challenged Handshake Authentication Protocol

Layer 3 – Network Layer (IP):

IPSec - Internet Protocol Security

Transport Layer (TCP/UDP):

SOCKS V5 - Sock-et-S version 5

SSL -Secure Socket Layer

Dell Wireless Routers SpecificDell Wireless Routers Specific

Does the Dell TrueMobile 2300 support Virtual Private Networking (VPN)?

Yes, the Dell TrueMobile 2300 supports Yes, the Dell TrueMobile 2300 supports PPTP, IPSec, L2TPPPTP, IPSec, L2TP VPN pass-through VPN pass-through..

Does the Dell TrueMobile 1184 support Virtual Private Networking (VPN)?

Yes, the Dell TrueMobile 1184 supports Yes, the Dell TrueMobile 1184 supports PPTP, IPSec, L2TPPPTP, IPSec, L2TP VPN pass-through. VPN pass-through. http://training.us.dell.com/training/new_products/Peripherals_Portables/network/ozzy/usergde/enu/help/index.htm

http://training.us.dell.com/training/new_products/Peripherals_Portables/network/ziggy/UG/English/help/index.htm

IPSec – Internet Protocol SecurityIPSec – Internet Protocol Security

Network Layer Protocol – Layer 3 Solution

A set of authentication and encryption – the only protocol with Standard of IFTF (Internet Engineering task Force)

Data confidentiality, integrity, authentication and key management, in addition to tunneling

Typically works on the edges of a security domain.

Supports Ipv4 and IPv6

Encapsulates each packet by wrapping another packet around itand then encrypts the entire packet. This encrypted stream oftraffic forms a secure tunnel across an otherwise unsecurednetwork.

Majority VPN vendors are implementing IPSec in their solutions

PPTP – Point- to- Point Tunneling ProtocolPPTP – Point- to- Point Tunneling Protocol

PPTP is a tunneling protocol provided by Microsoft, which provides remote users, encrypted, multi protocol access to a corporate network over the Internet.

It encapsulates PPP frames in IP data grams (IP, IPX and NetBEUI are encapsulated)

PPTP is built in to NT 4.0 and the client is free for the older versions such as Windows 95.

Microsoft’s implementation of PPTP has been found to have several problems that make it vulnerable to attacks, and it also lakes the scalability in that it only supports 255 concurrent connections per server.

Require an IP Network between PPTP Client and PPTP Server ( either LAN or dial- up)

PPTP can support only one tunnel at a time for each user.

Uses TCP Port 1723

L2TP – Layer 2 Tunneling ProtocolL2TP – Layer 2 Tunneling Protocol

PPTP’s successor L2TP (a hybrid of Microsoft’s PPTP and Cisco Systems’ Layer 2 Forwarding - L2F protocol) can support multiple, simultaneous tunnels for each user. It encapsulates PPP frames in IP data grams

Extends from the remote host to all the way back to corporate gateway. In effect, the remote host appears to be on the same subnet as the corporate gateway

It Uses UDP and supports any routed protocol, including IP, IPX and AppleTalk, including frame relay, ATM, X. 25

Because of L2TP’s use of PPTP, it is included as part of the remote access features of most Windows Products

It does not provide cryptographically key security features

It can support IPSec for data encryption and integrity

Compulsory tunneling Model

UDP Port 1701

VPN AdvantagesVPN Advantages

Authenticate all packets of data received, ensuring that they are from a trusted source and encryption ensures the data remains confidential

Most VPNs connect over the Internet so call costs are minimal, even if the remote user is a great distance from the central LAN.

A reduction in the overall telecommunication infrastructure – as the ISP Provides the bulk of the network.

Reduced cost of management, maintenance of equipment and technical support. Simplifies network topology by eliminating modem pools and a private network infrastructure.

VPN functionality is already present in some IT equipments.

VPNs are easily extended by increasing the available bandwidthand by licensing extra client software.

VPN DisadvantagesVPN Disadvantages If the ISP or Internet connection is down, so it’s VPN.

The central site must have a permanent Internet connection so that the remote clients and other sites can connect at anytime.

May provide less bandwidth than a dedicated line solution.

Different VPN manufacturers may comply with different standards.

All traffic over the VPN is encrypted, regardless of need. This can be potentially cause bottleneck since encrypting and decrypting causes network overhead.

Provides no internal protection on the corporate network. – The VPN endpoint is typically at the edge of the network.

Once employees are on the internal corporate network, data is no longer encrypted. (SSH provides point-to-point secure communication.)

Most VPN technologies today do not address performance and availability issues as important as they are.

Why? Because the majority of VPN solutions exist on client machines and gateway servers at the extreme ends of the communication path. They simply cannot consistently affect the performance of the network components in the middle. Unfortunately, this middle is exactly the Internet.

Troubleshooting Dell Wireless RoutersTroubleshooting Dell Wireless Routers - VPN Connections- VPN Connections

1. Remember, Dell Wireless routers only supports PPTP, IPSec, L2TP VPN pass-through

2. Make sure the VPN connection is not using any Static IP on the VPN Client

Even the connection depends on the VPN Client Application; In general, most VPN applications will automatically function properly through the router. In some cases, you may need to specifically open ports in the router through the Port Forwarding section.

If connection is using IP Sec, need to open port 500. If connection is using PPTP, need to open port 1723. If connection is using L2TP, need to open port 1701.

Continue for the Port Forwarding screens…..Continue for the Port Forwarding screens…..

4.

3. If your computer is running a software firewall (such as Norton Firewall, ZoneAlarm, or Windows XP Firewall) the VPN Client may not be able to initiate a tunnel. Disable the software firewall and try again.

5. If VPN client application is like SafeNet, Checkpoint, Cisco, SecureRemote, AT&T Client VPN etc. Try reinstalling the software or need to open specific ports depending on application.

Port Forwarding screens…..Port Forwarding screens…..

TM 2300TM 2300

Goto Router page by 192.168.2.1 – Click tab – Click tab

Click ADD button under Custom Port Forwarding Settings – Opens the Ports and SUBMIT

Continue….

Port Forwarding screens…..Port Forwarding screens…..

TM 1184TM 1184

Goto Router page by 192.168.2.1 – Click tab – Click tab

Under Custom Port Forwarding – Put the Port information and SUBMIT

The END