VPN

Virtual Private Networks (VPNs)
A Virtual Private Network (VPN) provides a secure tunnel across a public (and
thus, insecure) network. This provides a mechanism for organizations to connect
users and offices together, without the high costs of dedicated leased lines.
VPNs are most often used across the Internet, the world’s largest public
network, providing users with access to email, documents, printers, and systems
as if they were actually at their central office.
VPNs are generally used for two purposes:
• Client VPNs - connect home or “roaming” users to an office.

• Site-to-Site VPNs - connect remote offices to a main office.
VPN Benefits:
• Cost Saving
• Security
• Scalability
• Compatibility
Types of Tunneling Protocols:
• Generic Routing Encapsulation (GRE)

• Point-to-point Tunneling Protocol (PPTP)
• Layer 2 Tunneling Protocol (L2TP)
• Secure Socket Tunneling Protocol (SSTP)
• Internet Protocol security (IPsec)
Page | 1
IPsec
IPSEC, short for IP Security, is a suite of protocols, standards, and

algorithms to secure traffic over an untrusted network, such as the Internet.
IPSEC is supported on both Cisco IOS devices and PIX Firewalls.
IPSEC provides three core services:
• Confidentiality – prevents the theft of data, using encryption.

• Integrity – ensures that data is not tampered or altered, using a hashing
algorithm.
• Authentication – confirms the identity of the host sending data, using
pre-shared keys or a Certificate Authority (CA).
• Anti-replay – prevents duplication of encrypted packets, by assigning a
unique sequencing number.
Confidentiality and Encryption
Data sent in clear-text across the Internet can easily be intercepted and
stolen. Because of this, sensitive data should be encrypted when sent across
an untrusted network or domain.
Keys are generated values used to both encrypt and decrypt data. The longer
the key, the more secure that key is. The length of a key is measured in bits.
Two “types” of keys exist:
Symmetric keys can be used to both encrypt and decrypt data. More
specifically, the same key is used to both encrypt a packet (at the sending
device) and then decrypt that packet (at the receiving device). Symmetric
key encryption is efficient but does not scale well in large environments.
Page | 2
Symmetric keys are not openly shared during data transmit and must instead
be installed on each machine prior to the transfer of data. This can be
accomplished using a variety of (inefficient and insecure) methods: email,
sneaker-net, and even snail-mail. Each device on a network would require
every other device’s symmetric key, and thus the lack of scalability.
Asymmetric keys require a separate key for encryption (the public key) and
decryption (the private key). Public keys are openly exchanged between
devices to encrypt data during transfer. Private keys are never exchanged.
Diffie-Hellman (D-H) Public Key Exchange is the most common standard

used to create and exchange keys across insecure mediums. D-H is not used
to encrypt data, but rather to generate the keys that are used to encrypt and
decrypt data.
A variety of popular standards and protocols utilize D-H key exchange,

including SSL (Secure Socket Layer), SSH (Secure Shell), and IPSEC.
The generated public keys encrypt data payload using one of several
available encryption algorithms:
• DES (Data Encryption Standard) – 56-bit key

• 3DES (Triple Data Encryption Standard) – 168-bit key
• AES (Advanced Encryption Standard) - 128, 192, or 256-bit key
• Blowfish – up to a 448-bit key
Additionally, the strength of a key is determined by the D-H group used to

generate that key. There are several D-H groups:
• Group 1 – 768 bits

Page | 3
Data Integrity and Hashing
Data sent across the Internet can not only be stolen but can also be
maliciously altered.
To combat this, a hashing algorithm computes and appends a specific hash
value as each packet is sent. Once the data is received, it is run through the
hashing algorithm again. If the hash value is different, the packet was altered
in transit.
Hashed Message Authentication Code (HMAC) is used to perform this
hashing function. HMAC utilizes a secret key when computing the hash
value, thus preventing an attacker from altering the packet and then
recomputing the correct hash.
Two HMAC algorithms are commonly used:
• HMAC-MD5 (Message-Digest 5) – 128-bit hashed key
• HMAC-SHA1 (Secure Hash Algorithm) – 160-bit hashed key
Page | 4
Authentication
Another concern when sending data across the Internet is the source or
origin of that data. It is possible to masquerade or spoof one’s identity or
address.
For an IPSEC VPN tunnel to be established, both sides of the tunnel must be
authenticated. To accomplish this, either pre-shared keys or RSA digital
signatures are used.
When using pre-shared keys, a secret string of text is used on each device
to authenticate each other. This string must be pre-agreed upon and identical
on each device. This string is then hashed into a digital signature.
When using RSA Digital signatures, a Certificate Authority (CA) is used

to apply a verified digital signature.
Page | 5
The IPSEC Protocols
IPSEC uses one of two protocol headers for securing data:

• Authentication Header (AH)
• Encapsulation Security Payload (ESP)
Authentication Header (AH), or IP protocol 51, provides no
confidentiality of data. It does not encrypt any data at all. However, AH
provides both authentication and integrity services. Because AH does not
perform encryption, it is a quicker standard than ESP.
AH uses a hash algorithm to compute a hash value on both the payload and
header of a packet, ensuring integrity of the packet. However, this causes a
very specific problem. AH will not work through a NATed device.
NAT changes the IP header of a packet during translation, but the hash value
is not changed. Thus, the receiving device will believe the packet has been
altered in transit and reject the packet.
Encapsulation Security Payload (ESP), or IP protocol 50, performs
confidentiality, authentication, and integrity services. Thus, ESP does
perform encryption, and is inherently more secure than AH. ESP introduces
both an additional header and trailer to a packet.
ESP also uses a hash algorithm for data integrity. However, the hash does
not include the IP header of the packet, and thus ESP will (usually) work
through a NATed device.
ESP and AH can be used separately, or used in conjunction with each other.
Page | 6
Transport vs. Tunnel Modes
Each IPSEC protocol (AH or ESP) can operate in one of two modes:
• Transport mode – Original IP headers are left intact. Used when
securing communication from one device to another single device.
• Tunnel mode – the entire original packet is hashed and/or encrypted,
including both the payload and any original headers. A temporary IP
header is applied to the packet during transit. Used to tunnel traffic
from one site to another.
The following demonstrates how AH alters an IP packet:
The following demonstrates how ESP alters an IP packet:
ESP in Tunnel mode experiences NAT difficulties similar to AH. This can
be alleviated by implementing NAT Traversal (NAT-T).
Page | 7
IKE and IPSEC Security Associations
IPSEC VPN peers establish a Security Association (SA), a “connection” or

“policy” between the two endpoints of the VPN tunnel. An SA is a one-way
virtual tunnel between the VPN peers. Thus, for full communication to
occur, two SA’s must be established, one for each direction.
Before the SA can be established, several parameters must be negotiated
between VPN peers, and keys must be both created and exchanged. The
Internet Key Exchange (IKE) protocol controls this negotiation process,
on UDP port 500.
IKE Policy Sets are created to negotiate several parameters, including:
• The encryption algorithm (such as DES, 3DES, or AES)
• The hashing algorithm (such as MD5 or SHA-1)
• The authentication method (such as shared keys or RSA signatures)
• The Diffie-Hellman (D-H) group for creating and sharing keys
• The SA Lifetime, measured in seconds or in kilobytes sent
IKE policies are often referred to as Internet Security Association and Key
Management Protocol (ISAKMP) policies. Multiple IKE policies can be
created on a VPN peer. During the negotiation process, VPN peers share
their list of configured IKE policies. The SA will only be established if there
is an exact matching policy between the peers.
There are two phases to this negotiation process:
IKE Phase 1 establishes the initial tunnel (referred to as the IKE or
ISAKMP SA). Peers are authenticated, encryption and hashing algorithms
are negotiated, and keys are exchanged based on the IKE Policy Sets. Two
modes can be used for Phase 1 negotiation:
• Main Mode – slower, but more secure
• Aggressive Mode – faster, but less secure
Page | 8
IKE Phase 2 establishes the IPSEC tunnel (IPSEC SA), which details the
AH or ESP parameters for securing data. These parameters are contained in
an IPSEC Transform Set.
IKE Phase 1 negotiates parameters for the tunnel (key exchange) itself,
while IKE Phase 2 negotiates parameters for the data traversing that tunnel.
The Five Steps of IPSEC
The operation of IPSEC can be described in five steps:

1. Any traffic that should be secured and sent across the tunnel is
identified as interesting traffic, usually using an access-list.
2. IKE (Internet Key Exchange) Phase 1 is initiated. Peers are
authenticated, keys are exchanged, and IKE Policy Sets are
negotiated. If successful, the IKE SA is established.
3. IKE (Internet Key Exchange) Phase 2 is initiated. IPSEC Transform
Sets are negotiated, and if successful, the IPSEC SA is established.
4. Data is actually transferred, using the agreed upon security policy.
5. The session is torn down once the SA Lifetime expires.
Page | 9

VPN

Uploaded by

Copyright:

Available Formats

VPN

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

VPN

Uploaded by

Copyright:

Available Formats

Virtual Private Networks (VPNs)

VPNs are generally used for two purposes:

• Client VPNs - connect home or “roaming” users to an office.

Types of Tunneling Protocols:

• Generic Routing Encapsulation (GRE)

IPSEC, short for IP Security, is a suite of protocols, standards, and

IPSEC is supported on both Cisco IOS devices and PIX Firewalls.

IPSEC provides three core services:

• Confidentiality – prevents the theft of data, using encryption.

Confidentiality and Encryption

Diffie-Hellman (D-H) Public Key Exchange is the most common standard

A variety of popular standards and protocols utilize D-H key exchange,

• DES (Data Encryption Standard) – 56-bit key

Additionally, the strength of a key is determined by the D-H group used to

• Group 1 – 768 bits

When using RSA Digital signatures, a Certificate Authority (CA) is used

IPSEC uses one of two protocol headers for securing data:

The following demonstrates how ESP alters an IP packet:

IPSEC VPN peers establish a Security Association (SA), a “connection” or

The Five Steps of IPSEC

The operation of IPSEC can be described in five steps:

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.