access method for branch and SOHO sites. A virtual private network (VPN) is a concept that describes how to create a private network over a public network infrastructure while maintaining confidentiality and security. VPNs use cryptographic tunneling protocols to provide sender authentication, message integrity, and confidentiality by protecting against packet sniffing. VPNs can be implemented at Layers 2, 3, and 4 of the Open Systems Interconnection (OSI) model. Figure illustrates a typical VPN topology. Components required to establish a VPN include: The key to VPN technology is security. VPNs secure data by encapsulating the data, encrypting the data, or both encapsulating the data and then encrypting it: Encapsulation and encryption are discussed in more detail as this course progresses.
Content 3.1 Introducing VPN Technology 3.1.2 Overlay and Peer-to-Peer VPN Architecture In terms of evolution, there are two major VPN models: overlay VPN and peer-to-peer VPN. Overlay VPNs
Service providers (SPs) are the most common users of the overlay VPN model. The design and provisioning of virtual circuits (VC) across the backbone is complete prior to any traffic flow. In the case of an IP network, this means that even though the underlying technology is connectionless, it requires a connection-oriented approach to provision the service. The scaling issues of overlay VPNs present a challenge to SPs when they have to manage and provision a large number of circuits and tunnels between customer devices. From a customer's point of view, the Interior Gateway Protocol design is also complex and difficult to manage.
The overlay model includes L2 and L3 VPNs. CPE-Based VPN (Peer-to-Peer)
CPE-based VPN is another name for an L3 overlay VPN. The VPN is implemented using CPE, as shown in Figure . In this way, a customer creates a VPN across an Internet connection without any specific knowledge or cooperation from the service provider. The customer gains the advantage of increased privacy using an inexpensive Internet connection. This approach is not advantageous to the SP because there is little opportunity for VPN service revenue. However, SPs do charge a higher rate for “business class” Internet services applicable to medium to large enterprises. Also, some SPs offer “managed VPN” services where CPE configuration and Network Address Translation (NAT) address management are performed by the SP rather than by the customer. SP-Provisioned VPN
The introduction of Multiprotocol Label Switching (MPLS) combines the benefits of overlay VPNs (security and isolation among customers) with the benefits of the simplified routing of a peer-to-peer VPN. MPLS VPN provides simpler customer routing, simpler service provider provisioning and a number of possible topologies that are hard to implement in either the overlay or peer-to-peer VPN models. MPLS also adds the benefits of a connection-oriented approach to the IP routing paradigm, through the establishment of label-switched paths that are created based on topology information rather than traffic flow. This model uses three types of routers as shown in Figure : Note that MPLS VPNs cannot replace all VPN implementations because MPLS only supports IP as the Layer 3 protocol. Other protocols including IPX and AppleTalk must be tunneled through the IP backbone.
Content 3.1 Introducing VPN Technology 3.1.3 VPN Topologies There are three VPN topologies to consider: Benefits: Remote access VPNs reduce long-distance charges that are associated with dialup access. Remote access VPNs also help increase productivity and confidence by ensuring secure network access regardless of an employee’s location. Benefits: Site-to-site intranet VPNs offer cost savings over traditional leased-line or Frame Relay technologies.
Content 3.1 Introducing VPN Technology 3.1.4 Characteristics of a Secure VPNs Security is the focus of any VPN design. VPNs can use advanced encryption techniques and tunneling to establish secure, end-to-end,