vpn virtual private network VPN A technology

Document Sample
vpn virtual private network VPN A technology Powered By Docstoc
					virtual private network (VPN)

A technology for securely connecting a computer or network to a remote
network over an intermediate network such as the Internet.


The term virtual private network (VPN) is used in various senses in
the industry to describe a variety of technologies, but in essence it
can have one of two meanings:

? Using an insecure public network such as the Internet to connect two
networks (or to connect a network and a remote computer)

? Making this connection secure by employing technologies such as
tunneling, authentication, and encryption

The two main types of VPNs are

? Network-network: A branch office network of an enterprise is
connected by a VPN to corporate headquarters. Network-network VPNs
offer a low-cost alternative to deploying expensive dedicated leased
lines such as T1 lines at all branch offices (corporate headquarters
still requires a leased line for its VPN gateway, however, to provide
enough bandwidth for its branch office VPN connections). In spite of
the cost advantage, however, networknetwork VPNs have been slow to
gain a foothold in the enterprise due to the proven reliability of
leased lines and the relative unreliability of the Internet in

? Host-network: A mobile knowledge worker uses his or her laptop or
Personal Digital Assistant (PDA) and modem to dial in to a local
Internet service provider (ISP) to connect securely to a company
intranet or portal using an encrypted VPN connection. Using VPNs this
way has proliferated in the enterprise as it is more cost-effective
than traditional remote access solutions involving modem pools,
dedicated phone lines, and toll-free numbers. virtual private network
(VPN) virtual private network (VPN)

VPNs are based on a client/server architecture:

VPN client: This system initiates the VPN connection with the VPN
server. For a typical host-network VPN scenario, the remote user first
establishes a dial-up connection with a local ISP to connect to the
Internet, and then once online, the client contacts the VPN server to
connect to the corporate intranet.

 VPN server: This system authenticates the VPN client, negotiates
which tunneling and encryption protocols to use, and establishes the
secure VPN connection. The result is the formation of a secure
encrypted tunnel that connects the VPN client to the VPN server. The
effect is transparent—that is, as if both client and server were on
the same local area network (LAN). For the connection to work,
however, the VPN client must be assigned an Internet Protocol (IP)
address that makes it appear to the VPN server as if it is on the same
LAN as the server. VPN clients thus generally have two IP addresses,
one for the VPN connection and one for the intermediate or transit
network (the Internet).

Two VPN tunneling protocols are in use today: Microsoft
Corporation’s Point-to-Point Tunneling Protocol (PPTP) and Cisco
Systems’ Layer 2 Tunneling Protocol (L2TP). Both protocols are
essentially extensions of the industry standard Point-to-Point
Protocol (PPP) and are used to encapsulate PPP frames within IP
datagrams for transmission over the Internet. In other words, VPNs
employ two layers of encapsulation:

? First the IP datagrams from the client and server are encapsulated
with PPP headers to form PPP frames for transmission through the
serial interface to the modem or leased line.

? Then the PPP frames are encapsulated again with IP headers (and PPTP
or L2TP headers) to form IP packets for routing over the Internet.

The result of using PPTP or L2TP is to create a virtual PPP connection
between the VPN client and server. In short, the VPN connection
behaves as if it were a dedicated point-to-point serial link but
packets are actually routed across the Internet. How a VPN connection
works between a network and a remote host. Note that L2TP does not
include a mechanism for encrypting VPN communications, so it must be
combined with Internet Protocol Security (IPsec) when used to create a
VPN connection.

VPNs are typically implemented in one of two ways:

 Customer premises equipment (CPE): Here the VPN server is owned and
 operated by the private company and is located at the periphery of
 their corporate LAN. Such VPN servers may be routers, access servers,
 firewall appliances, or standard PC servers running VPN-enabled
 software such as Microsoft Windows 2000 Server.

? Service provider: Corporate VPN needs can also be outsourced to VPN
service providers, typically telcos, ISPs, or application service
providers (ASPs). The service provider maintains the VPN server at the
edge of its own network and parcels out VPN services to companies on a
monthly leased basis. In this scenario the customer only requires a
standard “dumb” router for Internet access at its end, not a
VPN-enabled router.

A third kind of VPN implementation involves using permanent virtual
circuits (PVCs) carrying IP over public frame relay networks. This
method is employed mainly for enterprise network-network VPNs.


A popular Linux-based VPN/firewall appliance is VelociRaptor from
Cobalt Networks, which employs Cobalt’s hardware and Raptor’s
firewall software to provide a secure VPN solution for the small
business and remote office markets. Another popular VPN appliance is
the Alcatel 7137 Secure VPN Gateway, originally developed by TimeStep
(now part of Alcatel). Cisco Systems offers many different
VPN-enabled routers and access servers, including the Cisco VPN 3005
Concentrator, which supports up to 100 concurrent users. For the Small
Office/Home Office (SOHO) business environment, the Cisco PIX Firewall
506 is a small unit the size of a pocketbook that can support 10
simultaneous VPN connections. Another market contender is the VPN-1
Appliance from Check Point Software Technologies, which includes their
widely used Firewall-1 product bundled in a Nokia appliance. Check
Point also offers a VPN-1 Gateway for high-end corporate VPN
connectivity. 3Com Corporation, Avaya, CoSine Communications, Data
Fellows Corporation, Indus River Networks, Intel Corporation, Lucent
Technologies, RadGuard, RedCreek Communications, and many other
companies offer VPN solutions ranging from VPN gateways and appliances
to software products.

Examples of service providers offering standard IP VPN services
include Aventail Corporation, Genuity, UUNET, Qwest Communications
International, and others. Providers of frame relay-based VPN services
include AT&T, Equant, Infonet, MCI/Worldcom, Sprint Corporation, and
others. Telera offers a nationwide Voice over IP (VOIP)-enabled
managed VPN that employs VPN gateways stationed at colocation centers
around the United States.

The future of network-network VPNs and corporate host-network VPN
gateways may be Digital Subscriber Line (DSL), a technology that
provides high-speed Internet access at costs vastly lower than leased
lines such as T1 lines. The main issue with most enterprises is that
DSL has yet to prove itself as reliable a technology as the more
costly leased lines, which are a mature technology that has been
around for many years. Nevertheless, the combination of a DSL
connection with VPN software to provide security is a tantalizing one
for IT departments in times of shrinking budgets.

Although VPNs typically use the Internet as their transit network, it
is also possible to run a VPN over a corporate IP LAN to create a
“LAN within a LAN” for secure communications across the network.

For More Information
Visit the VPN Consortium at www.vpnc.org. See Also: application
service provider (ASP), Digital Subscriber Line (DSL), firewall, frame
relay, Internet, Internet Protocol Security (IPsec), Internet service
provider (ISP), Layer 2 Tunneling Protocol (L2TP), permanent virtual
circuit (PVC), Point-to-Point Protocol (PPP), Point-to-Point Tunneling
Protocol (PPTP), T1, wide area network (WAN)

Shared By: