4.3 Virtual private networks

Here is the scenario: You are the network manager of a large company. You know that you must have secure access to five sites around the world. Each site will need to have 20 to 30 computers with a bandwidth of an equivalent of T1 (1.544 Mbps) to each site. One answer to this problem would be to set up direct connect circuits to each site in essence, set up a private network. This actually can be the "right" answer. But for our discussion, this is not a good answer. Why? Cost and availability are just two issues. In some countries, this could be very expensive and may not even be available. So what can you do? You can use the Internet. Now you may have the same problem with availability, but more and more countries are providing T1 access speeds to local businesses. Using the Internet, you can see that your data is not secure, and options like SSL and e-mail encryption are not viable options. A solution in this case is a "virtual private network" (VPN). A VPN is a collection of technologies that creates secure connections via the Internet. In simplest terms, a VPN is a secure connection between two or more locations over some type of a public network. Let's look at four different protocols for creating VPNs over the Internet:

PPTP point-to-point tunneling protocol
L2F layer 2 forwarding
L2TP layer 2 tunneling protocol
IPSec IP security protocol

PPTP, L2F, and L2TP are largely targeted at remote access, like dial-up. LAN-to-LAN solutions would use IPSec.

4.3.1 Point-to-point tunneling protocol (PPTP)

PPTP has been deployed for remote users since Microsoft included support for it in RAS (remote access server) for Windows NT Server 4. PPTP builds on the functionality of PPP to provide remote access that can be tunneled through the Internet to a destination site or computer. PPTP encapsulates PPP packets using generic routing encapsulation (GRE) protocol, which gives PPTP the flexibility of handling protocols other than IP. PPTP is designed to run at open systems interconnection (OSI) Layer 2 and IPSec operates at layer 3.

4.3.2 Layer 2 forwarding (L2F)

L2F is another protocol, developed by Cisco Systems. It is similar to PPTP in that L2F is a layer 2 tunneling protocol. ^[3]

4.3.3 Layer 2 tunneling protocol (L2TP)

L2TP is a combination of Microsoft's PPTP and the Cisco L2F. L2TP is a network protocol and it can send encapsulated PPP packets over IP, X.25, Frame Relay, or Asynchronous Transfer Mode (ATM) networks. ^[4]

For example, say each city has its own network but all of the networks are connected via a VPN as in Figure 4.3. The VPN is secured by using a technology known as IPSec. IPSec is a simple version of an emerging Internet IP security protocol. (Review the series of IETF standards for IPSec, which have been published as Request for Comments 1825 to 1829.) A virtual private network is a network that is not in actuality private but is as safe as a private network. If a company has its main office in Dallas and a branch office in London, the traditional solution for connecting the networks would be to lease a line for each site.

4.3 Virtual private networks