Section 16.152 Securing Network Communications

Question 1

Virtual Private Networks (VPNs)

Answer 1

Extend private networks across public networks to allow remote users to securely connect to an organisations network

■ Can be configured as site-to-site, client-to-site, or clientless VPNs

■ In addition to site-to-site and client-to-site VPNs, we have to decide whether we are going to use a full tunnel or split tunnel VPN configuration

Question 2

VPNs

Site-to-Site VPN

Answer 2

○ Connects two sites cost-effectively

○ Replaces expensive leased lines

○ Utilises a VPN tunnel over the public internet

○ Encrypts and secures data between sites

○ Slower, but more secure

Question 3

VPNs

Client-to-Site VPN

Answer 3

○ Connects a single host (e.g., laptop) to the central office

○ Ideal for remote user access to the central network

○ Options for full tunnel and split tunnel configurations

Question 4

VPNs

Clientless VPN

Answer 4

○ Uses a web browser to establish secure, remote-access VPN

○ No need for dedicated software or hardware client

○ Utilises HTTPS and TLS protocols for secure connections to websites

Question 5

VPNs

Full Tunnel VPN

Can be used with either site to site or client to site VPN

Answer 5

○ Encrypts and routes all network requests through the VPN

○ Provides high security, clients fully part of central network

○ Limits access to local resources

○ Suitable for remote access to central resources

Default for organisations offers more security

Question 6

VPNs

Split Tunnel VPN

Can be used with either site to site or client to site VPN

Answer 6

○ Divides traffic, routing some through the VPN, some directly to
the internet

○ Enhances performance by bypassing VPN for non-central traffic

○ Less secure; potential exposure to attackers

○ Recommended for better performance but requires caution on untrusted networks

offers better peformance

Question 7

Transport Layer Security (TLS)

Answer 7

A protocol that provides cryptographic security for secure connections and is used for secure web browsing and data transfer

■ Used for secure connections in web browsers (HTTPS)

■ Uses Transmission Control Protocol (TCP) for secure connections between a client
and a server

may slow down the connection

Question 8

Datagram Transport Layer Security (DTLS)

Answer 8

A UDP-based version of TLS protocol that offers the same security level as TLS while maintaining faster operations

● Ensures end-user security and protects against eavesdropping in clientless VPN connections

● Ensures confidentiality, integrity, and authentication of data

Question 9

Internet Protocol Security (IPSec)

Answer 9

A secure protocol suite for IP communication through authentication and data encryption in IP networks

■ Provides confidentiality, integrity, authentication, and anti-replay protection

■ Used for both site-to-site and client-to-site VPNs

■ Five key steps in establishing an IPSec VPN

Question 10

Five key steps in establishing an IPSec VPN

1 Request to start the Internet Key Exchange (IKE)

Answer 10

PC1 initiates traffic to PC2, triggering IPSec tunnel creation by
RTR1

Question 11

Five key steps in establishing an IPSec VPN

2 Authentication - IKE Phase 1

Answer 11

RTR1 and RTR2 negotiate security associations for the IPSec IKE Phase 1 (ISAKMP) tunnel

Question 12

Five key steps in establishing an IPSec VPN

3 Negotiation - IKE Phase 2

Answer 12

IKE Phase 2 establishes a tunnel within the tunnel

Question 13

Five key steps in establishing an IPSec VPN

4 Data transfer

Answer 13

Data transfer between PC1 and PC2 takes place securely

Question 14

Five key steps in establishing an IPSec VPN

5 Tunnel termination

Answer 14

Tunnel torn down including the deletion of IPSec security
associations

Question 15

IPSec Tunneling Modes (Data transfer step 4)

Transport Mode

Answer 15

Uses original IP header

○ Suitable for client-to-site VPNs
○ Avoids potential fragmentation issues from MTU constraints

MTU (Maximum Transmission Unit): et by default at 1500 bytes and may cause fragmentation and other VPN problems

Does not increase packet size

Question 16

IPSec Tunneling Modes (Data transfer step 4)

Tunneling Mode

Answer 16

○ Adds a new header to encapsulate the entire packet (think a letter within a letter)

○ Ideal for site-to-site VPNs

○ May increase packet size and require jumbo frames

○ Provides confidentiality for both payload and header

Question 17

Authentication Header (AH)

Answer 17

Offers connectionless data integrity and data origin authentication for IP
datagrams using cryptographic hashes as identification information

Question 18

Encapsulating Security Payload (ESP)

Answer 18

● Provides confidentiality, integrity, and encryption

● Provides replay protection

● Encrypts the packet’s payload

Question 19

Considerations

Answer 19

■ Balance between security and performance when choosing VPN tunnel type
■ Use full tunnel VPNs for higher security but reduced local access
■ Use split tunnel VPNs for better performance but potentially lower security
■ Ensure proper MTU settings when using tunneling mode in site-to-site VPNs
■ AH for integrity and ESP for encryption in IPSec, but both can be used together
for comprehensive security