490 likes | 841 Views
An Introduction to VPN Technology. Agenda. What is a Virtual Private Network (VPN)? VPN deployment situations Why use VPNs? Types of VPN protocols IPSec VPNs Components A sample session Deployment questions. VPN. VPN. What is a VPN?. Acme Corp.
E N D
Agenda • What is a Virtual Private Network (VPN)? • VPN deployment situations • Why use VPNs? • Types of VPN protocols • IPSec VPNs • Components • A sample session • Deployment questions
VPN VPN What is a VPN? Acme Corp • A VPN is a private connection over an open network • A VPN includes authentication and encryption to protect data integrity and confidentiality Internet Acme Corp Site 2
Types of VPNs • Remote Access VPN • Provides access to internal corporate network over the Internet • Reduces long distance, modem bank, and technical support costs Corporate Site Internet
Types of VPNs Corporate Site • Remote Access VPN • Site-to-Site VPN • Connects multiple offices over Internet • Reduces dependencies on frame relay and leased lines Internet Branch Office
Types of VPNs Corporate Site • Remote Access VPN • Site-to-Site VPN • Extranet VPN • Provides business partners access to critical information (leads, sales tools, etc) • Reduces transaction and operational costs Internet Partner #2 Partner #1
Types of VPNs • Remote Access VPN • Site-to-Site VPN • Extranet VPN • Client/Server VPN • Protects sensitive internal communications • Most attacks originate within an organization Database Server LAN clients Internet LAN clients with sensitive data
Alternate Technologies • Site-to-site/extranets • Frame relay, leased lines • Remote access • Dial up modem banks
Why Use Virtual Private Networks? • More flexibility • Leverage ISP point of presence • Use multiple connection types (cable, DSL, T1, T3)
Why Use Virtual Private Networks? • More flexibility • More scalability • Add new sites, users quickly • Scale bandwidth to meet demand
Why Use Virtual Private Networks? • More flexibility • More scalability • Lower costs • Reduced frame relay/leased line costs • Reduced long distance • Reduced equipment costs (modem banks,CSU/DSUs) • Reduced technical support
Non-VPN Savings with VPN-1 Solution Solution VPN Startup Costs Existing; (Hardware $51,965 sunk costs = and Software) $0 Site-to-Site $41,180 /yr $30,485 $71,664 Frame relay Annual Cost RAS $556,800 /yr $48,000 $604,800 Dial-in costs Annual Cost Combined $597,980 /yr $78,485 $676,464 Annual Cost VPN-1 Return on Investment Case History – Professional Services Company • 5 branch offices, 1 large corporate office, 200 remote access users. • Payback: 1.04 months. Annual Savings: 88%
VPN ROI Calculator Tool URL: http://www.checkpoint.com/products/vpn1/roi_calculators/index.html
Components of a VPN • Encryption • Message authentication • Entity authentication • Key management
Internet Point-to-Point Tunneling Protocol • Layer 2 remote access VPN distributed with Windows product family • Addition to Point-to-Point Protocol (PPP) • Allows multiple Layer 3 Protocols • Uses proprietary authentication and encryption • Limited user management and scalability • Known security vulnerabilities Corporate Network Remote PPTP Client PPTP RAS Server ISP Remote Access Switch
Internet Layer 2 Tunneling Protocol (L2TP) • Layer 2 remote access VPN protocol • Combines and extends PPTP and L2F (Cisco supported protocol) • Weak authentication and encryption • Does not include packet authentication, data integrity, or key management • Must be combined with IPSec for enterprise-level security Corporate Network Remote L2TP Client L2TP Server ISP L2TP Concentrator
Internet Protocol Security (IPSec) • Layer 3 protocol for remote access, intranet, and extranet VPNs • Internet standard for VPNs • Provides flexible encryption and message authentication/integrity • Includes key management
Components of an IPSec VPN • Encryption • Message Authentication • Entity Authentication • Key Management • DES, 3DES, and more • HMAC-MD5, HMAC-SHA-1, or others • Digital Certificates, Shared Secrets,Hybrid Mode IKE • Internet Key Exchange (IKE), Public Key Infrastructure (PKI) All managed by security associations (SAs)
Security Associations • An agreement between two parties about: • Authentication and encryption algorithms • Key exchange mechanisms • And other rules for secure communications • Security associations are negotiated at least once per session – possibly more often for additional security
Encryption Explained • Used to convert data to a secret code for transmission over an untrusted network Encrypted Text Clear Text Encryption Algorithm “The cow jumped over the moon” “4hsd4e3mjvd3sd a1d38esdf2w4d”
Symmetric Encryption • Same key used to encrypt and decrypt message • Faster than asymmetric encryption • Used by IPSec to encrypt actual message data • Examples: DES, 3DES, RC5, Rijndael Shared Secret Key
Asymmetric Encryption • Different keys used to encrypt and decrypt message (One public, one private) • Provides non-repudiation of message or message integrity • Examples include RSA, DSA, SHA-1, MD-5 Bob Alice Alice Private Key Decrypt Alice Public Key Encrypt
Key Management • Shared Secret • Simplest method; does not scale • Two sites share key out-of-band (over telephone, mail, etc) • Public Key Infrastructure • Provides method of issuing and managing public/private keys for large deployments • Internet Key Exchange • Automates the exchange of keys for scalability and efficiency
What are Keys? • An Encryption Key is: • A series of numbers and letters… • …used in conjunction with an encryption algorithm… • …to turn plain text into encrypted text and back into plain text • The longer the key, the stronger the encryption
What is Key Management? • A mechanism for distributing keys either manually or automatically • Includes: • Key generation • Certification • Distribution • Revocation
Internet Key Exchange (IKE) • Automates the exchange of security associations and keys between two VPN sites • IKE provides: • Automation and scalability • Improved security • Encryption keys be changed frequently • Hybrid IKE • Proposed standard designed by Check Point • Allows use of existing authentication methods
Internet Internet Internet VPN Firewall Firewall VPN Internet VPN Firewall Different Types of VPN/Firewall Topologies VPN device is vulnerable to attack eg. denial of service Two connections to the firewall for every communication request Bypasses security policy Denial of service
Internet Internet Internet VPN Firewall Only integrated VPN/firewall solutions can deliver full access control and consistent security policy enforcement Firewall VPN Internet VPN Firewall Different Types of VPN/Firewall Topologies VPN device is vulnerable to attack eg. denial of service Two connections to the firewall for every communication request Bypasses security policy Denial of service
Protecting Remote Access VPNs • The Problem: • Remote access VPN clients can be “hijacked” • Allows attackers into internal network • The Solution: • Centrally managed personal firewall on VPN clients Attacker Cable or xDSL Internet
Summary • Virtual Private Networks have become mission-critical applications • IPSec is the leading protocol for creating enterprise VPNs • Provides encryption, authentication, and data integrity • Organizations should look for: • Integrated firewalls and VPNs • Centralized management of VPN client security • A method to provide VPN QoS