-: Virtual private networks or VPNs. 2 2
In this lesson, 3 3
we're going to dive deeper into VPNs 4 4
known as virtual private networks. 5 5
And we're going to cover all the things you need to know 6 6
about a VPN for your exam. 7 7
First, what is a VPN? 8 8
Well, a VPN is a virtual private network, 9 9
and it's going to be used to extend a private network 10 10
across a public network 11 11
and enable users to send and receive data 12 12
across that shared or public network 13 13
as if their computing devices were directly connected 14 14
to the private network. 15 15
Now with a VPN, 16 16
your users can work in a remote office or work from home 17 17
and they can telecommute 18 18
simply by logging into their laptop and establishing 19 19
a secure VPN tunnel to the organization's network, 20 20
regardless of where it sits in the world. 21 21
To do this, 22 22
they're going to connect to a VPN device 23 23
sitting at the headquarters data center, 24 24
and then they're going to establish a secure tunnel 25 25
using a VPN protocol in order to allow a secure connection 26 26
for that corporate user over an untrusted or public network, 27 27
something like the internet. 28 28
Now, this allows them to then reach 29 29
into the corporate network 30 30
and be connected to the internet 31 31
as if they were sitting right at their desk in their office. 32 32
VPNs can be configured as a site to site VPN, 33 33
a client to site VPN, 34 34
or a clientless VPN. 35 35
With a site to site VPN, 36 36
we can connect two offices together. 37 37
With a client to site VPN, 38 38
we're more concerned with connecting a single remote user 39 39
back to a corporate network as I described earlier 40 40
with the user who needed to telecommute. 41 41
When we talk about a clientless VPN, 42 42
these are usually going to be used with web browsing. 43 43
All right. Let's dive a little bit deeper 44 44
and talk about a site to site VPN. 45 45
Now, a site to site VPN is used to interconnect to sites 46 46
and provide an inexpensive alternative 47 47
to dedicated lease lines. 48 48
For example, 49 49
let's pretend I have a branch office in California 50 50
and my headquarters is in Washington DC. 51 51
Now, if I want to be able to connect 52 52
my remote regional office in California, 53 53
to my headquarters office in Washington DC, 54 54
I could buy a dedicated lease line 55 55
from a telecommunications provider 56 56
and they would give me a direct connection 57 57
that covers over 3000 miles in distance 58 58
between these two sites. 59 59
Even if I got a low speed T1 connection, 60 60
this would be very expensive. 61 61
Now, on the other hand, 62 62
I could use a site to site VPN and I can save 63 63
a lot of money. 64 64
Instead of using that dedicated lease line, 65 65
I could simply create a VPN tunnel from the regional office 66 66
back to the headquarters over the public internet, 67 67
using the internet connectivity 68 68
that's already in that office. 69 69
This solution might cost me 50 or $100 per month 70 70
for a standard cable modem or a fiber modem service 71 71
from the local ISP. 72 72
Once that VPN tunnel is established, 73 73
it's going to take all the traffic 74 74
from the regional office in California 75 75
and run it back to the headquarters in Washington DC, 76 76
over the internet within this secure tunnel. 77 77
And then, once it gets to Washington DC, 78 78
it's going to be decrypted and put back 79 79
inside of my corporate network. 80 80
Now, when a California user 81 81
wants to go to Google.com, for instance, 82 82
that data is going to go from California to Washington DC, 83 83
out the Washington DC's office internet connection 84 84
to visit that website, 85 85
get the information, 86 86
send it back 87 87
to the Washington DC's office internet connection, 88 88
and then back through the VPN to that California user, 89 89
where they'll be able to view the website they requested. 90 90
By using this site to site VPN, 91 91
all the traffic that goes back and forth 92 92
between California and Washington, 93 93
is going to be encrypted and secure. 94 94
So no one can see the internal network traffic 95 95
that's going 96 96
through this external public internet connection. 97 97
Now, when we deal with a client to site VPN 98 98
on the other hand, 99 99
we're going to be seeing data from a single host, 100 100
like a laptop or cell phone or smartphone or tablet, 101 101
and connecting it back to our headquarters office. 102 102
This is going to be done instead of going 103 103
from router to router, 104 104
we're going from client to router. 105 105
This allows a remote user to be able to connect 106 106
back to the head office. 107 107
And that's why we call it a client to site. 108 108
Now, in addition to site to site and client to site VPNs, 109 109
we also have to decide whether or not, 110 110
we're going to use a full tunnel 111 111
or a split tunnel VPN configuration. 112 112
Both full tunnel and split tunnel VPNs 113 113
can be used with either a site to site 114 114
or client to site model. 115 115
Now, a full tunnel VPN is usually used by default 116 116
in most organizations. 117 117
And it's what I described earlier. 118 118
With a full tunnel VPN, 119 119
we're going to route and encrypt all the traffic requests 120 120
through the VPN connection, back to the headquarters, 121 121
regardless of where the destination 122 122
of that service is located. 123 123
This is considered more secure, 124 124
but when we're connected using a full tunnel, 125 125
the clients are considered 126 126
to be fully part of the headquarters network 127 127
when they're connected. 128 128
This means if you're trying to access a local area resource 129 129
like a wireless printer in your home office, 130 130
you're not going to be able to do that 131 131
because that wireless printer in your home office, 132 132
is not connected to the headquarters network, 133 133
like your laptop is, over that client to site VPN. 134 134
Conversely though, 135 135
you can still print to the printers 136 136
in the headquarters office, 137 137
even if you're connected using a full tunnel VPN, 138 138
because you could be sitting in a hotel room 139 139
halfway around the world, 140 140
but logically, you're still sitting in your office 141 141
at the corporate headquarters. 142 142
Now, a split tunnel VPN on the other hand 143 143
is going to divide your traffic and network requests 144 144
and then route them to the appropriate connection 145 145
or network. 146 146
With a split tunnel VPN, 147 147
we're going to route and encrypt the traffic 148 148
bound for the headquarters over the VPN, 149 149
and we're going to send all the other traffic 150 150
out the regular internet. 151 151
So, let's pretend that I'm using a client to site VPN 152 152
on my laptop with a split tunnel configuration 153 153
from my home office. 154 154
The VPN here is going to decide which traffic 155 155
goes back over the VPN 156 156
and gets sent over to the headquarters 157 157
and what traffic goes over the internet. 158 158
So, if I'm trying to access a file server 159 159
or a Microsoft exchange mail server, 160 160
that's back on the headquarters network, 161 161
those packets will get encrypted 162 162
and write it over the VPN to the headquarters. 163 163
But, if I need to attend a Zoom conference 164 164
or access Office 365 or traffic outbound for the internet, 165 165
I'm simply going to bypass that encrypted VPN connection 166 166
and go directly out my internet connection 167 167
to those public websites. 168 168
Now, this is why we call it a split tunnel 169 169
because we have an encrypted VPN tunnel 170 170
for traffic that needs to go to the headquarters 171 171
and another un-encrypted tunnel 172 172
that takes a direct path out to the internet from your ISP. 173 173
The challenge when using a split tunnel, 174 174
is that they can be less secure 175 175
because there is a possibility 176 176
that an attacker could connect to your device 177 177
over that un-encrypted internet tunnel, 178 178
and then they could pivot through your laptop 179 179
and send out over the VPN back to the headquarters network. 180 180
For this reason, 181 181
if you're connecting the VPN over an untrusted network, 182 182
like Wi-Fi at a hotel or a coffee shop, 183 183
you should never use a split tunnel. 184 184
And instead, you should be using a full tunnel. 185 185
Now, a split tunnel does give you better performance 186 186
because it's going to route all your internet based traffic 187 187
directly to those servers 188 188
and bypass the entire company headquarters network. 189 189
So, as you see, 190 190
it becomes a trade off between security and performance. 191 191
If you want more security, 192 192
use a full tunnel VPN. 193 193
If you want better performance, use a split tunnel VPN. 194 194
So, at this point we've talked about two main types of VPNs, 195 195
a site to site VPN and a client to site VPN. 196 196
But, there is one more type of VPN that we need to discuss. 197 197
And it's known as a clientless VPN. 198 198
Now, a clientless VPN is used 199 199
to create a secure remote access VPN tunnel 200 200
using a web browser without requiring any software 201 201
or hardware clients to be used. 202 202
In fact, using this type of VPN, 203 203
is something you do every day 204 204
without even knowing it. 205 205
A clientless VPN is used by your web browser 206 206
when it makes a secure connection to an e-commerce 207 207
or other secure website using HTTPS. 208 208
This can be done using an SSL or TLS tunnel 209 209
by using those protocols. 210 210
Now, SSL or the Secure Socket Layer, 211 211
is going to provide cryptography and reliability 212 212
using the upper layers of the OSI model, 213 213
specifically, layers five, six and seven. 214 214
In recent years, 215 215
SSL has become a bit outdated and less secure. 216 216
So, most clientless VPNs are now using TLS, 217 217
which is Transport Layer Security, 218 218
to provide secure web browsing over HTTPS. 219 219
So, when you logged into this website to watch this video, 220 220
you had to enter your username and password, 221 221
and you saw that little green padlock 222 222
in the upper left corner of the address bar. 223 223
That's how you knew you had a secure connection using HTTPS. 224 224
That means you're using either SSL or TLS 225 225
to create that secure clientless VPN tunnel 226 226
from your web browser in your computer to my servers, 227 227
so you can pull these videos. 228 228
Now, SSL and TLS, 229 229
both use TCP to establish their secure connections 230 230
between a client and a server. 231 231
But, this can slow down your connection 232 232
because TCP has a lot more overhead 233 233
than a UDP connection does. 234 234
So, if you want, 235 235
you can instead opt to use DTLS 236 236
or the Datagram Transport Layer Security, 237 237
which is essentially a UDP based version 238 238
of the TLS protocol. 239 239
This provides the same level of security as TLS, 240 240
but it does operate a bit faster 241 241
because there's less overhead inside the UDP protocol. 242 242
Now, DTLS is an excellent choice to use 243 243
when you're wanting to do things like video streaming 244 244
and things like Voice over IP 245 245
over secure and encrypted tunnels. 246 246
This provides the end-user with security over UDP 247 247
and prevents eavesdropping, tampering and message forgery 248 248
inside that clientless VPN connection. 249 249
Now, there are a few older VPN protocols 250 250
you need to be aware of as well. 251 251
This includes things like L2TP, L2F and PPTP. 252 252
L2TP is the Layer 2 Tunneling Protocol. 253 253
L2TP was a very early VPN. 254 254
It was invented all the way back in the 80s and 90s. 255 255
Unfortunately, 256 256
L2TP lacks security features like encryption by default. 257 257
So, if you're going to use L2TP, 258 258
you have to combine it with another protocol 259 259
to provide encryption for your VPN tunnel 260 260
when you're using L2TP. 261 261
Even though it's an older protocol, 262 262
it's still used by a lot of modern networks 263 263
by combining it with that extra encryption layer 264 264
for protection. 265 265
L2F or Layer 2 Forwarding is a VPN protocol 266 266
that was originally developed by Cisco 267 267
to provide a tunneling protocol 268 268
for the point to point protocol or PPP. 269 269
Unfortunately, it also lacks the native security 270 270
and encryption features 271 271
just like the Layer 2 Tunneling Protocol. 272 272
For this reason, 273 273
LTF has lost most of its popularity, 274 274
and it's not used in most modern networks. 275 275
PPTP or the Point-to-Point Tunneling Protocol 276 276
is an older version of the VPN protocol as well. 277 277
And it was used for dial up networks. 278 278
PPTP also lacks the native security features, 279 279
but Microsoft Windows has added security features 280 280
to their implementation of PPTP. 281 281
Therefore, if you're using a VPN through Windows with PPTP, 282 282
you can still consider this to be pretty secure. 283 283
All these VPN types can still be used today. 284 284
It's just a matter of how secure 285 285
you need your implementation to be, 286 286
and if you need to add an additional layer of encryption, 287 287
provide a more secure tunnel. 288 288
But in most modern VPNs, 289 289
you're going to see overwhelmingly that IPsec 290 290
or IP Security is being used. 291 291
Now, IPsec is used in virtual private networks 292 292
to provide authentication and encryption of packets 293 293
to create a secure encrypted communication path 294 294
between two computers 295 295
over an internet protocol based network. 296 296
We're going to talk more about IPsec in a separate lesson, 297 297
because there's a lot to cover in terms of IPsec 298 298
and how it operates. 299 299
For now, remember there are three main types of VPNs, 300 300
site to site, client to site, 301 301
and clientless. 302 302
Also, remember there are two methods of communication 303 303
using a VPN. 304 304
You can use full tunnel or split tunnel. 305 305
Finally, remember there are several VPN protocols 306 306
you can use to establish those VPNs. 307 307
You can use the L2TP, 308 308
L2F, 309 309
PPTP 310 310
and IPsec.