Bảo mật hệ thống mạng part 27 potx

CHAPTER
10
Virtual Private
Networks
167
Copyright 2001 The McGraw-Hill Companies, Inc. Click Here for Terms of Use.
P
rivate networks have been used by organizations to communicate with remote sites
and with other organizations. Private networks are made up of lines leased from
the various phone companies and ISPs. The lines are point to point and the bits that
travel on these lines are segregated from other traffic because the leased lines create a real
circuit between the two sites. There are many benefits to private networks:
▼
Information is kept “within the fold.”
■
Remote sites can exchange information instantaneously.
▲
Remote users do not feel so isolated.
Unfortunately, there is also a big disadvantage: cost. Private networks cost a lot of
money. Using slower lines can save some money but then the remote users start to notice
the lack of speed and some of the advantages begin to evaporate.
With the increasing use of the Internet, many organizations have moved to Virtual
Private Networks (VPN). VPNs offer organizations many of the advantages of private
networks with a lower cost. However, VPNs introduce a whole new set of issues and
risks for an organization. Properly architected and implemented, VPNs can be advanta-
geous to the organization. Poorly architected and implemented, all the information that
passes across the VPN might as well be posted on the Internet.
DEFINING VIRTUAL PRIVATE NETWORKS
So, we are going to send sensitive organization information across the Internet in such a
way as to reduce the need for leased lines and still maintain the confidentiality of the traf-
fic. How do we separate our traffic from everyone else’s? The short answer is that we use

encryption.
All kinds of traffic flow across the Internet. Much of that traffic is sent in the clear so that
anyone watching the traffic can see exactly what is going by. This is true for most mail and
Web traffic as well as telnet and FTP sessions. Secure Shell (SSH) and HyperText Transfer
Protocol - Secure (HTTPS) traffic is encrypted and thus cannot be examined by someone
reading the packets. However, SSH and HTTPS traffic does not constitute a VPN.
VPNs have several characteristics:
▼
Traffic is encrypted so as to prevent eavesdropping.
■
The remote site is authenticated.
■
Multiple protocols are supported over the VPN.
▲
The connection is point to point.
Since neither SSH nor HTTPS can handle multiple protocols, neither is a real VPN.
VPN packets are mixed in with the regular traffic flow on the Internet and segregated be
-
cause only the end points of the connection can read the traffic.
168
Network Security: A Beginner’s Guide
Let’s look more closely at each of the characteristics of a VPN. We have already stated
that VPN traffic is encrypted to prevent eavesdropping. The encryption must be strong
enough to guarantee the confidentiality of the traffic for the length of time the traffic is
valuable. Passwords may only be valuable for 30 days (assuming a 30-day change pol
-
icy); however, sensitive information may be valuable for years. Therefore, the encryption
algorithm and the VPN implementation must prevent an unauthorized individual from
decrypting the traffic for some number of years.
The second characteristic is that the remote site is authenticated. This characteristic

may require that some users be authenticated to a central server or it may require that
both ends of the VPN be authenticated to each other. The authentication mechanism used
will be governed by policy. It may require that users authenticate with two factors or with
dynamic passwords. For mutual authentication, both sites may be required to demon
-
strate knowledge of a shared secret that is preconfigured.
VPNs are built to handle different protocols, especially at the application layer. For
example, a remote user may use SMTP to communicate with a mail server while also us
-
ing NetBIOS to communicate with a file server. Both of these protocols would run over
the same VPN channel or circuit (see Figure 10-1).
Point to point means that the two end points of the VPN set up a unique channel be-
tween them. Each end point may have several VPNs open with other end points simulta-
neously but each is distinct from the others and separated by the encryption.
Chapter 10: Virtual Private Networks
169
Figure 10-1.
VPNs handle multiple protocols
VPNs are generally separated into two types: user VPNs and site VPNs. The differ
-
ence between them is the way the two types are used, not because of the way traffic is seg
-
regated by each type. The remainder of this chapter discusses each type of VPN in detail.
USER VPNS
User VPNs are virtual private networks between an individual user machine and an or
-
ganization site or network. Often user VPNs are used for employees who travel or work
from home. The VPN server may be the organization’s firewall or it may be a separate
VPN server. The user connects to the Internet via a local ISP dial-up, DSL line, or cable
modem and initiates a VPN to the organization site via the Internet.

The organization’s site requests the user to authenticate and, if successful, allows the
user access to the organization’s internal network as if the user were within the site and
physically on the network. Obviously, the network speeds will be slower since the limit
-
ing factor will be the user’s Internet connection.
User VPNs may allow the organization to limit the systems or files that the remote
user can access. This limitation should be based on organization policy and depends on
the capabilities of the VPN product.
While the user has a VPN back to the organization’s internal network, he or she also
has a connection to the Internet and can surf the Web or perform other activities like a
normal Internet user. The VPN is handled by a separate application on the user’s com-
puter (see Figure 10-2).
Benefits of User VPNs
There are two primary benefits of user VPNs:
▼
Employees who travel can have access to e-mail, files, and internal systems
wherever they are without the need for expensive long distance calls to
dial-in servers.
▲
Employees who work from home can have the same access to network services
as employees who work from the organization facilities without the
requirement for expensive leased lines.
Both of these benefits can be figured into cost savings. Whether the costs are long-dis
-
tance charges, leased-line fees, or staff time to administer dial-in servers, there is a cost
savings.
For some users there may also be a speed increase over dial-in systems. Home users
with DSL or cable modems should see a speed increase over 56K dial-up lines. More and
more hotel rooms are also being equipped with network access connections so speed
should also increase for employees who travel.

170
Network Security: A Beginner’s Guide
TEAMFLY

Team-Fly
®

NOTE:

A speed increase over a 56K dial-up line is not guaranteed. The overall speed of the connection
depends upon many things, including the user’s Internet connection, the organization’s Internet connec-
tion, congestion on the Internet, and the number of simultaneous connections to the VPN server.
Issues with User VPNs
The proper use of user VPNs can reduce the costs to an organization but user VPNs are
not a panacea. There are significant security risks and implementation issues that must be
dealt with.
Perhaps the biggest single security issue with the use of a VPN by an employee is the
simultaneous connection to other Internet sites. Normally, the VPN software on the
user’s computer determines if the traffic should be sent to the organization via the VPN
or to some other Internet site in the clear. If the user’s computer has been compromised
with a Trojan Horse program, it may be possible for some external, unauthorized user to
use the employee’s computer to connect to the organization’s internal network (see Fig
-
ure 10-3). This type of attack takes some sophistication but is far from impossible.
User VPNs require the same attention to user-management issues as internal systems.
In some cases, the users of the VPN can be tied to user IDs on a Windows NT domain or to
some other central user-management system. This capability makes user management
Chapter 10: Virtual Private Networks
171
Figure 10-2.
User VPN configuration
simpler but administrators must still be cognizant of which users require remote VPN ac-
cess and which do not. If the VPN user management is not tied to a central user-manage-
ment system, the user-management procedures for the organization must take this into
account when employees leave the organization.
Users must authenticate themselves before using the VPN. Since the VPN allows re
-
mote access to the organization’s internal network, this authentication should require
two factors. One factor may be the user’s computer itself. If so, the second factor must be

something the user knows or something she is. In either case, the second factor must not
be something that can reside on or with the computer.
Organizations must also be concerned with traffic loads. The primary load point will
be the VPN server at the organization site. The key parameter for loads is the number of
simultaneous connections that are expected. As each connection comes up, the VPN
server is expected to be able to decrypt additional traffic. While the processor may be able
to handle large traffic volumes, it may not be able to encrypt and decrypt a large number
of packets without significant delay. Therefore, the VPN server should be sized based on
the number of simultaneous connections that are expected.
One other issue may impact how an organization uses a user VPN. This issue is the
use of NAT at the remote end of the connection. If the organization expects its employees
to attempt to use a VPN from sites that are behind firewalls, this may become an issue.
172
Network Security: A Beginner’s Guide
Figure 10-3.
Use of a Trojan Horse program to access an organization’s internal network
For example, if Organization A is a consulting company with employees working at Or
-
ganization B, A might like its employees to be able to connect back for mail and file access.
However, if they are working from computers attached to B’s internal network and B
uses dynamic NAT to hide the addresses of internal systems, this may not be possible. If
your organization chooses to use its VPN in this matter, you should check the capabilities
of the VPN software in this regard.
Managing User VPNs
Managing user VPNs is primarily an issue of managing the users and user computer sys
-
tems. Appropriate user-management procedures should be in place and followed during
employee separation.
Obviously, the proper VPN software versions and configurations must be loaded on
user computers. If the computers are owned by the organization, this becomes part of the

standard software load for the computer. If the organization allows employees to use the
VPN from their home computers, the organization will need to increase overall support
to these users as different computers and ISPs may require different configurations.
One key aspect of the user VPN that should not be forgotten is the use of a good
anti-virus software package on the user’s computer. This software package should have
its signatures updated on a regular basis (at least monthly) to guard against viruses and
Trojan Horse programs being loaded on the user’s computer.
SITE VPNS
Site VPNs are used by organizations to connect remote sites without the need for expen-
sive leased lines or to connect two different organizations that wish to communicate for
some business purpose. Generally, the VPN connects one firewall or border router with
another firewall or border router (see Figure 10-4).
To initiate the connection, one site attempts to send traffic to the other. This
causes the two VPN end points to initiate the VPN. The two end points will negotiate
the parameters of the connection depending on the policies of the two sites. The two
Chapter 10: Virtual Private Networks
173
Figure 10-4.
Site-to-site VPN across the Internet