In this lesson, we're going to cover
some of the methods used in securing network communications.
Now, as cyber threats continue to evolve,
it's always important that you learn
about the different tools and protocols that are used
to protect our data as it's transiting across the Internet
and other insecure networks.
As we attempt to secure our data in transit,
we have to protect it against any potential eavesdroppers
or malicious actors so that our data communications
remain confidential and trustworthy.
To achieve this kind of data in transit security,
we usually are going to rely on three main technologies.
These are Virtual Private Networks known as VPNs,
Transport Layer Security known as TLS,
and Internet Protocol Security known as IPSec.
Let's take a look at each of these.
First, we have virtual private networks.
Now, a virtual private network or VPN is going to be used
to extend a private network across a public network
to allow users to send and receive data across a shared
or public network as if they're computing devices
were directly connected to your organization's
own private network.
With a VPN, your users can work in a remote office
or work from home
and telecommute simply by logging into their laptop
and establishing a secure VPN tunnel
within their organization's network
regardless of where it is in the world.
Now, to do this, users are going to connect to a VPN device
sitting at the headquarters' data center,
and then they'll establish a secure tunnel
using a VPN protocol in order to allow a secure connection
from the corporate user's device
over that untrusted or public network
such as the Internet back into the trusted network
that is contained inside of your headquarters' data center.
These VPNs can be configured as a site-to-site VPN,
a client-to-site VPN or a clientless VPN.
Now, a site-to-site VPN is going to be used
to interconnect two sites
and provide an inexpensive alternative
to a dedicated leased line.
For example, let's pretend that I have a branch office
in California and my headquarters sits in Washington DC.
If I want to be able to connect my remote regional office
in California all the way back to my head office
in Washington DC, I could buy a dedicated leased fiber line
from a telecommunications provider
that gives me a direct connection
that covers over 3,000 miles between these two sites.
Now, even if I got a low speed T1 connection,
this would be very expensive for me to use,
so I can actually use a site-to-site VPN instead
and I'll be able to save a lot of money.
Instead of using a dedicated leased line,
I can simply create a VPN tunnel from the regional office
all the way back to my headquarters over the public Internet
using the Internet connectivity
that I already have in place at both of those offices.
This solution might only cost me $50 or $100 per month
using a standard cable modem or fiber optic modem
from your local service provider at each of those locations.
Now, once the VPN tunnel is established,
it's going to take all the traffic from my regional office
over in California and route it back to the headquarters
in Washington DC over the Internet
within this securely encrypted tunnel.
And then once it reaches back to my network
in Washington DC, I can decrypt that data
and use it as if somebody was sitting right there
inside the Washington DC office.
Now, whenever a California user though
wants to go to google.com,
their data is actually going to go
from California to Washington DC
and then out the Washington DC office's Internet connection
to visit that website, in this case google.com,
and then it returns that response back
to the Washington DC office,
and then it goes back through the VPN connection
over to the user in California.
This way, we're actually funneling everything
through that headquarters' network.
Now, this gives us an ability
to have a lot of security there,
but it also does slow down things for that California user
because they have all this extra data transit happening
going from the West Coast to the East Coast,
out to the website, and then back from the East Coast
over to our user on the West Coast.
Under this kind of a setup,
we're really using a site-to-site VPN,
and all of our traffic from California
is going over to Washington DC first
before it goes out into the public Internet.
By doing this, all the traffic between those two sites
is going to be encrypted and secure
so that nobody can see our internal network traffic,
even though we're doing all this
over an external public Internet connection.
Now, when we deal with a client-to-site VPN,
on the other hand,
we're going to be sending data from a single host
like a laptop, a cellphone, a smartphone, or a tablet,
and connecting it directly back to our headquarters office.
This way, instead of going from a site's router
to the headquarters' router,
we're just going from our device back to the headquarters.
This allows the remote user to be able to connect
back to the head office
and that's why we call this a client-to-site VPN.
For example, let me show you how easy it is
for a user to configure a client-to-site VPN
from their Windows laptop back to their corporate network
using their wireless connection.
In this demonstration, I'm going to show you how to create
a VPN connection on a Windows machine.
Now for this example, I'm going to use a Windows 7 machine,
but it's pretty much the same process
in any version of Windows.
What we're going to do is I'm going to click
on this wireless network that's currently connected,
and I'm going to go to Open Network and Sharing Center.
Now, from here, we're going to go to set up
a new connection or network,
and this will bring up our dialog box to create our VPN.
We want to use connect to a workplace,
which is going to set up our dial up or VPN connection.
We'll then hit Next, and then from here,
we're going to either use it over the Internet
or a direct dial.
In our case, we're going to create a secure VPN tunnel
over the Internet.
And then we'll give it our IP address.
In my case, it's 198.10.20.12,
and I'll give it a name.
Let's call it the Corporate VPN.
And then from there, we're going to hit Next.
We have to put in our username and our password.
So let's say it was Jason Dion and my password of password,
and then we can hit Connect.
And there you go, you're now connected to the VPN,
and you can see that we have an access
over our VPN connection
and we have our wireless connectivity on top of that.
And that's going to make that secure tunnel
so that nobody can see anything that we're transmitting
from our laptop over the Internet back into our VPN network.
Now, once you've decided to use either a site-to-site
or a client-to-site VPN, you need to decide one more thing,
and that's whether you're going to use a full tunnel
or a split tunnel VPN configuration.
Now, both full tunnel and split tunnel VPNs can be used
with either a site-to-site or a client-to-site VPN,
and each one gives you different abilities.
Now, a full tunnel VPN is usually what's going to be used
by most organizations by default,
and it's what I described earlier.
With a full tunnel VPN,
we're going to route and encrypt all of our network requests
through the VPN connection back to the headquarters
regardless of where that destination
or the service is actually going to be located.
This is considered to be more secure,
but when you're connected using a full tunnel,
all of your clients are considered to be fully
a part of your headquarters network
whenever they're connected.
This means that if you're trying to access
a local area network resource
like a wireless printer in your home office,
you're not going to be able to do that
because that wireless printer in your home office
is not connected back to your headquarters network
like your laptop is because you're using
that client-to-site VPN connection.
Conversely though, you could still print
to the printer in your headquarters office
when you're connected using that full tunnel VPN
because all of your headquarters' resources
are still virtually connected to you,
even if you're sitting in a hotel room
halfway around the world.
Now, a split tunnel VPN, on the other hand,
is going to divide your traffic and network requests
and then route them
to the appropriate connection or network.
A split tunnel VPN will route and encrypt
only the traffic that's bound
for your headquarters' network over your VPN
and everything else will be sent out a split tunnel
to the rest of the Internet directly from your location.
For example, if I'm using a client-to-site VPN on my laptop
using a split tunnel from my home office,
I actually have a VPN that's going to decide
which traffic will be routed over the VPN
and which traffic will go directly over to a website
that's located directly on the Internet.
So if I'm trying to access a file server
or a Microsoft Exchange mail server
for my corporate network, I'm going to go through the VPN
and all those packets will get encrypted
and routed back to the headquarters network.
But if I'm going to attend a Zoom conference
or access Office 365, that traffic that's bound for those
will go directly to those sites
by going directly through my Internet connection
and bypassing the headquarters' network completely.
And this is why we call this a split tunnel configuration
because we have both an encrypted VPN tunnel
for the traffic that needs to go to the headquarters
and an unencrypted direct Internet path or tunnel
for everything else that's available openly
and online in the public Internet.
Now, the big challenge when you're using a split tunnel
is that these can be less secure
because now we have a possibility
that an attacker could connect to your device
over your unencrypted Internet tunnel
and then pivot through your laptop
and send out that out back through the VPN
over to the headquarters' network.
For this reason, if you're connecting to the VPN
from an untrusted network
like using Wi-Fi at a hotel or a coffee shop,
you should always use a full tunnel VPN
and not a split tunnel VPN
because this gives you higher levels of security.
That being said,
a split tunnel will give you better performance
because it's routing all Internet-based traffic
directly to those Internet servers
and bypassing your entire headquarters' network.
So as you can see, once again, we have to make a decision
and weigh the trade-offs between security and performance
when we're choosing which type of VPN tunneling
we want to use.
For more security, you're going to use a full tunnel VPN.
For better performance, you're going to use a split tunnel VPN.
So now that we've talked about two main types of VPNs,
a site-to-site VPN and a client-to-site VPN,
we need to talk about the third type
and the third type is known as a clientless VPN.
Now, a clientless VPN is going to be used
to secure remote access VPN tunnels using a web browser,
and it doesn't require any software
or hardware clients to be configured.
In fact, you use this VPN every single day
without even knowing it.
A clientless VPN is going to be used by your web browser
when it makes a secure connection to an e-commerce
or other secure website using the HTTPS connection
over port 443
and it uses a TLS protocol to encrypt the data
being sent to and from that website.
Now, TLS or the Transport Layer Security protocol
is going to provide cryptographic and reliability
using the upper layers of the OSI model,
specifically Layers 5, 6, and 7.
So if you logged into this website to watch the video,
you had to actually enter your username and password.
And when you did that, you looked up to verify
there was that little green lock
in the upper left corner of the address bar.
If you saw that, you knew you had a secure HTTPS connection
and that you're using TLS to create a secure
clientless VPN tunnel through your web browser
from your computer over to my server
to be able to log in securely
without your username and password
being sent directly over the Internet
without being first encrypted.
This now allows you to watch these videos over the secure
and encrypted tunnel between your system and my system.
TLS uses the Transmission Control Protocol,
which is known as TCP,
for us to be able to establish our secure connections
between a client and a server.
But this can slow down your connection
because TCP has a lot more overhead
than a UDP connection does.
So your systems can also opt to use DTLS instead.
And DTLS is the Datagram Transport Layer Security protocol,
which is a UDP-based version of the TLS protocol.
DTLS does provide the same level of security as TLS,
but it operates a bit faster
because it has less overhead in the UDP protocol itself.
Now, DTLS is considered to be an excellent choice to use
when you're wanting to provide video streaming
and things like that over a secure and encrypted tunnel.
This provides the end user with security
over a UDP connection and prevents eavesdropping,
tampering, and message forgery
inside of our clientless VPN connections.
Now, in most modern VPNs that rely on site-to-site
or client-to-site connections though,
you're going to see that we're going to use
the Internet Protocol Security Suite,
which is more commonly called IPSec,
instead of using a clientless TLS encrypted tunnel.
In fact, IPSec is the most popular protocol in use today
for the creation and operation of VPNs
because it provides us with confidentiality, integrity,
authentication, and anti-replay protections
when we're using our VPN connections
for both site-to-site and client-to-site VPNs.
IPSec is a secure network protocol suite
that provides authentication
and encryption of our data packets
to create a secure encrypted communication path
between two computers over an Internet protocol network.
IPSec provides confidentiality by using data encryption.
IPSec will also provide us with the integrity that we want
by ensuring that our data was not modified in transit
by checking its hash digest just before it's transmitted
and then again once it's been received
to ensure they match.
Authentication is going to be provided
by having each party verify they are who they claim to be.
And IPSec will also provide you with anti-replaying
by checking the sequence of numbers
on all of the packets before they're sent.
This prevents the transmission of any duplicate packets,
and it prevents an attacker from being able to capture
and resend packets later as part of an attack.
Now, there are five main steps in the process
of establishing and using a secure VPN tunnel
when you're using IPSec.
First, there's a request to start a key exchange.
Second, IKE Phase 1 is going to authenticate the parties
and establish a secure channel for negotiation.
Third, IKE Phase 2 is going to negotiate
the security association parameters
and fully establish the secure tunnel.
Fourth, we're going to have data transfer,
and this is then going to allow data transfer
between the two parties to occur over the secure tunnel
using the IPSec parameters and keys
that we stored from the security associations
that were negotiated back in step three.
And fifth, IPSec tunnel termination is going to occur,
and this happens when the security associations
are going to be terminated
through either a mutual agreement and deletion
or due to the timing out of the tunnel
because one party became non-responsive.
Now, let's take a look at these five steps
and how they work in the real world.
First, I have PC1
and they want to be able to send some traffic over to PC2.
To do this, router one is going to create
an initiation of an IPSec tunnel.
Second, we're going to see router one and router two,
and they're going to start negotiating
the security associations
to form the IPSec IKE Phase 1 tunnel.
This is known as our ISAKMP tunnel or I-S-A-K-M-P.
Now in step three, IKE Phase 2 is going to create this tunnel
inside of a tunnel when it's negotiated and set up.
Now, once the second tunnel is established,
we can then begin to conduct data transfer in step four
and the information will start flowing
between PC1 and PC2 securely.
When they're all done with that,
we reach step five and the tunnel will be torn down
and the IPSec security associations are going to be deleted.
Now, if you want to be able to create another VPN,
you can do that by starting this whole process
over again from the beginning
and going through those five steps once more.
Now, to allow the data transfer to happen inside of IPSec,
we do this during step four,
and we're going to do this using one of two modes.
These modes are known as transport mode or tunneling mode.
First, we have transport mode.
And transport mode is going to use the packet's
original IP header
and it's going to be used for client-to-site VPNs.
The transport mode approach works really well
if you have problems increasing your packet size
because you may go over your maximum transmission unit size
or MTU inside of your network.
Remember, by default in most networks,
the MTU or maximum transmission unit size
is going to be set at 1,500 bytes in most of our networks.
If you go over 1,500 bytes,
that packet will become fragmented,
and this can cause issues with your VPN's functionality.
If you're using a client-to-site VPN,
I highly recommend that use a transport mode
as your IPSec method because it doesn't add
any additional padding to your packet
and it doesn't increase its size.
Now, on the other hand,
if you're setting up a site-to-site VPN,
like having a regional office
connecting back to your main office,
then I would use tunneling.
Now, tunneling mode is going to be used
to encapsulate the entire packet
and put another header on top of it.
This will increase the size of the packet,
and this could cause you to go over
that 1,500 bytes of your MTU
or maximum transmission unit size.
Now, when you think about tunneling mode,
I want you to think about it this way.
Let's say you have a letter that you want to deliver
and you put it in an envelope.
Inside of that envelope, you're going to put down the address
of who you want to send it to.
Now, before you send it out, you're actually going to tunnel it
by putting it into a second envelope
and putting a different address on it.
Now, when you put that second address on it,
this is going to be a new header,
and this new header has the new source
and destination of the VPN terminating device
at the different site that you want this letter to go to.
When it gets to the other side,
your VPN concentrator will remove the outer envelope,
which is that outer header,
and inside of that will be the network packet
that can be decrypted
and then routed across their private local area network
just as if it came from an internally connected client.
When you're using this tunneling mode,
you're actually encapsulating the entire packet
into a new packet
so you can send it over the public Internet.
This is going to increase the size of your overall packet,
and it could go above the MTU default size of 1,500 bytes.
So if you're going to be using a site-to-site VPN,
you may need to allow jumbo frames
or frames that are bigger than 1,500 bytes
inside of your network
to be able to access this type of tunneling mode.
This way, it'll be able to properly support these packets
that are larger than 1,500 bytes.
Now, if you can't set up jumbo mode,
another way you can do this
is by actually dropping the maximum MTU size
on your inner router to something like 1,400 bytes
and then connecting to the VPN.
This way, you've got an extra 100 bytes of room
between 1,400 and 1,500 bytes
to be able to add that extra encapsulation
and the new packet header
before it's transmitted over the public Internet
inside of your VPN tunnel.
If you control your entire network though,
you can again just use jumbo frames
and actually go up to a size of up to 9,000 bytes
if you wanted to, but this should only be done
on your own local area networks
because 9,000 byte packets will have trouble
traversing the entire Internet.
Now, the final thing we need to discuss in this lesson
is the concept of an AH or Authentication Header,
as well as an Encapsulating Security Payload or ESP
that is used within your IPSec protocol.
Now, the AH or Authentication Header is going to be used
to provide connectionless data integrity
and data origin authentication for IP datagrams,
and it provides protection against replay attacks.
Be aware though that the authentication header
does not provide any kind of confidentiality
of the data itself.
Instead, the authentication header
contains a cryptographic hash of the data,
and this will simply act as identification information
to provide the integrity between the sender
and the receiver of each packet that's being transmitted.
Now, the Encapsulating Security Payload or ESP,
on the other hand, is going to be used to provide
authentication, integrity, replay protection,
and confidentiality of your data.
By using ESP within IPSec,
you can actually rewrite the payload of the packet
inside of an encrypted format.
Now, when we're using ESP,
we're only protecting the confidentiality of the payload
that's contained within the packet,
not the headers themself.
So if you're using transport mode,
such as in a client-to-site VPN,
you can use authentication headers
to provide integrity for your TCP header,
and then you can add ESP
or the Encapsulating Security Payload
to be able to encrypt the TCP header
and the data inside the payload.
This does not encrypt the end-to-end header
so people outside your organization though
will be able to see where the data's coming from
and where it's going to,
but they won't be able to read the data inside.
It's just like if I went to your mailbox
and looked at a letter in there.
I could see who sent you the letter
and I could see that it was sent to you,
but I don't know what's inside that letter
because I haven't opened up the envelope.
Now, if you're using the tunneling mode,
such as in a site-to-site VPN,
you can instead use both the authentication header
and the encapsulated security payload
to provide integrity and encryption of that payload,
including the end-to-end header.
In this case, a new IP header is going to be added
to the front of the packet to cover the hops
to the other end of the secure connection.
This means that nobody on the Internet
will be able to see the source or destination of the traffic
within your organization's internal networks
on either side of that VPN connection.
So remember, when it comes
to securing network communications,
we usually rely on a VPN, TLS, or IPSec
to ensure the data remains safe from prying eyes
as it traverses over an untrusted or insecure network
like the Internet.
A VPN or Virtual Private Network
is a secure and encrypted connection
between a user's device and a remote server
that allows for private
and anonymous access to the Internet.
A client-to-site VPN will allow individual users
to remotely connect to a secure network,
while a site-to-site VPN establishes a secure connection
between two separate network locations.
A clientless VPN is a remote access solution
that's going to allow users to securely access
network resources using a web browser
without the need for a dedicated piece of client software
that's going to rely on the Transport Layer Security protocol
for its encryption.
IPSec or the Internet Protocol Security Suite
is a suite of protocols that's used
to secure Internet protocol communications by authenticating
and encrypting each IP packet in the data stream.
IPSec can be configured
to use either transport mode or tunneling mode.
Transport mode is normally going to be used
for client-to-site VPNs,
while tunneling mode is normally going to be used
for site-to-site VPNs.
These different tools and protocols are going to be used
to help encrypt our data
and to protect it against any potential eavesdropping
or modifications as it transits across the Internet
and other insecure networks.