Remote Access VPN Solutions

Transcription

1 Remote Access VPN Solutions P/N June 2000 Check Point Software Technologies Ltd. In this Document: Introduction Page 3 Remote Access VPN Defined Page 3 Business Case Page 4 Key Requirements Page 5 Check Point Solutions Page 5 Summary Page 13

2 2000 Check Point Software Technologies Ltd. All rights reserved. Check Point, the Check Point logo, FireWall-1, FireWall-1 SecureServer, FloodGate-1, INSPECT, IQ Engine, Meta IP, MultiGate, Open Security Extension, OPSEC, Provider-1, SVN, User-to-Address Mapping, VPN-1, VPN-1 Accelerator Card, VPN-1 Certificate Manager, VPN-1 Gateway, VPN-1 Appliance, VPN-1 SecuRemote, VPN-1 SecureServer, and ConnectControl are trademarks or registered trademarks of Check Point Software Technologies Ltd. or its affiliates. All other product names mentioned herein are trademarks or registered trademarks of their respective owners. The products described in this document are protected by U.S. Patent No. 5,606,668 and 5,835,726 and may be protected by other U.S. Patents, foreign patents, or pending applications. Check Point Software Technologies Ltd. 2

3 Introduction As corporate workforces are increasingly distributed across the globe, connecting remote employees to the corporate network is becoming a requirement to remain competitive. The business benefits of remote access solutions are clear, as is the argument for leveraging Internetbased VPNs to make it happen. This paper defines the remote access VPN, discusses the benefits of choosing a VPN-based solution versus a dial-up solution, and finally, outlines how Check Point delivers the industry s leading solution. Remote Access VPN Defined A remote access VPN uses data security technologies to securely connect remote employees to corporate information resources via the Internet. Figure 1 illustrates a typical remote access VPN. Corporate LAN Corporate Internet Link INTERNET Local ISP POP Dial-up or Broadband Internet Link VPN Gateway Remote VPN Client Encrypted Tunnel Fig.1: Typical Remote Access VPN In a remote access VPN, the employee first connects to the Internet using a standard broadband or dial-up link to any ISP s local point of presence (POP). VPN client software running on a remote machine then uses a combination of encryption and authentication technologies to establish a secure tunnel over the Internet to a VPN gateway running at the edge of the corporate network. Once the VPN tunnel has been established, all communications between the client and the gateway are secured. This design leverages the Internet for long distance data transport while outsourcing modem termination hardware and last-mile connectivity to the ISP and local phone company respectively. Dial-Up Alternative The alternative to a remote access VPN is a dial-up remote access server (RAS). RAS solutions require employees to connect to the corporate network via a direct telephone call to modem banks installed at the network edge. The key differences between dial-up and VPN architectures are: 1) direct dial-up does not leverage the Internet for long distance connections, 2) modem banks are supported by the corporation rather than the ISP, and 3) encryption technologies are not required due to the fact that traffic traverses non-shared (switched) links. Figure 2 illustrates a dial-up remote access solution. Check Point Software Technologies Ltd. 3

4 Corporate Network Remote Access Servers (RAS) Telephone Network Dial-up Client Fig. 2: Typical Dial-Up Remote Access Business Case Remote access makes remote employees more productive and more effective by giving them direct access to information from anywhere in the world. Access to alone makes a big difference for mobile employees who rely on it as a primary business communication tool. VPNs deliver tangible business benefits with several advantages versus RAS solutions. Cost - VPN cost savings are derived from two sources. First, Internet connections, which are typically local calls, are much less expensive than toll free or long distance dial-up connections. This factor alone convinces many organizations to eliminate RAS solutions in favor of VPN solutions. Secondly, VPN equipment is much less expensive to deploy and maintain than RAS equipment. According to Giga Information Group, domestic remote access VPNs can yield cost savings of 20 to 70 percent over RAS. Similarly, international remote access VPNs can yield cost savings of between 60 and 90 percent 1 over RAS. As a result, most remote access VPNs pay for themselves in a matter of months. Scalability - Scaling a remote access VPN involves a process of distributing VPN client software and, if necessary, increasing bandwidth of the corporate Internet connection. Once the VPN gateway is up and running, it can easily scale to support anywhere from a few hundred to tens of thousands of users. Scaling RAS solutions, on the other hand, requires deployment of additional hardware and adding phone lines. Broadband - VPNs allow users to inexpensively connect to corporate networks via broadband links. This is a very attractive option for telecommuters in particular. Dial-up solutions do not offer this option. 1 Giga Information Group, The Current State of Enterprise Internet VPN Technology, February 25, 2000 Check Point Software Technologies Ltd. 4

5 Key Requirements The key elements of a remote access VPN include security, performance, high availability, and client management. Organizations should clearly define their specific requirements in each area before selecting and deploying a solution. The remainder of this document defines the challenges associated with each of these elements, and outlines how the Check Point product family meets these challenges. Check Point s Solutions The foundation of Check Point s remote access VPN is formed by VPN-1 Gateway and VPN-1 SecuRemote. VPN-1 Gateway serves as the local termination point for VPN-1 SecuRemote client connections originating from anywhere in the world. Together, these components serve as a flexible VPN platform to meet enterprise security, performance, high availability, and manageability requirements. These core components are illustrated in Figure 3. VPN-1 Gateway INTERNET VPN-1 SecuRemote Figure 3: Core Check Point Remote Access VPN Components Security Security is the foremost concern of any organization considering sending corporate communications over the Internet. In the context of remote access VPNs, relevant security issues include encryption, data authentication, user authentication, access control, and broadband security. Check Point Software Technologies Ltd. 5

6 IPSec (Internet Protocol Security) IPSec is a framework of open standards developed by the IETF (Internet Engineering Task Force) to ensure data privacy, data authentication, and user authentication on public networks. It is a robust standard that has withstood extensive peer review and emerged as the clear industry standard for Internet VPNs. Check Point s complete VPN solution is compliant with ICSA 1.0a IPSec conformance criteria. One of the advantages of IPSec is that it operates at the network layer, whereas other approaches insert security at the application layer. The benefit of network layer security is that it can be deployed independently of applications running on the network. This means that organizations are able to secure their networks without deploying and coordinating security on an application-byapplication basis. Data Privacy Encryption algorithms are used in a VPN to scramble data prior to transmission over the Internet. This scrambling ensures that third parties cannot inspect data in transit. Only authorized endpoints of a VPN tunnel have the ability to decrypt and view data. IPSec specifies 56-bit DES or 168-bit 3DES encryption for data privacy. 3DES provides the strongest security and is recommended for highly sensitive data. DES offers better performance than 3DES, but it is only used where strong security is not required or where export restrictions prevent use of strong encryption. Data Authentication Data authentication schemes are used to verify that communications have not been modified in transit. IPSec specifies MD5 and SHA-1 for data authentication and VPN-1 supports both of these algorithms. SHA-1 is a slightly stronger security algorithm, although both MD5 and SHA-1 are considered secure and are widely deployed. User Authentication Prior to granting access to the corporate network, it is necessary to verify the identity of remote users. Unauthorized individuals cannot be allowed to access the network. This process, called user authentication, is arguably the most important element of any VPN solution. VPN-1 provides a host of user authentication options. Pre-shared secrets are essentially passwords that must be distributed to users out of band", or independent of the VPN technology infrastructure. They offer an easy way to quickly roll out VPNs to a limited number of remote users. However, shared secrets do not provide robust scalability for large remote user environments. Shared secrets are part of the IPSec standard. Digital certificates are electronic credentials used to prove user identity. These electronic credentials can be stored on the remote machine or on tokens carried by the user. Management of digital certificates, including distribution and revocation, is automated by a Public Key Infrastructure (PKI). PKIs offer a stronger and more scaleable authentication infrastructure than shared secrets but are more expensive and complex to deploy. Digital certificates are also part of the IPSec standard. Through strict adherence to IPSec standards and Check Point s OPSEC (Open Platform for Security) partner certification program, Check Point enables organizations to choose from multiple PKI vendors for maximum flexibility. Check Point Software Technologies Ltd. 6

7 Hybrid Mode Authentication enables organizations to integrate legacy authentication schemes such as SecureID, TACACS+, and RADIUS with IPSec VPNs. Without Hybrid Mode Authentication, these schemes must be replaced by shared secrets or digital certificates in order to deploy an IPSec VPN. This conversion can be a complex and costly process. With Hybrid Mode, VPN-1 simplifies the deployment of standards-based VPNs by enabling integration of legacy authentication technologies. Broadband Security Although cable and xdsl networks offer attractive opportunities to improve telecommuter productivity, each is associated with security issues that should be addressed prior tovpn deployment. Cable modem networks rely on a shared network topology in which computers in the same neighborhood reside on the same physical network segment. This topology makes it trivial for malicious or curious individuals to access their neighbor s data. The second problem is due to the fact that cable and xdsl networks assign "always on" fixed IP addresses to user machines. An unprotected machine with an "always on" fixed IP address on the Internet makes a very attractive target for hackers. These vulnerabilities mean that a hacker could easily compromise data stored on the client machine. Even worse, a hacker could hijack a VPN tunnel to gain access to the corporate network. VPN-1 SecureClient To mitigate broadband security concerns, Check Point offers VPN-1 SecureClient. VPN-1 SecureClient combines a Stateful Inspection-based firewall with an IPSec VPN client. By adding a firewall to the VPN client, hackers are prevented from accessing client data or hijacking VPN tunnels to the corporate network. The primary difference between VPN-1 SecureClient s firewall and personal firewalls available for retail purchase is that the security policy is defined and managed by the corporate security manager rather than the individual. End users cannot connect to the corporate network unless the approved VPN-1 SecureClient policy is loaded and configured properly. This eliminates the possibility of end users disabling or modifying the policy. VPN-1 Gateway Attacker VPN-1 SecureClient INTERNET Cable or xdsl Figure 4: VPN-1 SecureClient Secures Broadband Remote Access VPNs Check Point Software Technologies Ltd. 7

8 Integrated Access Control As organizations increasingly use VPNs to allow individuals with varying degrees of trust to use corporate network resources, comprehensive access control policies must be integrated into the VPN architecture. For example, an organization may want to provide contract engineers with remote access to an engineering database but restrict access to the rest of the network. Because VPN-1 incorporates FireWall-1, such a policy is straightforward for the administrator and transparent to the end user. Figure 4 illustrates such a policy. In rule three, members of the sales force are allowed unrestricted access to the entire local network. In rule four, contractors are allowed to access only the private FTP server via encrypted FTP connections. Access to other network resources using other applications is not allowed. With VPN-1, granularity of the access control policy can be extended to include individual users, host machines, applications, and time of day. Figure 5: VPN-1 Rule Base with Remote Access Performance Any time network traffic is moved from dedicated lines to shared networks (as is the case for an organization switching from a dial-up to VPN remote access) performance is a concern. There are several factors that must be considered to adequately address VPN performance: concurrent connections, throughput, and quality of service (QoS). Check Point Software Technologies Ltd. 8

9 Concurrent Connections Concurrent connections specifications refer to the number of remote users who may simultaneously connect to the VPN gateway. The ability of an IPSec VPN to support a large number of concurrent connections depends on the amount of memory installed in the gateway. Check Point s VPN-1 Gateway has been tested to support more that 4,500 concurrent remote users and because support is primarily dependent upon system memory, there is no inherent limit. To determine the level of concurrent connection support required for a given deployment, approximate the percentage of total remote users that are likely to connect simultaneously, and apply that percentage to the total number of users. For organizations switching from a dial-up solution, this number can usually be approximated through experience. Throughput VPN throughput refers to the rate that a VPN device can encrypt or decrypt data and it is typically measured in megabits per second. A remote access VPN without enough throughput capacity results in poor application performance for users. VPN-1 Gateway software easily meets the vast majority of VPN deployments by delivering 3DES throughput of up to 20 Mbps (actual performance varies depending upon hardware platform and traffic conditions). For very large remote user deployments, VPN-1 Accelerator Card is available. This PCI compatible card offloads CPU intensive cryptographic operations from the host CPU to a dedicated processor. The card increases VPN-1 Gateway performance to support throughput of 45 Mbps. To estimate the amount of throughput required for a given deployment, multiply an approximate average bandwidth requirement per user by the number of expected concurrent users. VPN Quality of Service Delivering sufficient data throughput and concurrent connection support does not guarantee reliable VPN performance. An organization could have more than enough VPN processing power but still experience poor performance as a result of congestion on shared Internet links. Too often, bandwidth-hungry discretionary traffic overwhelms business-critical VPN traffic. FloodGate-1 FloodGate -1 is a VPN QoS solution that eliminates Internet link congestion by prioritizing critical VPN traffic over less important discretionary traffic. It integrates seamlessly with the VPN-1 management architecture so that a multi-site deployment can be as simple as installing Flood- Gate 1 to existing VPN-1 Gateways and adding a single rule to the Check Point Policy Editor. FloodGate-1 provides a powerful tool for optimizing performance of Internet links with very little management overhead. High Availability Loss of VPN connectivity can become extremely costly for any organization whose employees rely on the network for daily activities. When the VPN becomes unavailable, telecommuters are less productive, sales people are less effective, and traveling employees are less responsive. For these reasons, many organizations require that the remote access VPN solutions incorporate fault tolerance or high availability features to guarantee uninterrupted access to network resources. VPN-1 Gateway solutions offer two high availability alternatives. Check Point Software Technologies Ltd. 9

10 High Availability VPN Clusters High availability VPN clusters are groups of co-located gateways in which one or more redundant gateways serve as backups to a primary gateway. If the primary gateway fails, all connections, including ongoing connections, are seamlessly redirected to the backup. Users will not even notice that a fail-over has occured. High availability clusters are enabled through Check Point s own High Availability Module or through OPSEC High Availability solutions. The High Availability Module is a Check Point product that is purchased as an optional add-on to VPN-1 Gateway. OPSEC solutions are available from third-party vendors whose products are certified by Check Point for interoperability with VPN-1. Co-located VPN-1 Gateways Transparent VPN Fail-Over INTERNET Fig.6: High Availability Center VPN-1 SecuRemote/ VPN-1 SecureClient Resilient Remote Access Organizations with multiple sites connected via a private WAN link can implement a high availability deployment with a feature called Resilient Remote Access. With resilient remote access, if a primary gateway in one location becomes unreachable, VPN-1 SecuRemote or VPN-1 SecureClient automatically redirects connections to a secondary gateway located elsewhere. Traffic is then routed to the primary gateway network via the private WAN link. For organizations with multiple VPN sites complemented by a private WAN, the benefits are: 1. redundancy of their Internet links without the need to purchase additional links at each location, and 2. redundancy of the VPN equipment without the need to deploy high availability clusters at each location. The drawback to Resilient Remote Access is that VPN connections are dropped during a fail-over. Remote users are prompted to re-authenticate to the secondary gateway in the event of a fail-over. Consequently, the optimal high availability infrastructure would employ both High Availability Clusters and Resilient Remote Access. Check Point Software Technologies Ltd. 10

11 Private WAN Link Secondary Gateway (Denver) Primary Gateway (Denver) INTERNET VPN-1 SecuRemote/ VPN-1 SecureClient Fig.7: Resilient Remote Access Client Manageability A major concern for most organizations is the manageability of the VPN client software. Common questions include the following. Can the client software be easily distributed to users or is manual software installation required for each remote machine? Will users understand the software or is training required? Will the VPN client result in many help desk calls? Will telecommuters be able to do everything remotely that they can do from the office? The answers to these questions have a significant effect on VPN ROI and should be addressed prior to rollout. Both VPN-1 SecuRemote and VPN-1 SecureClient include ease-of-use and software distribution features to address these issues. Ease-of-Use User Transparency End users do not need to know anything about VPN client software or the VPN-1 gateway to establish a VPN tunnel. When a user wishes to check remotely, for example, he or she simply opens their client and requests a download as if connected to the corporate LAN. VPN-1 SecuRemote automatically detects the request, prompts the user to authenticate and establishes a tunnel. The only user knowledge required is username and password. Split Tunneling VPN-1 clients differentiate between corporate and Internet (Yahoo, etc.) traffic. Only traffic destined for the corporate network is encrypted while Internet traffic is passed directly to Internet destinations. Slit tunneling delivers better performance when compared to alternative solutions that encrypt all traffic and route it through the VPN gateway. Corporate Host Name Resolution Corporate host names are very often duplicated on the Internet. As a result, when a remote user enters a corporate host name into a browser, they are unexpectedly directed to a non-corporate Internet host with the same name. VPN-1 Split DNS feature makes it possible to use corporate DNS servers in parallel with Internet DNS. This means users may continue to use familiar corporate host names while out of the office. Check Point Software Technologies Ltd. 11

12 Secure NT Domain Login VPN-1 clients allow end users to remotely log into the Windows NT Domain so that they can access network file and print services as if connected locally. This feature is supported for Windows NT remote clients only. Fig. 8: VPN-1 SecureClient Authentication Prompt Software Distribution Pre-configured Installation VPN-1 clients can be pre-configured with IPSec setup, network topology, DNS, NT Domain login, and other setup criteria prior to distribution to end users. This enables the network administrator to create installation packages that can be easily downloaded and installed by end users. Configuration Updates Once installed, configuration updates can be carried out remotely by the administrator. There is no need for end users to reconfigure clients if network topology changes are required. Check Point Software Technologies Ltd. 12

13 Summary Remote access VPNs deliver tangible business benefits with significant cost savings versus RASbased solutions. The important factors to consider before selecting and deploying a remote access solution include security, performance, high availability, and client management. Check Point's VPN-1 product family delivers a flexible solution that will meet the needs of any enterprise along each of these dimensions both today and in the future. For more details on the complete range of Check Point products please see Check Point Software Technologies Ltd. 13