VPN Lesson 2: VPN Implementation Summary 1
Notations VPN client (ok) Firewall Router VPN firewall VPN router VPN server VPN concentrator 2
Basic Questions 1. VPN implementation options for remote users or sites 2. VPN implementation options for corporate main network 3. How does a remote access VPN work? How to implement the VPN client and the VPN server? When the remote user sends a message to the corporate network, What is done in Step 1? What is done in Step 2? Step 3? 4. How does a site to site VPN work? Overview the things that a VPN router can do When a host at one site sends a message to the other site, What is done in Step 1? What is done in Step 2? Step 3? 3
Remote Access VPN DMZ AAA e.g. Cisco VPN Concentrator 4
Step by Step Operations Alice, employee, is traveling in CA Her laptop: 200.200.1.2 (dynamic IP) Real app server: 130.128.2.3 (port 126) VPN server: 130.128.1.99 (port 89) AAA server: 130.128.22.22 (port 212) 5
Assume Alice wants to get a service: access a file Step 1: If Alice constructs the request packet as follows, her request will be denied Source IP: 200.200.1.2 Dest IP: 130.128.2.3 (real app server) Source port: Dest Port: 126 Other fields: Reason: no direct access to real server from outside; 6
To solve this problem Stage 1: Alice laptop establishes a TCP handshake with the VPN server First packet: Source IP: 200.200.1.2 Dest IP: 130.128.1.99 Second packet: VPN server to the VPN client program running on Alice laptop 3 rd packet: ack from client to VPN server Stage 2: authentication Client sends encrypted password and username to VPN server 7
Stage 2 Stage 2: However, VPN server CANNOT authenticate So, VPN server forwards the password to the AAA server (through a separate TCP session) The AAA server checks the password The AAA server sends YES message to VPN server; in addition, AAA server will tell the VPN server that Alice has permission to access the real server VPN server tells the client through the first TCP session that Alice is authenticated 8
Cont d Stage 2: VPN server: I can serve you. VPN server: but, we need to encrypt everything Client: fine, VPN server: which encryption algorithm you want to use? Client: how about AES 1.0 with IV (initial vector) value XXXX VPN server: agree VPN server: which session key? Client: will pick a key; encrypt the key with the public key of the VPN server; send the key to VPN server VPN server: the key is a good key 9
Stage 3 Stage 3: do the business VPN server: I know the session key; now I am ready to serve you VPN server: hi, which app server you want to access Client: 130.128.2.3 VPN server: good, let me establish a TCP session with the real server VPN server will do 3 way handshake with the real server: 3 steps; 3 packets 10
Cont d VPN server: which service request you want to send to the real server? Client program: encrypts the first service request using the session key; sends the packet to VPN server VPN server decrypts the packet and gets the 1 st request VPN server forwards this request to the real server through the 3 rd TCP session 11
Cont d The real server gets it The real server processes the request The real server sends the result to VPN server via the 3 rd TCP session The VPN server encrypts the result The VPN server sends the encrypted result to client via the 1 st TCP session The client decrypts The client program shows the result to Alice 12
Cont d The client sends 2 nd request out VPN server gets it; decrypts it; VPN server sends it to real server Real server processes it Real server sends back results to VPN server VPN server encrypts VPN server sends to client Client decrypts Client shows the result to Alice 13
VPN implementation options for remote users or sites Software VPN clients like PSU client Hardware VPN clients (a small box) Remote site firewalling 14
Site to Site VPN 15
Site to Site VPN VPN router: support heavy duty site to site VPN traffic Target speed: Gigabit throughput Not designed for remote access VPN In standard setting, no employee desktop needs to encrypt or decrypt anything; all the encryption/decryption is done by the VPN routers The two VPN routers will negotiate the key 16
Summary VPN facilities used by a site VPN firewall: a firewall armed with basic VPN capability: encryption, key management Slow; less powerful Suitable for small sites VPN router: support heavy duty site to site VPN traffic Target speed: Gigabit throughput Not designed for remote access VPN VPN concentrator: designed for remote access VPN Heavy duty: support 10,000 simultaneous remote users Has no routing capability: should stay behind a router 17
VPN implementation options for corporate main network Dedicated VPN server for remote access Hardware to hardware firewalls VPN routers to route traffic and terminate sessions For a VPN firewall does that mean that the VPN firewall encrypts traffic? Is there an advantage to doing that over a VPN concentrator? Hardware is quicker than software, putting together can separate which handles more traffic, but putting together saves money. could adding VPN slow down firewall? Yes Will VPN significantly slow down firewall? VPN always slows down firewall Could a rule be set up to allow VPN packets to pass through? Still need decryption 18
How does a remote access VPN work? User would have an established internet connection, has software client installed, creates a tunnel over the public internet Not a replacement for other security measures once it s through the concentrator it s no longer secure Using personal systems to connect to a VPN could allow already compromised systems on to the secured network VPN server decrypts data and sends to application 19
How to implement the VPN client and the VPN server? A VPN client is just a software program installed Does the concentrator actually have routing capabilities or does it only decrypt? Concentrator knows where the application server is VPN router does it need to be separate from the usual router? You pay extra for the VPN capabilities it s the same hardware device with an added VPN plug in card VPN Concentrator is behind router What is the biggest difference between VPN concentrator & VPN router & VPN firewall & router & firewall? VPN Concentrator does not do routing VPN router is a router that can implement only the most popular VPN functionalities can satisfy most applications VPN firewalls are very similar to VPN routers, since a router typically does firewalling A pure firewall does not support VPN Is the concentrator vulnerable to attacks? Concentrator only handles VPN traffic forwards everything to the application server Concentrator behind router no need for anything other than decryption 20
Concluding Question What is the biggest difference between VPN concentrator & VPN router & VPN firewall & router & firewall? VPN Concentrator does not do routing VPN router is a router that can implement only the most popular VPN functionalities (encryption, key negotiation) VPN firewalls vs. VPN routers Firewalls and routers do different jobs In real products, you see a combo equipment A pure firewall does not support VPN 21