ITE I Chapter 6 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Objectives Providing Teleworker Services Describe the enterprise requirements for providing teleworker services Explain how broadband services extend Enterprise Networks including DSL, cable, and wireless Describe how VPN technology provides secure teleworker services in an Enterprise setting Accessing the WAN Chapter 6 2 Teleworking Remote Connection Options A broad term referring to conducting work by connecting to a workplace from a remote location, with the assistance of telecommunications. Possible because of broadband Internet connections, virtual private networks (VPN), and more advanced technologies, including Voice over IP (VoIP) and videoconferencing. Teleworking can save money otherwise spent on travel, infrastructure, and facilities support. Residential cable, DSL and broadband wireless are three options that provide high bandwidth to teleworkers. 3 4 Providing Teleworker Services A VPN is a private data network that uses the public telecommunication infrastructure, i.e. the Internet. VPN security maintains privacy using a tunneling protocol and security procedures. Connecting Teleworkers to the Corporate WAN 5 6
Residential Cable Broadband (CATV) Cable Broadband Uses fibre and coaxial cable for signal transmission Headend Where signals are first received, processed, formatted, and distributed downstream to the cable network The distribution network consists of trunk and feeder cables Subscriber drop coaxial cable Splitter connects topbox and cable modem Cable modem provides an Ethernet connection to a host computer or LAN 7 8 Cable Broadband Users on a segment share bandwidth Downstream bandwidth is usually greater than upstream bandwidth An individual subscriber can typically get an access speed of between 256 kb/s and 6 Mb/s. DOCSIS, a non-profit research and development consortium for cable-related technologies Cable operators employ DOCSIS to provide Internet access over their existing hybrid fiber-coaxial (HFC) infrastructure Euro-DOCSIS variation for use in Europe 9 Delivers high bandwidth over local loop copper wires Asymmetric (ADSL) Lower upload bandwidth residential use Symmetric (SDSL) Same bandwidth in both directions business use Available DSL services and bandwidths depends on length and quality of local loop - loop must be less than 5.5 kilometers (3.5 miles) At best, bandwidth can exceed a T1 line The advantage of DSL over cable technology is that DSL is not a shared medium. Each user has a separate direct connection to the central office (CO) of the provider. 10 Plain old telephone service (POTS) only uses the lower frequency range. Remaining frequency space used by the upstream and downstream DSL signals. DSL access multiplexer (DSLAM) located at the central office (CO) of the provider concentrates connections from multiple DSL subscribers. 11 12
POTS splitter separates the DSL traffic from the POTS traffic. One wire would go directly to the DSL modem, and the other would carry the DSL signal to the telephones. Alternatively, use microfilters The user connects inline microfilters on each telephone Can connect DSL modem or telephone to any access point No installation required, more flexible Asymmetric (ADSL) Lower upload bandwidth residential use Symmetric (SDSL) Same bandwidth in both directions business use Available DSL services and bandwidths depends on length and quality of local loop - loop must be less than 5.5 kilometers (3.5 miles) At best, bandwidth can exceed a T1 line 13 14 Broadband Wireless 802.11b WLAN connection to wired networks Covers limited area Wi-Fi hotspots 802.16 (or WiMAX) Allows transmissions up to 70 Mb/s, and has a range of up to 30 miles Providing wireless data in a variety of ways, from point-to-point links to full mobile cellular type access Satellite Internet One-way multicast Internet pages be "pushed" to local storage at enduser sites by satellite Internet One-way terrestrial return dialup access to send outbound data through a modem and receive downloads from the satellite. Two-way satellite Satellite dish at each location needs precise positioning to avoid interference with other satellites. 15 16 Virtual Private Networks (VPNs) VPN technology used to create private networks over the public Internet infrastructure that maintain confidentiality and security Benefits of using VPNs: Cost savings Security Scalability Site-to-site VPN Hosts send and receive traffic through a VPN gateway A VPN gateway could be a router, PIX firewall, or an Adaptive Security Appliance (ASA). Remote-access VPN Site-to-Site and Remote Access VPNs 17 18 Each host typically has VPN client software
VPN Security VPNs secure data by encapsulating (tunnelling) and/or encrypting the data. Data confidentiality Protect data from eavesdroppers Data integrity Guarantee that no tampering or alterations occur to data while it travels between the source and destination. Authentication Use passwords, digital certificates, smart cards, and biometrics to establish the identity of parties at the other end of a network. 19 VPN Tunneling Tunneling encapsulates an entire packet within another packet and sends the new, composite packet over a network 20 VPN Tunneling Protocols VPN Encryption Carrier protocol The protocol over which the data is travelling (Frame Relay, ATM, etc) Encapsulating protocol The protocol wrapped around the original data (GRE, IPSec, L2F, PPTP, L2TP) Passenger protocol The protocol over which the original data was being carried (IPX, AppleTalk, IPv4, IPv6) Plain text data transported over the public Internet can be intercepted and read. To keep data private, it needs to be encrypted. Symmetric Encryption Require a shared secret key Example: DES, 3DES, AES Asymmetric Encryption Uses different keys for encryption and decryption. Example: RSA 21 22 VPN Encryption Hashing for Data Integrity 23 A hash, also called a message digest, is a number generated from a string of text and a secret key. Hosts can add a hash to the message to provide data integrity and peer authentication A keyed hashed message authentication code (HMAC) is a data integrity algorithm that guarantees the integrity of the message There are two common HMAC algorithms: Message Digest 5 (MD5) Uses a 128-bit shared secret key. Secure Hash Algorithm 1 (SHA-1) Uses a 160-bit secret key. 24
Hashing for Peer Authentication Peer Authentication methods: Pre-shared key (PSK) Key is entered manually. RSA signature Uses the exchange of digital certificates to authenticate the peers. IPsec IPsec is a protocol suite for securing IP communications which provides encryption, integrity, and authentication. There are two main IPsec framework protocols: Authentication Header (AH) Provides data authentication and integrity for IP packets passed between two systems. Use when confidentiality is not required or permitted Encapsulating Security Payload (ESP) Provides encryption, data integrity and authentication. 25 26 Requirements for providing teleworker services are: Maintains continuity of operations Provides for increased services Secure & reliable access to information Cost effective Scalable Components needed for a teleworker to connect to an organization s network are: Home components Corporate components 27 Broadband services used Cable transmits signal in either direction simultaneously DSL requires minimal changes to existing telephone infrastructure delivers high bandwidth data rates to customers Wireless increases mobility wireless availability via:»wimax» satellite internet 28 Securing teleworker services VPN security achieved through using Advanced encryption techniques Tunneling Characteristics of a secure VPN Data confidentiality Data integrity Authentication 29