A Note on IP Address and Domain Name Conventions Used in This Book

14

Chapter 2. Basic VPN Technologies

This chapter focuses on the background technologies used to build a virtual private network. As we discussed in Chapter 1 , there are two competing camps at work when we talk about connecting networks. The first camp places the highest worth on the accessibility of data anywhere the user might be, and anywhere the data might be. The second emphasizes that the protection of the data itself, the content, is most important and must be protected to prevent unauthorized persons from using it. As you can see, these two concepts are not at all mutually exclusive, but more of a yin-yang. As you focus on sharing more and more information so that everyone can get what they need, you must also remain focused on the security of that information so that others will not take advantage of you. Because the Internet is a vast collection of resources, it is clear that sharing your information with other participants can help you prosper. It is not clear, however, at what risk you place yourself when you actually connect. It is our opinion that some companies see the Net as a huge untapped marketplace, full of consumers and advertising opportunities, but dont realize that the Internet has its own version of an underworld as well. It is this, above all else, that compels us to protect our data, and where the emergence of the virtual private network presents itself is a stepping stone into the 21st century. The protection of private data is the core of the virtual private network, and the two most relevant technologies encryption and firewalls are what make it all possible. In this chapter we will present an overview and background of the technologies used to build a VPN, and how they are incorporated into the products and services covered in this book. We will start with a discussion of how firewall techniques are used to protect an entire network at its gateway routers. Next, we will present you with a general background on encryption: how it is used in a traditional sense, plus how it will be deployed using a VPN. Following this, we will discuss authentication techniques and how they are used in conjunction with the encryption algorithms with VPNs. Also, we will delve into the protocols that have arisen from the growth of the VPN industry. Lastly, we will briefly cover various compromise methodologies that a potential assailant may use to try to gain access to your private network or data.

2.1 Firewall Deployment

The first of the security-related technologies that we cover in this book is the firewall. A firewall is a system that stands between your internal network and the world outside. Firewalls have been employed on large public networks for many years and are a great starting place in the development of a security strategy. The reason to start with firewalls is that they are generally placed at the point at which your network interconnects with a public network, like the Internet. Although not a perfect strategy, a firewall is easy to configure; it requires only the modification of one gateway router. Of course, if you have a large, multiply- connected WAN, with many paths to the Internet, then it should be noted that you will need to create a firewall for each interconnection point. The complexity of this process increases dramatically from the single point gateway to the multiple point gateway. 2.1.1 What Is a Firewall? The U.S. Department of Defense, probably the worlds authority on data sensitivity and security controls, used a system of confidences defined as security levels to restrict access to 15 classified documents. The criteria for determining how a governmental computer should be protected were detailed in the fabled Orange Book. It stated that to secure highly sensitive data, one must never connect the computer to an exterior network. This is of course the best firewall strategy that exists, but it is too restrictive to be practical. We know the value of interconnection like the rest of you; we just want you to realize that the best firewall for extremely sensitive materials is to isolate them on a computer without a network connection at all. Firewalls usually serve two main functions for a network administrator. The first is to control which machines an outsider can see and the services on those machines with which he can converse. The second controls what machines on the Internet an internal user can see, as well as what services he can use. A firewall is much like a traffic cop, organizing which paths network traffic can take, and stopping some altogether. Internet firewalls usually do this by inspecting every packet that tranverses the gateway router, which is why they are usually referred to as packet filtration systems. Watch out for possible circumvention techniques. The best firewall in the world wont do you a bit of good if there is some backdoor or circumnavigational route the attacker can take. Take care to protect the remote access systems such as PPP, SLIP, and ARA servers that allow users to dial directly into your private network. Remember that hackers will try to take these avenues into your site if you allow them. By avoiding the gateway firewalls and all of your cleverly erected traps and pitfalls, a system cracker has only to dial in with a compromised account to gain access to services against which your exterior gateway firewall cant protect. Remember that your firewall is only as strong as its weakest point. No one security package is a comprehensive solution for all of the services your network provides. It is important to conduct an ongoing audit of your access policies and police your site regularly in concert with researching vulnerabilities as they become discovered. For this chapter, we will use our large branch network as an example. We will further assume that we have a Cisco 2500 series router and 40 workstations. Of the 40 computers, three are servers: one FTP server, one mail server, and one web server. We have a full class C address 2.48.29.024 allocated to us from the NIC Network Information Center; we will be presenting examples throughout this section on how to set up different firewall topologies using our 40 machines and the network provided earlier. Figure 2-1 illustrates what the firewall will be doing in a basic sense for both our large branch as well as our main corporate network at the top.