VPNs extend private networks over shared public infrastructure like the internet. VPNs use encryption and tunneling to provide secure connectivity similar to a private network but at lower cost. Common VPN types include remote access VPNs for mobile users, intranet VPNs for connecting multiple company sites, and extranet VPNs for connecting to business partners. VPNs can reduce networking costs and improve flexibility while maintaining security.

1. Module 12: Understanding Virtual Private Networks

2. Agenda What Are VPNs? VPN Technologies Access, Intranet, and Extranet VPNs VPN Examples

3. What Are VPNs? Virtual Private Networks (VPNs) extend the classic WAN VPNs leverage the classic WAN infrastructure, including Cisco’s family of VPN-enabled routers and policy management tools VPNs provide connectivity on a shared infrastructure with the same policies and “performance” as a private network with lower total cost of ownership Service Provider Shared Network VPN Internet, IP, FR, ATM

4. Extends private network through public Internet Lower cost than private WAN Relies on tunneling and encryption Virtual Private Networks Internet Hong Kong Paris IP Packet (Private, Encrypted) IP Header (Public)

5. Why Build a VPN? Company information secured Lower costs Connectivity costs Capital costs Management and support costs Wider connectivity options Speed of deployment

6. What’s Driving VPN Offerings? Reduced Networking Costs Increased Network Flexibility Mobile Users Telecommuters Organizational Changes Mergers/ Acquisitions Extranets Intranets

7. Who Buys VPNs? Organizations wishing to: Implement more cost- effective WAN solutions Connect multiple remote sites Deploy intranets Connect to suppliers, business partners, and customers Get back to their core business, and leave the WAN to the experts Lower operational and capital equipment costs Businesses with: Multiple branch office locations Telecommuters Remote workers Contractors and consultants

8. Networked Applications Traditional applications E-mail Database File transfer New applications Videoconferencing Distance learning Advanced publishing Voice

9. Example of a VPN Private networking service over a public network infrastructure Munich Main Office New York Office Milan Office Paris Office Internet Mobile Worker Dials to Munich over Internet

10. VPN Technologies © 1999, Cisco Systems, Inc. www.cisco.com

11. VPN Technology Building Blocks Security QoS

12. Security Tunnels and encryption Packet authentication Firewalls and intrusion detection User authentication

13. Tunneling: L2F/L2TP SP Network/ Internet POP Corporate Intranet Mobile users Telecommuters Small remote offices 1. User identification 2. Tunnel to home gateway Security Server 3. User authentication 4. PPP negotiation with user 5. End-to-end tunnel established Home GW LAC

14. Tunneling: Generic Route Encapsulation (GRE) Mesh of virtual point- to-point interfaces Encapsulates multiprotocol packets in IP tunnels Application-level QoS Value-added platform (new services) Encryption-optional tunneling Standard architecture for service providers with IP infrastructures Service Provider Backbone Enterprise A Enterprise A Enterprise A Enterprise B Enterprise B

15. What Is IPSec? Network-layer encryption and authentication Open standards for ensuring secure private communications over any IP network, including the Internet Provides a necessary component of a standards-based, flexible solution for deploying a network-wide security policy Data protected with network encryption, digital certification, and device authentication Scales from small to very large networks

16. Automatically negotiates policy to protect communication Authenticated Diffie-Hellman key exchange Negotiates (possibly multiple) security associations for IPSec What is Internet Key Exchange (IKE)? 3DES, MD5, and RSA Signatures, OR IDEA, SHA, and DSS Signatures, OR Blowfish, SHA, and RSA Encryption IDEA, SHA, and DSS Signatures IKE Policy Tunnel

17. IPSec VPN Client Operation Remote User with IPSec Client Home Gateway Router Home Network Certificate Authority/ AAA Public Network Exchange X.509 or One-Time Password Secure Tunnel Established Encrypted Data flows Dial Access to Corporate Network IKE Negotiation Authentication Approved

18. L2TP and IPSec Are Complementary IPSec creates the remote tunnel L2TP provides tunnel end-point authentication IPSec maintains encryption L2TP provides tunnels for non-IP traffic AAA services and dynamic address like DHCP IPSec L2TP AAA Server

19. Widely adopted standard Encrypts plain text, which becomes cyphertext DES performs 16 rounds Triple DES (3DES) The 56-bit DES algorithm runs three times 112-bit triple DES includes two keys 168-bit triple DES includes three keys Accomplished on a VPN client, server, router, or firewall Encryption: DES and 3DES

20. All traffic from inside to outside and vice versa must pass through the firewall Only authorized traffic, as defined by the local security policy, is allowed in or out The firewall itself is immune to penetration Firewalls

21. User Authentication Centralized security database (AAA services) High availability Same policy across many access points Per-user access control Single network login Support for: TACACS+, RADIUS (IETF), Kerberos, one-time password TACACS+ RADIUS TACACS+ RADIUS ID/User Profile ID/User Profile ID/User Profile AAA Server Dial-In User Network Access Server Campus Internet User Gateway Router Firewall Intercept Connections Public Network Internet

22. VPNs and Quality of Service Voice Premium IP Best Effort Tunnel Conforming Traffic Packet Classification CAR Traffic Policing CAR Congestion Avoidance WRED Tunnel Layer 2TP IPSec, GRE AAA CA PBX

23. Access, Intranet, and Extranet VPNs © 1999, Cisco Systems, Inc. www.cisco.com

24. Three Types of VPNs Type Remote access VPN Application Mobile users Remote connectivity Alternative To Dedicated dial ISDN Intranet VPN Extranet VPN Site-to-site Internal connectivity Leased line Business-to-business External connectivity Fax Mail EDI Time Ubiquitous access, lower cost Benefits Extend connectivity, lower cost Facilitates e-commerce

25. Access VPNs Enterprise DMZ Web Servers DNS Server STMP Mail Relay AAA CA Service Provider A Small Office Mobile User or Corporate Telecommuter Ubiquitous Access Modem, ISDN xDSL, Cable Potential Operations and Infrastructure Cost Savings Client Initiated or NAS Initiated

26. Access VPN Operation Overview SP Network/ Internet POP Corporate Intranet Mobile Users and Telecommuters 1. VPN identification 2. Tunnel to home gateway Security Server 3. User authentication 4. PPP negotiation with user 5. End-to-end tunnel established Home Gateway NAS

27. Access VPN Basic Components Dial Client (PPP Peer) AAA Server (RADIUS/TACACS+) ISDN ASYNC L2TP Access Concentrator AAA Server (RADIUS/TACACS +) L2TP Network Server ( Home Gateway)

28. Encrypted tunnel from the remote client to the corporate network Independent of access technology Standards compliant IPSec encapsulated tunnel IKE key management Client-Initiated Access VPN Internet Corporate Network Encrypted IP

29. Client-Initiated VPNs Pros: Use same hardware for dedicated access Dedicated encryption hardware in firewall for performance Cons: Management of IPSec PC client Security must be initiated by user

30. NAS-Initiated Access VPN NAS [email_address] Home Gateway IP Network

31. NAS-Initiated VPNs Pros: No PC client software to manage Premium services VPN and Internet access at the NAS More scalable and manageable Cons: Users can connect only to certain POPs

32. The Intranet VPN Enterprise DMZ Web Servers DNS Server STMP Mail Relay AAA CA Remote Office Service Provider A Regional Office Potential Operations and Infrastructure Cost Savings Extends the Corporate IP Network Across a Shared WAN

33. The Extranet VPN Business Partner Enterprise DMZ Web Servers DNS Server STMP Mail Relay AAA CA Service Provider A Service Provider B Extends Connectivity to Business Partners, Suppliers, and Customers Security Policy Very Important Supplier

34. Intranet and Extranet VPNs Multiple users, multiple sites, and potentially multiple companies or multiple communities of interest Dedicated connections Flexible architecture options IP tunnels with IPSec or GRE Managed router service with Frame Relay or ATM virtual circuits Tag Switching/MPLS

35. Comparing the Types Intranet Access VPN NAS-Initiated Extranet Type Client-Initiated Router-Initiated X X X X X X X X

36. VPN Examples © 1999, Cisco Systems, Inc. www.cisco.com

37. Health Care Company Intranet Deployment Challenge—Low-cost means for connecting remote sites with primary hospital Primary Hospital Remote Centers Remote Center Public Network Private Network

38. IPSec encrypts traffic from remote sites to the enterprise using any application IPSec may be combined with other tunnel protocols, e.g., GRE Telecommuters can gain secure, transparent access to the corporate network Branch Office or Telecommuters Public Network Challenge—Cost-effective means for connecting branch offices and telecommuters to the corporate network

39. Traditional Dialup Versus Access VPN Monthly long-distance charges per minute Avg. use per day, per user (min) Traditional Dialup Access VPN Number of users Remote access server One-time installation fee: 10 phone lines 20 $4,600 $1,000 $5,000 20 $3,000 $1,000 Number of users Access router, T1/E1, DSU/CSU, firewall VPN client software ($50/user) T1/E1 installation $0.10 90 Central site T1/E1 Intranet access Monthly ISP access ($20/user) $2,500 $400

40. Traditional Dialup Versus Access VPN Traditional Dial-Up Access VPN Number of users Remote access server One-time installation fee-10 phone lines 20 $4,600 $1,000 $5,000 20 $3,000 $1,000 Number of users Access router, T1/E1, DSU/CSU, firewall VPN client software ($50/user) T1/E1 installation One-time capital cost $4,000 One-time capital cost $10,600 Recurring cost $5,400 Recurring cost $2,900 Monthly long distance charges per minute Avg. use per day per user (min) $0.10 90 Central site T1/E1 Intranet access Monthly ISP access ($20/user) $2,500 $400

41. VPN Payback 0 $20,000 $40,000 $60,000 $80,000 1 2 3 4 5 6 7 8 9 10 11 12 Month Payback in 3 months!! Total Cost Traditional VPN

42. Summary VPNs reduce costs VPNs improve connectivity VPNs maintain security VPNs offer flexibility VPNs are reliable

43. Presentation_ID © 1999, Cisco Systems, Inc. www.cisco.com