13.8 Virtual Private Networks and Remote Switch Access

Question 1

Describe VPN

Answer 1

allows a remote user to connect to needed resources. VPNs accomplish this by using already-established internet connections. Data that flows across an internet connection is generally not secure. All data that flows across the VPN is encrypted and repackaged. This is why processes on VPN connections are sometimes referred to as tunneling protocols. Many users also use VPN connections on their personal internet connections to surf the internet anonymously.

Question 2

Describe Point-to-Point Tunneling Protocol

Answer 2

Is the oldest and most-used tunneling protocol.
Was developed by Microsoft for use with dial-up networks.
Uses 128-bit encryption, but is very easy to break due to its old age.
Is one of the faster protocols because of its low encryption standards

Question 3

Describe Layer 2 Tunneling Protocol with internet Protocol Security (L2TP/IPsec)

Answer 3

Was developed by Microsoft and Cisco in the 1990s.
Pairs L2TP with IPsec to make it one of the more secure VPN methods.
Is slower than PPTP due to higher encryption standards.

Question 4

Describe Secure Socket Tunneling Protocol (SSTP)

Answer 4

Was developed by Microsoft with the release of Windows Vista. Comes loaded and configured in all later Windows. versions.
Is usually paired with the Advanced Encryption Standard (AES).
Is used only by Windows, so it is not compatible with other operating systems.

Question 5

Describe Internet Key Exchange v2 (IKEv2)

Answer 5

Is a unique tunneling protocol that reconnects a dropped connection. This protocol is often used by mobile devices because of this feature.
Was developed by Microsoft and Cisco.
Is one of the fastest and most secure protocols available.
Is not compatible with many operating systems.

Question 6

Describe OpenVPN

Answer 6

Was released in 2001.
Is an extremely configurable open-source protocol. OpenVPN can be set up to use many different ports and encryption methods.
Is used by many third-party VPN providers.
Is extremely secure when configured properly and about as fast as L2TP/IPsec.

Question 7

Describe Remote Access VPN

Answer 7

A remote access VPN lets remote and mobile users connect to the organization network securely. Remote access VPNs:

Question 8

Desrcibe SSL VPN

Answer 8

SSL uses the public key infrastructure (PKI) and digital certificates to authenticate peers.

Question 9

Describe Site-tosite IPsec VPNs

Answer 9

Site-to-site VPNs connect networks across an untrusted network such as the internet.

Question 10

Describe GRE over IPsec (GRE)

Answer 10

Generic Routing Encapsulation is an unsecure site-to-site VPN tunneling protocol.

Question 11

Describe Dynamic Multipoint VPNs

Answer 11

When an organization needs to add more sites, other VPN types may not be sufficient. Dynamic Multipoint VPN (DMVPN) is a Cisco software solution for building multiple VPNs in an easy, dynamic, and scalable manner.

Question 12

Describe IPsec Virtual Tunnel Interface

Answer 12

IPsec Virtual Tunnel Interface (VTI) simplifies the configuration process required to support multiple sites and remote access

Question 13

Describe Service Provider Multi-Protocol Label Switching (MPLS) VPNs

Answer 13

Many VPN service providers utilize MPLS in their core networks.

Question 14

What is IPsec

Answer 14

an IETF standard that defines how a VPN can be secured across IP networks. IPsec protects and authenticates IP packets between source and destination.

Question 15

Describe the Authentication Header Protocol

Answer 15

AH provides integrity and authentication.
AH provides a message integrity check with the Keyed-hash Message Authentication Code (HMAC). With HMAC, a symmetric key is embedded into a message before the message is hashed. When the message is received, the recipient’s symmetric key is added back into the message before hashing the message. If the hash values match, message integrity is proven.

AH uses Secure Hashing Algorithm 1 (SHA-1) or Message Digest v5 (MD5) for integrity validation.

Question 16

Describe the Encapsulating Security payload (ESP) Protocol

Answer 16

ESP provides encryption, integrity, anti-replay, and a weak form of authentication.

Question 17

Describe the internet key exchange (IKE)

Answer 17

IKE negotiates the connection. As two end points are securing an IPsec network, they have to negotiate a Security Association (SA). An inbound and outbound SA is necessary for each connection with a remote endpoint.

Question 18

Describe Tunnel mode

Answer 18

Tunnel mode is used for site-to-site communications:
Tunnel mode is often referred to as subnet-to-subnet.
The entire data packet, including original headers, is encapsulated in a new packet when using IPsec in tunnel mode.
The new packet has a new unencrypted Layer 2 and Layer 3 header that contains the endpoint addresses and all necessary AH and ESP information.
The VPN server acts as a gateway by providing encryption support for other devices on the LAN.

Question 19

Describe Transport Mode

Answer 19

Transport mode is used for end-to-end (or host-to-host) data encryption:
The end communicating devices are the tunnel endpoints.
The packet data is encrypted, but the header is left intact, allowing intermediary devices (such as routers) to examine the packet header and use the information in routing packets.
Transport mode operates at Layer 4, encrypting from level four and up.