Internet Security And VPN Network

This article discusses some essential technical concepts associated with a VPN. A Virtual Private Network (VPN) integrates remote employees, company offices, and business partners using the Internet and secures encrypted tunnels between locations. An Access VPN is used to connect remote users to the enterprise network. The remote workstation or laptop will use an access circuit such as Cable, DSL or Wireless to connect to a local Internet Service Provider (ISP). With a client-initiated model, software on the remote workstation builds an encrypted tunnel from the laptop to the ISP using IPSec, Layer 2 Tunneling Protocol (L2TP), or Point to Point Tunneling Protocol (PPTP). The user must authenticate as a permitted VPN user with the ISP. Once that is finished, the ISP builds an encrypted tunnel to the company VPN router or concentrator. TACACS, RADIUS or Windows servers will authenticate the remote user as an employee that is allowed access to the company network. With that finished, the remote user must then authenticate to the local Windows domain server, Unix server or Mainframe host depending upon where there network account is located. The ISP initiated model is less secure than the client-initiated model since the encrypted tunnel is built from the ISP to the company VPN router or VPN concentrator only. As well the secure VPN tunnel is built with L2TP or L2F.

The Extranet VPN will connect business partners to a company network by building a secure VPN connection from the business partner router to the company VPN router or concentrator. The specific tunneling protocol utilized depends upon whether it is a router connection or a remote dialup connection. The options for a router connected Extranet VPN are IPSec or Generic Routing Encapsulation (GRE). Dialup extranet connections will utilize L2TP or L2F. The Intranet VPN will connect company offices across a secure connection using the same process with IPSec or GRE as the tunneling protocols. It is important to note that what makes VPN’s very cost effective and efficient is that they leverage the existing Internet for transporting company traffic. That is why many companies are selecting IPSec as the security protocol of choice for guaranteeing that information is secure as it travels between routers or laptop and router. IPSec is comprised of 3DES encryption, IKE key exchange authentication and MD5 route authentication, which provide authentication, authorization and confidentiality.

Internet Protocol Security (IPSec)

IPSec operation is worth noting since it such a prevalent security protocol utilized today with Virtual Private Networking. IPSec is specified with RFC 2401 and developed as an open standard for secure transport of IP across the public Internet. The packet structure is comprised of an IP header/IPSec header/Encapsulating Security Payload. IPSec provides encryption services with 3DES and authentication with MD5. In addition there is Internet Key Exchange (IKE) and ISAKMP, which automate the distribution of secret keys between IPSec peer devices (concentrators and routers). Those protocols are required for negotiating one-way or two-way security associations. IPSec security associations are comprised of an encryption algorithm (3DES), hash algorithm (MD5) and an authentication method (MD5). Access VPN implementations utilize 3 security associations (SA) per connection (transmit, receive and IKE). An enterprise network with many IPSec peer devices will utilize a Certificate Authority for scalability with the authentication process instead of IKE/pre-shared keys.

  • Laptop – VPN Concentrator IPSec Peer Connection
  • IKE Security Association Negotiation
  • IPSec Tunnel Setup
  • Mode Config Response / Acknowledge (DHCP and DNS)
  • IPSec Security Association

Access VPN Design

The Access VPN will leverage the availability and low cost Internet for connectivity to the company core office with WiFi, DSL and Cable access circuits from local Internet Service Providers. The main issue is that company data must be protected as it travels across the Internet from the telecommuter laptop to the company core office. The client-initiated model will be utilized which builds an IPSec tunnel from each client laptop, which is terminated at a VPN concentrator. Each laptop will be configured with VPN client software, which will run with Windows. The telecommuter must first dial a local access number and authenticate with the ISP. The RADIUS server will authenticate each dial connection as an authorized telecommuter. Once that is finished, the remote user will authenticate and authorize with Windows, Solaris or a Mainframe server before starting any applications. There are dual VPN concentrators that will be configured for fail over with virtual routing redundancy protocol (VRRP) should one of them be unavailable.

Each concentrator is connected between the external router and the firewall. A new feature with the VPN concentrators prevent denial of service (DOS) attacks from outside hackers that could affect network availability. The firewalls are configured to permit source and destination IP addresses, which are assigned to each telecommuter from a pre-defined range. As well, any application and protocol ports will be permitted through the firewall that is required.

Extranet VPN Design

The Extranet VPN is designed to allow secure connectivity from each business partner office to the company core office. Security is the primary focus since the Internet will be utilized for transporting all data traffic from each business partner. There will be a circuit connection from each business partner that will terminate at a VPN router at the company core office. Each business partner and its peer VPN router at the core office will utilize a router with a VPN module. That module provides IPSec and high-speed hardware encryption of packets before they are transported across the Internet. Peer VPN routers at the company core office are dual homed to different multilayer switches for link diversity should one of the links be unavailable. It is important that traffic from one business partner doesn’t end up at another business partner office. The switches are located between external and internal firewalls and utilized for connecting public servers and the external DNS server. That isn’t a security issue since the external firewall is filtering public Internet traffic.

https://pbase.com/topics/kaas09madsen/do_you_need_to_make_a_stella

https://penzu.com/p/2c414f4f

https://diigo.com/0jfduf

https://king46kaas.werite.net/post/2021/01/11/Designing-a-website-needs-time-to-work,-patience-and-a-small-amount-of-know-how.-It-could-be-easy-if-you-are-already-aware-what-is-put-into-fantastic-design,-including-Search-engine-optimisation-and-valuable-navigation.-Read-on-to-find-some-ver

https://petersen13kaas.doodlekit.com/blog/entry/12721505/planning-a-web-site-will-take-time-perseverance-and-a-bit-of-knowhow-it-may-be-easy-if-you-know-what-explores-great-design-like-seo-and-valuable-the-navigation-please-read-on-to-locate-some-great-suggestions-which-can-help-you-develop-the-site-of-the-ambitions

https://holdtfrantzen221.shutterfly.com/21

https://tan83johnson.mystrikingly.com/

https://king16tan.wordpress.com/2021/01/11/many-individuals-enter-in-web-page-design-not-understanding-any-of-the-important-methods-do-you-desire-to-become-a-master-web-design-service-and-have-the-ability-to-construct-your-personal-site-foll/

https://www.instapaper.com/p/petersen06kaas

https://www.diigo.com/profile/mackinnondes

https://blip.fm/lillelund84nash

https://www.longisland.com/profile/kaas45johnson

https://doodleordie.com/profile/lillelund55jo

http://wikifisc.uqtr.ca/index.php?qa=user&qa_1=lillelund11vest

https://seller.ae/user/profile/228856

https://godotengine.org/qa/index.php?qa=user&qa_1=kaas69petersen

https://www.inventables.com/users/boyettedurham2951

https://www.genuitec.com/forums/users/nash85vest

https://app.box.com/s/2v54qtfyix9u3bpfc0y4hesh02qkdc84

https://www.instapaper.com/p/whalen07brown

https://www.diigo.com/profile/foremanbowli

https://blip.fm/andrews63andrews

https://visual.ly/users/foremanbowling84snjqsj/portfolio

https://bbs.now.qq.com/home.php?mod=space&uid=605916

http://www.feedbooks.com/user/6920423/profile

https://knowyourmeme.com/users/whitney95brown/

https://www.ultimate-guitar.com/u/whalen33nichols

https://qiita.com/grace78grace

https://www.inventables.com/users/pereiraochoa2750

https://www.boredpanda.com/author/foremanbowling84snjqsj/

https://www.bonanza.com/users/47360069/profile

https://foursquare.com/user/1361547777/list/web-design-is-definitely-a-complex-topic-you-will

http://www.associazionehombre.it/index.php?option=com_k2&view=itemlist&task=user&id=2137100

https://www.genuitec.com/forums/users/brown15brown

https://ask.fm/brown55whitney14

https://coub.com/suhr18grace

https://files.fm/f/z9sxe5trh

Categories Tec

Our website uses cookies and thereby collects information about your visit to improve our website (by analyzing), show you Social Media content and relevant advertisements. Please see our cookies page for furher details or agree by clicking the 'Accept' button.

Cookie settings

Below you can choose which kind of cookies you allow on this website. Click on the "Save cookie settings" button to apply your choice.

FunctionalOur website uses functional cookies. These cookies are necessary to let our website work.

AnalyticalOur website uses analytical cookies to make it possible to analyze our website and optimize for the purpose of a.o. the usability.

Social mediaOur website places social media cookies to show you 3rd party content like YouTube and FaceBook. These cookies may track your personal data.

AdvertisingOur website places advertising cookies to show you 3rd party advertisements based on your interests. These cookies may track your personal data.

OtherOur website places 3rd party cookies from other 3rd party services which aren't Analytical, Social media or Advertising.