Virtual
Private
Networks
Overview
Types of VPNs
When and why VPN?
VPN Design Issues
Security Issues
VPN Examples: PPTP, L2TP, IPSec
Raj Jain
2
What is a VPN?
Private Network: Uses leased lines
Virtual Private Network: Uses public Internet
Internet
Service
Provider
Raj Jain
3
Types of VPNs
WAN VPN: Branch offices
Access VPN: Roaming Users
Extranet VPNs: Suppliers and Customers
Branch Office
ISP
Head Office Partner
Telecommuter
Raj Jain
4
When to VPN?
Modest Many
Bandwidth Locations
QoS not Long
Critical Distance
More Locations, Longer Distances, Less
Bandwidth/site, QoS less critical
VPN more justifiable
Fewer Locations, Shorter Distances, More
Bandwidth/site, QoS more critical
VPN less justifiable
Raj Jain
5
VPN Design Issues
1. Security
2. Address Translation
3. Performance: Throughput, Load balancing (round-
robin DNS), fragmentation
4. Bandwidth Management: RSVP
5. Availability: Good performance at all times
6. Scalability: Number of locations/Users
7. Interoperability: Among vendors, ISPs, customers (for
extranets) Standards Compatibility, With firewall
Raj Jain
6
Design Issues (Cont)
8. Compression: Reduces bandwidth requirements
9. Manageability: SNMP, Browser based, Java based,
centralized/distributed
10. Accounting, Auditing, and Alarming
11. Protocol Support: IP, non-IP (IPX)
12. Platform and O/S support: Windows, UNIX,
MacOS, HP/Sun/Intel
13. Installation: Changes to desktop or backbone only
14. Legal: Exportability, Foreign Govt Restrictions,
Key Management Infrastructure (KMI) initiative
Need key recovery
Raj Jain
7
Security 101
Integrity: Received = sent?
Availability: Legal users should be able to use.
Ping continuously No useful work gets done.
Confidentiality and Privacy:
No snooping or wiretapping
Authentication: You are who you say you are.
A student at Dartmouth posing as a professor canceled
the exam.
Authorization = Access Control
Only authorized users get to the data
Raj Jain
8
Secret Key Encryption
Encrypted_Message = Encrypt(Key, Message)
Message = Decrypt(Key, Encrypted_Message)
Example: Encrypt = division
433 = 48 R 1 (using divisor of 9)
Text Ciphertext
Key
Ciphertext Text
Raj Jain
9
Public Key Encryption
Invented in 1975 by Diffie and Hellman
Encrypted_Message = Encrypt(Key1, Message)
Message = Decrypt(Key2, Encrypted_Message)
Key1
Text Ciphertext
Key2
Ciphertext Text
Raj Jain
10
Public Key Encryption
RSA: Encrypted_Message = m3 mod 187
Message = Encrypted_Message107 mod 187
Key1 = <3,187>, Key2 = <107,187>
Message = 5
Encrypted Message = 53 = 125
Message = 125107 mod 187
= 125(64+32+8+2+1) mod 187
= {(12564 mod 187)(12532 mod 187)...
(1252 mod 187)(125)} mod 187 = 5
1254 mod 187 = (1252 mod 187)2 mod 187
Raj Jain
11
Public Key (Cont)
One key is private and the other is public
Message = Decrypt(Public_Key,
Encrypt(Private_Key, Message))
Message = Decrypt(Private_Key,
Encrypt(Public_Key, Message))
Raj Jain
12
Confidentiality
User 1 to User 2:
Encrypted_Message = Encrypt(Public_Key2,
Encrypt(Private_Key1, Message))
Message = Decrypt(Public_Key1,
Decrypt(Private_Key2, Encrypted_Message)
Authentic and Private
Your Public My Private Message
Key Key
Raj Jain
13
Firewall: Bastion Host
Bastion
Bastion
R2 Internet
Intranet Host
Host
R1
Bastions overlook critical areas of defense, usually
having stronger walls
Inside users log on the Bastion Host and use outside
services.
Later they pull the results inside.
One point of entry. Easier to manage security.
Raj Jain
14
Proxy Servers
Proxy
Proxy
Client R2 Server
Server Internet Server
R1
Specialized server programs on bastion host
Take user's request and forward them to real servers
Take server's responses and forward them to users
Enforce site security policy
May refuse certain requests.
Also known as application-level gateways
With special "Proxy client" programs, proxy servers
are almost transparent Raj Jain
15
VPN Security Issues
Authentication methods supported
Encryption methods supported
Key Management
Data stream filtering for viruses, JAVA, active X
Supported certificate authorities
(X.509, Entrust, VeriSign)
Encryption Layer: Datalink, network, session,
application. Higher Layer More granular
Granularity of Security: Departmental level,
Application level, Role-based
Raj Jain
16
Private Addresses
32-bit Address 4 Billion addresses max
Subnetting Limit is much lower
Shortage of IP address Private addresses
Frequent ISP changes Private address
Private Not usable on public Internet
RFC 1918 lists such addresses for private use
Prefix = 10/8, 172.16/12, 192.168/16
Example: [Link]
Raj Jain
17
Address Translation
[Link]
[Link]
VPN
VPN
[Link]
Server
Server R2
Host
[Link] Internet
[Link]
NAT
NAT
[Link]
Router
Router
NAT = Network Address Translation
Like Dynamic Host Configuration Protocol (DHCP)
IP Gateway: Like Firewall
Tunneling: Encaptulation
Raj Jain
18
Tunnel
IP Land IP Not Spoken Here IP Land
Non-IP Header IP Header Payload
Tunnel = Encaptulation
Used whenever some feature is not supported in some
part of the network, e.g., multicasting, mobile IP
Raj Jain
19
VPN Tunneling Protocols
GRE: Generic Routing Encaptulation (RFC 1701/2)
PPTP: Point-to-point Tunneling Protocol
L2F: Layer 2 forwarding
L2TP: Layer 2 Tunneling protocol
ATMP: Ascend Tunnel Management Protocol
DLSW: Data Link Switching (SNA over IP)
IPSec: Secure IP
Mobile IP: For Mobile users
Raj Jain
20
GRE
Delivery Header GRE Header Payload
Generic Routing Encaptulation (RFC 1701/1702)
Generic X over Y for any X or Y
Optional Checksum, Loose/strict Source Routing, Key
Key is used to authenticate the source
Over IPv4, GRE packets use a protocol type of 47
Allows router visibility into application-level header
Restricted to a single provider network end-to-end
Raj Jain
21
PPTP
Network
PPTP Access Client
ISP
Server Server
PPTP Tunnel
PPTP = Point-to-point Tunneling Protocol
Developed jointly by Microsoft, Ascend, USR, 3Com
and ECI Telematics
PPTP server for NT4 and clients for NT/95/98
MAC, WFW, Win 3.1 clients from Network
Telesystems ([Link])
Raj Jain
22
PPTP Packets
Network
Private PPTP Internet Access Client
Network Server Server
PPP
Public IP IP IP
Addressing GRE GRE
PPP PPP
IP/IPX/NetBEUI IP/IPX/NetBEUI IP/IPX/NetBEUI
Data Data Data
Internal IP
Encrypted
Addressing
Raj Jain
23
L2TP
Layer 2 Tunneling Protocol
L2F = Layer 2 Forwarding (From CISCO)
L2TP = L2F + PPTP
Combines the best features of L2F and PPTP
Will be implemented in NT5
Easy upgrade from L2F or PPTP
Allows PPP frames to be sent over non-IP (Frame
relay, ATM) networks also (PPTP works on IP only)
Allows multiple (different QoS) tunnels between the
same end-points. Better header compression.
Supports flow control
Raj Jain
24
IPSec
Secure IP: A series of proposals from IETF
Separate Authentication and privacy
Authentication Header (AH) ensures data integrity
and authenticity
Encapsulating Security Protocol (ESP) ensures
privacy and integrity
IP Original Original
AH ESP
Header IP Header* Data
Encrypted
Authenticated
* Optional
Raj Jain
25
IPSec (Cont)
Two Modes: Tunnel mode, Transport mode
Tunnel Mode Original IP header encrypted
Transport mode Original IP header removed.
Only transport data encrypted.
Supports a variety of encryption algorithms
Better suited for WAN VPNs (vs Access VPNs)
Little interest from Microsoft (vs L2TP)
Most IPSec implementations support machine (vs
user) certificates Any user can use the tunnel
Needs more time for standardization than L2TP
Raj Jain
26
Application Level Security
Secure HTTP
Secure MIME
Secure Electronic Transaction (SET)
Private Communications Technology (PCT)
Raj Jain
27
Summary
VPN allows secure communication on the Internet
Three types: WAN, Access, Extranet
Key issues: address translation, security, performance
Layer 2 (PPTP, L2TP), Layer 3 (IPSec), Layer 5
(SOCKS), Layer 7 (Application level) VPNs
QoS is still an issue MPLS
Raj Jain
28
References
For a detailed list of references, see
[Link]
Raj Jain
29