Documente Academic
Documente Profesional
Documente Cultură
ITE PC v4.0
Chapter 1 © 2007 Cisco Systems, Inc. All rights reserved. Cisco Public 1
What is VPN?
• A VPN is a means of carrying private traffic over a
public network.
• Often used to connect two private networks, over a
public network, to form a virtual network
• The word virtual means that, to the users on either
end, the two private networks seem to be
seamlessly connected to each other.
• That is, they are part of a single virtual private
network (although physically they are two separate
networks).
implication? connectivity, security, privacy
The VPN should provide the same connectivity and
privacy you would find on a typical local private
network.
2
Encrypted vs Nonencrypted VPNs
• In encrypted VPNs, encryption mechanisms
are used to secure the traffic across the
public network.
– Example: IPsec VPNs
• In nonencrypted VPNs, either data security is
not ensured at all, or is ensured by other
means (including encryption at higher layers).
– Examples:
MPLS VPNs (Multiprotocol Label Switching)
GRE-based VPNs
– Uses higher layer encryption for confidentiality
3
VPNs at different OSI layers
• The layer where VPN is constructed affects
its functionality.
– Example: In encrypted VPNs, the layer where
encryption occurs determines
(i) how much traffic gets encrypted
(ii) the level of transparency for the end users
4
VPNs at different OSI layers
• Network layer VPNs (Layer-3)
– Created using layer 3 tunneling and/or encryption
Q: difference between encapsulation and tunneling ?
See http://computing-dictionary.thefreedictionary.com/tunneling%20protocol
– Advantages:
• A ‘proper’ layer
– Low enough: transparency
– High enough: IP addressing
• Cisco focuses on this layer for its VPNs.
5
Generic Routing Encapsulation
(GRE)
• Provides low overhead tunneling (often between two private networks)
• C = 1, checksum present
• Checksum: to ensure the integrity of the GRE header and the payload packet; contains
a checksum of the GRE header and the payload packet
• Key:
– contains a number to prevent misconfiguration of packets;
– may be used to identify individual traffic flow within a tunnel
– Not the same as a cryptographic key
7
Generic Routing Encapsulation
• Case Studies:
- GRE between multiple sites