Presentation is loading. Please wait.

Presentation is loading. Please wait.

Guide to Network Defense and Countermeasures Second Edition Chapter 6 VPN Implementation.

Similar presentations


Presentation on theme: "Guide to Network Defense and Countermeasures Second Edition Chapter 6 VPN Implementation."— Presentation transcript:

1 Guide to Network Defense and Countermeasures Second Edition Chapter 6 VPN Implementation

2 Guide to Network Defense and Countermeasures, Second Edition2 Objectives Explain design considerations for a VPN Describe options for VPN configuration Explain how to set up VPNs with firewalls Explain how to adjust packet-filtering rules for VPNs Describe guidelines for auditing VPNs and VPN policies

3 Guide to Network Defense and Countermeasures, Second Edition3 Designing a VPN Assess organization’s needs and goals –Type of business –How many employees it has –Infrastructure already in place –Security required Enforce security on the client side of the VPN tunnel –Most difficult aspect of the design process

4 Guide to Network Defense and Countermeasures, Second Edition4 Business Needs Business processes –Determine how you will implement a VPN strategy Careful analysis of the existing infrastructure –Helps you integrate the VPN with minimal disruption VPNs can be classified as site-to-site or client-to-site –Can offer cost-effective, secure connectivity Legal implications to failing to secure access to a remote network

5 Guide to Network Defense and Countermeasures, Second Edition5 Business Needs (continued) Nature of the business –What does it do? –What product or service does it sell? –Who are its customers? –Cost is usually a key factor Narrows the choices of hardware and software

6 Guide to Network Defense and Countermeasures, Second Edition6 Business Needs (continued) Nature of the business –A secure VPN design should address: Secure connectivity Availability Authentication Secure management Reliability Scalability Performance

7 Guide to Network Defense and Countermeasures, Second Edition7 Client Security Several ways to increase VPN client security Split tunneling –Describes multiple paths –One path goes to the VPN server and is secured –Another unauthorized and unsecured path permits users to connect to the Internet While still connected to the corporate VPN –Leaves the VPN server and internal LAN vulnerable to attack

8 Guide to Network Defense and Countermeasures, Second Edition8

9 9

10 10 Client Security (continued) Planning VPN deployment –Consider the existing infrastructure Make a network map –Decide on the placement of VPN servers –Research hardware and software to use Decide whether you need new hardware or software Sometimes you can reconfigure existing resources to support a VPN –Develop a list of requirements When you meet a vendor so nothing is overlooked –Follow security policy guidelines

11 Guide to Network Defense and Countermeasures, Second Edition11 Configuring VPNs Define a VPN domain –Set of one or more computers that VPN hardware and software handle as a single entity Computers in a VPN domain use the VPN to communicate with another domain

12 Guide to Network Defense and Countermeasures, Second Edition12

13 Guide to Network Defense and Countermeasures, Second Edition13 Single and Multiple Entry Point Configurations Determine whether network gateway will be included in the VPN domain –Depends on whether your network has a site-to-site or client-to-site VPN configuration Single entry point configuration –Typically used by small networks –All traffic to and from the network passes through a single gateway –Gateway must be a member of the VPN domain

14 Guide to Network Defense and Countermeasures, Second Edition14

15 Guide to Network Defense and Countermeasures, Second Edition15 Single and Multiple Entry Point Configurations (continued) Multiple entry point configuration –Typically used by large organizations –Multiple gateways are used Each with a VPN tunnel connecting a different location –Gateway must be excluded from the VPN domain Otherwise all traffic will be encrypted reducing performance unnecessarily –Make sure VPN domains do not overlap

16 Guide to Network Defense and Countermeasures, Second Edition16

17 Guide to Network Defense and Countermeasures, Second Edition17 VPN Topology Configurations VPN topology –How components in a network are connected physically to one another –Determines how gateways, networks, and clients are related to each other –Corresponds to the basic physical and logical topologies of any network

18 Guide to Network Defense and Countermeasures, Second Edition18 VPN Topology Configurations (continued) Mesh topology –All participants in the VPN have Security Associations (SAs) with one another –Types of mesh arrangements Full mesh –Every subnetwork is connected to all other subnets in the VPN –Complex to manage Partial mesh –Any subnet in the VPN may or may not be connected to the other subnets

19 Guide to Network Defense and Countermeasures, Second Edition19

20 Guide to Network Defense and Countermeasures, Second Edition20 VPN Topology Configurations (continued) Star topology –Also known as a hub-and-spoke configuration –VPN gateway is the hub –Networks that participate in the VPN are called rim subnetworks –Separate SAs are made between the hubs of each rim subnetwork in the star configuration –Central VPN router is at organization’s central office –Any LANs or computers that want to participate need to connect only to the central server

21 Guide to Network Defense and Countermeasures, Second Edition21

22 Guide to Network Defense and Countermeasures, Second Edition22 VPN Topology Configurations (continued) Hybrid topology –Combines two different network topologies –Central core uses a mesh topology Mesh topologies tend to operate more efficiently –Branch offices can be connected using a star topology –Benefits from strengths of each topology Scalability (of the star topology) Speed (of the mesh configuration)

23 Guide to Network Defense and Countermeasures, Second Edition23

24 Guide to Network Defense and Countermeasures, Second Edition24 Using VPNs with Firewalls VPNs do not reduce the need for a firewall –Always use a firewall as part of VPN security design Install VPN software on the firewall itself –Firewall allows outbound access to the Internet –Firewall prevents inbound access from the Internet –VPN service encrypts traffic to remote clients or networks

25 Guide to Network Defense and Countermeasures, Second Edition25 Using VPNs with Firewalls (continued) Install VPN software on the firewall itself –Advantages Control all network access security from one server Fewer computers to manage Use the same tools for VPN and firewall –Disadvantages Single point of failure Must configure routes carefully Internet access and VPN traffic compete for resources on the server

26 Guide to Network Defense and Countermeasures, Second Edition26

27 Guide to Network Defense and Countermeasures, Second Edition27 Using VPNs with Firewalls (continued) Set up VPN parallel to your firewall inside the DMZ –Advantages No need to modify firewall settings to support VPN traffic Configuration scales more easily Can deal with congested servers –Disadvantages VPN server is connected directly to the Internet If VPN server becomes compromised, attacker will have direct access to your internal network Cost of supporting a VPN increases with new servers

28 Guide to Network Defense and Countermeasures, Second Edition28

29 Guide to Network Defense and Countermeasures, Second Edition29 Using VPNs with Firewalls (continued) Set up VPN server behind the firewall connected to the internal network –Advantages VPN server is completely protected from the Internet Firewall is the only device controlling access VPN traffic restrictions are configured on VPN server –Disadvantages VPN traffic must travel through the firewall Firewall must handle VPN traffic Firewall might not know what to do with IP protocols other than ICMP, TCP, and UDP

30 Guide to Network Defense and Countermeasures, Second Edition30

31 Guide to Network Defense and Countermeasures, Second Edition31 Adjusting Packet-Filtering Rules for VPNs Perimeter firewall filters packets VPN sends or receives Packet filtering is based on header fields of inbound and outbound packets IP packet header fields used by packet filtering –Source address –Destination address –Protocol identifier You can conduct packet filtering based on any or all of these header fields

32 Guide to Network Defense and Countermeasures, Second Edition32 PPTP Filters PPTP –First widely supported VPN protocol –Supports legacy authentication methods –Does not require PKI –Might be only option when VPN connections pass through NAT –PPTP uses two protocols TCP GRE

33 Guide to Network Defense and Countermeasures, Second Edition33

34 Guide to Network Defense and Countermeasures, Second Edition34 L2TP and IPSec Filters Need to set up rules that permit IPSec traffic –IKE uses protocol ID 171 and UDP on port 500 –ESP uses protocol ID 50 –AH uses protocol ID 51

35 Guide to Network Defense and Countermeasures, Second Edition35

36 Guide to Network Defense and Countermeasures, Second Edition36 Auditing VPNs and VPN Policies Auditing needed to make sure organizations have a well-define VPN policy Access policies define standards for connecting to the organization’s network –Must be integrated with the security policy Policies should be defined for different levels of restrictions VPN endpoints are as vulnerable as internal network computers –Endpoints should also use antivirus software and personal firewalls

37 Guide to Network Defense and Countermeasures, Second Edition37 Auditing VPNs and VPN Policies (continued) Test each client that will connect to your LAN –Helps prevent network threats You can standardize VPN client for remote users Third-party solutions –Cisco Secure VPN Client –Nokia VPN Client –SonicWALL VPN Client Verify everything is working according to your policies

38 Guide to Network Defense and Countermeasures, Second Edition38 Summary Business nature helps determine your VPN requirements Decide placement of VPN servers –Research hardware and software to use Establish a VPN domain VPN configurations –Single entry point configurations –Multiple entry point configurations VPNs need to be used with firewalls

39 Guide to Network Defense and Countermeasures, Second Edition39 Summary (continued) Adjust packet-filtering rules –To allow PPTP, L2TP, and IPSec traffic Auditing VPNs and VPN policies –After you have installed and configured your VPN Work with a knowledgeable remote user –Helps determine a baseline for future auditing, testing, and troubleshooting


Download ppt "Guide to Network Defense and Countermeasures Second Edition Chapter 6 VPN Implementation."

Similar presentations


Ads by Google