Network Defense and
Countermeasures
Sir. Ahmad Kamalrulzaman Othman
FSKM, UiTM Johor
Chapter 7: Virtual Private Networks
Objectives
Use a virtual private network (VPN)
Use point-to-point tunneling protocol (PPTP)
as an encryption tool for VPNs
Use layer 2 tunneling protocol (L2TP) as an
encryption tool for VPNs
Add security and privacy to a communication
using IPSec
Understand and evaluate VPN solutions
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
Introduction
Virtual private networks (VPNs) provide users
of your network the ability to establish a secure
remote connection to the network as if they
were connecting locally. VPNs provide a
solution to the administrators need for security
in remote connections while solving the users
need to connect from virtually anywhere.
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
Basic VPN Technology
Data is encapsulated with a header and
transmitted over the Internet
Does not require additional technologies
Multiple methods of connection are available:
Dial-up and modem bank
High-speed (DSL, cable-modem, etc.)
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
Basic VPN Technology cont.
Remote users are not the only beneficiaries
Site-to-site connections can also be made
Allows an organization to move away from
expensive dedicated data lines
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
Using VPN Protocols for VPN
Encryption
Point-to-Point Tunneling Protocol (PPTP)
PPTP Authentication
Layer 2 Tunneling Protocol (L2TP)
L2TP Authentication
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
Using VPN Protocols for VPN
Encryption cont.
MS-CHAP
PAP
SPAP
IPSec
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
VPN Protocols cont.
PPTP
Enables PPP to be encapsulated in IP
Older protocol than L2TP and IPSec
Consumes fewer resources than L2TP and IPSec
Originally proposed as a standard in 1996
Most VPN vendors support it
Operates at layer 2 of the OSI model
Supports IPX and Net-BEUI transmissions
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
VPN Protocols cont.
PPTP (Continued)
Supports two types of tunneling:
Voluntary
Compulsory
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
VPN Protocols cont.
PPTP Authentication
Extensible Authentication Protocol (EAP)
Challenge Handshake Authentication Protocol
(CHAP)
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
10
VPN Protocols cont.
L2TP
Enhancement to PPTP
Considered less secure than IPSec
Not uncommon to be used in conjunction with
IPSec
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
11
VPN Protocols cont.
L2TP Authentication
EAP
CHAP
MS-CHAP
PAP
SPAP
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
12
L2TP Authentication cont.
MS-CHAP
Microsoft-specific extension to CHAP
There are differences between CHAP and MS-CHAP
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
13
MS-CHAP v. CHAP
Response packet formatted for Windows
compatibility
Does not require the authenticator to store a
clear-text or reversibly encrypted password
Provides retry and password changing
mechanisms
Defines a set of reason-for-failure codes
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
14
L2TP Authentication
PAP
Password Authentication Protocol
Most basic form of authentication
Username and password transmitted in clear text
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
15
L2TP Authentication cont.
SPAP
Shiva Password Authentication Protocol
Proprietary version of PAP
Encrypted username and password
Susceptible to Playback attack
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
16
L2TP Compared to PPTP
L2TP
PPTP
Non IP networks Yes, L2TP can
No, IP only
work over X.25
networks and ATM
networks
Encryption
Yes, using IPSec Yes, using MPPE
Authentication
2006 by Pearson Education, Inc.
Yes, using EAP, Yes, EAP, CHAP
MS-CHAP, CHAP,
SPAP, and PAP
Chapter 7 Virtual Private Networks
17
L2TP Additional Resources
The following sites provide additional
information on L2TP:
Wikipedia: [Link]/wiki/L2TP
Cisco:
[Link]/univercd/cc/td/doc/product/softwa
re/ios120/120newft/120t/120t1/[Link]
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
18
IPSec
Short for Internet Protocol Security
Developed by the Internet Engineering Task
Force (IETF)
[Link]
Two encryption modes:
Transport & Tunnel
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
19
IPSec cont.
Other protocols used with IPSec:
Authentication Header (AH)
Encapsulated Security Payload (ESP)
IPComp (IP Payload compression)
Internet Key Exchange (IKE)
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
20
IPSec cont.
Additional details can be found at these sites:
The IPSec FAQ
The High Performance Computing Group
IPSec for Free BSD
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
21
Implementing VPN Solutions
Built-in solutions
Cisco Solutions
Service Solutions
Free S/WAN
Other solutions
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
22
Summary
VPNs provide a secure way of connecting
remote users to the network
L2TP, PPTP, IPSec are protocols that can be
used
PPTP is based on the PPP
It is essential to understand the OSI model in
relation to how protocols interact and
communicate
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
23
Summary cont.
There are various VPN solutions that can be
implemented
Solutions built into an operating system may
not provide adequate features for large
companies
2006 by Pearson Education, Inc.
Chapter 7 Virtual Private Networks
24