Internet Security and VPN Network Design

 Overview

In this essay, several fundamental VPN technological ideas are covered. Using the Internet, a Virtual Private Network (VPN) connects distant workers, corporate locations, and commercial partners while securing encrypted tunnels between them. The company network is accessible to remote users via an access VPN. The distant computer or laptop will connect to a nearby Internet service provider using an access circuit, such as cable, DSL, or wireless (ISP). A client-initiated model uses IPSec, Layer 2 Tunneling Protocol (L2TP), or Point to Point Tunneling Protocol to create an encrypted tunnel from the laptop to the ISP (PPTP). The user must provide the ISP with proof of identity as an authorised VPN user. After that is done, the ISP creates an encrypted tunnel to the corporate VPN concentrator or router. The remote user will be verified as an authorised employee to access the company network via TACACS, RADIUS, or Windows servers. Depending on where their network account is situated, the remote user must then authenticate to the local Windows domain server, internetprivatsphare Unix server, or Mainframe host. Since the encrypted tunnel is only constructed from the ISP to the business VPN router or VPN concentrator, the ISP started approach is less secure than the client-initiated model. The secure VPN tunnel is also constructed using L2TP or L2F.

By establishing a secure VPN connection from the router of the business partner to the company VPN router or concentrator, the Extranet VPN will join business partners to a company network. Whether a router connection or a distant dialup connection is being used determines the precise tunnelling protocol that is being used. There are two alternatives for an Extranet VPN connected to a router: IPSec and Generic Routing Encapsulation (GRE). Extranet connections made via dial-up will use L2TP or L2F. Using IPSec or GRE as the tunnelling protocols, the Intranet VPN will use the same procedure to securely connect business offices. It is crucial to remember that the reason VPNs are so economical and successful is because they use the current Internet to carry business traffic. For this reason, a lot of businesses decide to use IPSec as their preferred security protocol to ensure that data is secure while it moves between routers or between a laptop and a router. IPSec provides authentication, authorisation, and confidentiality through the use of 3DES encryption, IKE key exchange authentication, and MD5 route authentication.

Web Security Protocol (IPSec)

Given how frequently Virtual Private Networking uses IPSec operation today, it is important to note. IPSec is established as an open standard for secure IP transport via the open Internet and is detailed in RFC 2401. An IPSec header, an IP header, and an encapsulating security payload make up the packet structure. IPSec offers authentication with MD5 and 3DES encryption services. The distribution of secret keys between IPSec peer devices is also automated by Internet Key Exchange (IKE) and ISAKMP (concentrators and routers). Negotiating one-way or two-way security associations calls for those protocols. An encryption algorithm (3DES), a hash algorithm (MD5), and an authentication method make up the IPSec security associations (MD5). Three security associations (SA) are used by access VPN solutions for each connection (transmit, receive and IKE). A Certificate Authority will be used for scalability with the authentication process instead of IKE/pre-shared keys in a business network with numerous IPSec peer devices. https://internetprivatsphare.at

Laptop - IPSec Peer Connection with VPN Concentrator

1. Discussions with the IKE Security Association

2. Setting up IPSec Tunnel

3. Request / Answer for XAUTH (RADIUS Server Authentication)

4. Respond / Acknowledge Mode Configuration (DHCP and DNS)

IPSec Security Association, number 5.

Access VPN Concept

The Access VPN will use WiFi, DSL, and cable access circuits from nearby Internet Service Providers to connect to the company's main office at a reasonable cost. The key concern is that company data must be secured while it is transferred from the telecommuter laptop to the corporate headquarters through the Internet. The client-initiated paradigm, which establishes an IPSec tunnel from each client laptop and terminates it at a VPN concentrator, will be used. The VPN client software, which runs on Windows, will be set up on each laptop. To authenticate with the ISP, the telecommuter must first dial a local access number. Each dial connection will be verified by the RADIUS server as a legitimate telecommuter. The remote user will next authenticate and approve with Windows, Solaris, or a Mainframe server after that is complete before beginning any applications. Should one of the two VPN concentrators become unavailable, the other will automatically take over using the virtual routing redundancy protocol (VRRP).

Each concentrator is connected to a firewall and an external router. Denial of service (DOS) assaults from outside hackers that might disrupt network availability are prevented by a new feature of VPN concentrators. Each telecommuter is given an IP address from a predetermined range, and the firewalls are set up to allow traffic from both sources and destinations. Moreover, all application and protocol ports will be allowed through the necessary firewall.

VPN Extranet Design

Each business partner office can securely connect to the main office of the organisation via the extranet VPN. Since the Internet will be used to convey all data flow from each business partner, security is the main priority. Each business partner will have a circuit connection that will end at a VPN router at the corporate headquarters. At the central office, a router with a VPN module will be used by each business partner and its peer VPN router. Before packets are sent across the Internet, internetprivatsphare.at that module offers IPSec and fast hardware encryption. Peer VPN routers are dual homed to two different multilayer switches at the company's main office to provide link diversity in the event that one of the links fails. It is crucial that no business partner's office receives traffic from another partner. The switches are used to link up public servers and the external DNS server and are situated between internal and external firewalls. As the external firewall is filtering traffic from the public Internet, that is not a security concern.

To further prevent routes from being publicised or vulnerabilities from being exploited by having business partner connections at the company's core office multilayer switches, filtering can also be applied at each network switch. At each network switch, distinct VLANs will be assigned to each business partner to enhance security and segment subnet traffic. The tier 2 external firewall will inspect each packet and allow those with the source and destination IP addresses, application and protocol ports, and other information needed by the business partner. Sessions with business partners will need to use a RADIUS server for authentication. They will then authenticate at Windows, Solaris, or Mainframe hosts before launching any programmes after that is complete.