How PPTP Can Bypass a Proxy Server

89

Chapter 6. Implementing the AltaVista Tunnel 98

The AltaVista Tunnel is a product from Digital Equipment Corporation now Compaq that supports moderately heavy use over a virtual private network connection. As virtual private networks mature, the AltaVista Tunnel continues to evolve, increasing security and adding features and functionality. Now reincarnated as the Altavista Tunnel 98, this client-server package is still a solid solution to a companys VPN needs. In this chapter we introduce some of the advantages, drawbacks, and key concepts to the functionality of the AltaVista solution. Though this is not the only virtual private networking solution, it is one that seems to be taking the lead in this still maturing field. The AltaVista Tunnel 98 is available in two versions: the Extranet Server and the Telecommuter Client. The Extranet server manages connections on the office side, while remote users dial in using Telecommuter Client. The Extranet server itself can also act as a tunnel client, allowing an entire LAN to access a tunnel to a remote LAN. The server keeps a file on each user, defining each user with a username, group name, password, and half of a digital key for the purposes of encryption. Each users client software is configured to issue this information to the server upon initiating a connection. The server secures traffic for the tunnel network with a combination of encryption and conventional authorization using usernames and passwords. This authorization scheme allows remote connections to the tunnel network from any point on the Internet. Each user belongs to one or more groups, and each group gains access to certain systems protected behind the server. The server manages the user groups name and password files, and each groups individual encryption keys. This system gives the enterprise a secure and fairly versatile solution to implementing a virtual private network, without a great expense in administrative time and headaches. While the AltaVista Tunnel Extranet Edition can be used on a computer running other network services, it is advised that this server be managed as a highly trusted system, as the AltaVista Tunnel software handles key generation and management, and authorizes remote tunnel clients. In other words, you should isolate it physically and remove non-essential software. The Telecommuter Client manages each virtual private network connection that the user has access to, allowing for multiple group configurations, keys, and routing information. The tunnel session from the end user side of the connection is transparent to the users Internet service provider, as the remote tunnel server handles all virtual IP assignments and routing information. The virtual IP address is assigned from a defined range in the Extranet servers configuration. These IP addresses are assigned to connecting users for the purpose of routing tunnel traffic. The end users PC then connects to the private network as if it were a node on the local network. The tunnel session is secure, and transparent to the end user. The AltaVista Tunnel Extranet server is available for Windows NT 4.0 SP3 or later, or Digital Unix. The AltaVista Tunnel Telecommuter Client is available for Windows NT 4.0 SP3 or later, MacOS v.8.0, or the Windows 9598 operating systems. 90

6.1 Advantages of the AltaVista Tunnel System

The AltaVista Tunnel system has three advantages of note: accessibility, security, and general flexibility.

6.1.1 Accessibility

Other virtual private network solutions are geared toward providing secure network-to- network access over the Internet. This setup requires fixed IP addresses on both sides, and specific firewall configurations for tunnel traffic on both sides. While the AltaVista Tunnel can provide a LAN-to-LAN virtual private network, its main difference from other solutions resides in its independence from fixed IP addresses, and its user-based verification system. With the use of unique group names, passwords, and encryption keys, the AltaVista Tunnel lets a user log in from a variety of locations, free to use a different IP address each time. This allows the individual user to roam from one Internet access point to another, maintaining access to the corporate LAN. User groups make configuration easier. For instance, you could assign all salespeople to one group, letting them share a single password, and limit their access to particular machines on your corporate network that are owned by the sales organization. User-group authentication, rather than IP authentication, is the functional widget that allows roaming access. The inbound Extranet server is configured with tunnel groups that have specific group usernames, passwords, and individual tunnel keys. These groups, once verified, are routed from a range of dynamically assigned virtual IP addresses to ranges of physical IP addresses on the local network. This allows certain groups of users from the Internet access to specific machines or groups of machines on the local net. The authentication and encryption information is shared by all users authorized to access each specific tunnel. Each user configures an AltaVista Tunnel Telecommuter client with the appropriate username, password, and session key, and connects to the corporate private LAN.

6.1.2 Security

The Tunnel is quite state-of-the-art as far as encryption and authentication go.

6.1.2.1 Three-part encryption technique

The AltaVista Tunnel initially employs RSAs 1024-bit public key exchange technology to provide authentication between tunnel participants. After the initial authentication, the tunnel switches to RSAs RC4 128-bit secret key encryption, which seals all data into secured cryptographic packets for transport to the receiving tunnel client. The receiving tunnel client then decrypts these sealed packets into a readable form. Tunneling data remains encrypted until it is received by the Extranet Server, ensuring data security even within the trusted network. Data integrity of the encrypted packets is transparently checked using RSAs MD5 checksum algorithm, verifying that the data has not been tampered with via transport. Finally, AltaVista Tunnel exchanges new encryption keys among tunnel clients from 30 minutes to 1,440 minutes 1 day during the tunnel session, depending on the configuration parameters set on the server. This re-keying operation happens automatically and is transparent to the various users on the tunnel.