1. Virtual Private Networks and Spawning Networks Department of Computer Science

2. Wired Magazine Hype List Feb 1998 Virtual Private Networks Ranked #1 The wonderful thing about virtual private networks is that its myriad definitions give every company a fair chance to claim that its existing product is actually a VPN. But no matter what definition you choose, the networking buzz- phrase doesn't make sense. The idea is to create a private network via tunneling and/or encryption over the public Internet. Sure, it's a lot cheaper than using your own frame relay connections, but it works about as well as sticking cotton in your ears in Times Square and pretending nobody else is around. Other items on the list n Hacker Consultants n MiniDisc n Windows NT 5.0 n Interior Design http://www.wired.com/wired/archive/6.02/hypelist.html

3. Overview What is a VPN ? Requirements and Motivation Scenarios Methods Practical VPN Spawning Networks : VPNs on the fly

4. What is a VPN ? Network : A Network consists of any number of devices which can communicate through some arbitrary method Private: –Data Privacy and data integrityPrivacy –Access is restricted to defined set of entities –Privacy of addressing and routing system  Addressing used by VPN community is separate and discrete from underlying shared network  Same for routing Virtual: –Private communication over shared network infrastructure e.g. Internet One Line Definition

5. What is a VPN ? Network : A Network consists of any number of devices which can communicate through some arbitrary method Private: –Data Privacy and data integrityPrivacy –Access is restricted to defined set of entities –Privacy of addressing and routing system  Addressing used by VPN community is separate and discrete from underlying shared network  Same for routing Virtual: –Private communication over shared network infrastructure e.g. Internet (encryption and authentication)

6. One Line Definition A VPN is a private network constructed within a public network infrastructure, such as the global internet One Line Definition

7. Scenarios Two end-systems e.g. e-commerce Remote access network –E.g. a large firm with hundreds of sales people in the field Site to Site –Branch Office connection network – intranet VPN –Business partner networks – extranet VPN Combination of above

9. Motivations Economics of Communications –Cheaper than constructing or leasing physical networks for private communication Communications Privacy –Depends on the technology used to construct the VPN Global Reachability Scalability ( compared to custom networks )

10. Requirements Data Security –Authentication –Confidentiality –Integrity Tunneling Mechanisms QoS Guarantees

11. Methods to construct VPNs Most common – TunnelingTunneling Tunnel connects two VPN endpoints –Traffic opaque to underlying IP backbone –IP backbone used as link-layer technology, where tunnel forms a virtual point-to-point link Advantages –Segregation of common host network from the VPN –Routing of VPN isolated from common host network –Encapsulate different protocol families http://www.howstuffworks.com/vpn5.htm

12. Methods to construct VPNs Most common – Tunneling Tunnel connects two VPN endpoints –Traffic opaque to underlying IP backbone –IP backbone used as link-layer technology, where tunnel forms a virtual point-to-point link Advantages –Segregation of common host network from the VPN –Routing of VPN isolated from common host network –Encapsulate different protocol families “tunneling" is a technology that allows a network transport protocol to carry information for other protocols within its own packets. For example, IPX data packets can be encapsulated in IP packets for transport across the Internet, which isn't normally possible

13. Tunnels Cons –Administrative overhead – manual configuration –Scaling problems – point to point or point to multipoint ? –QoS Performance issues  Encapsulation overhead  No control over path on the common network ( e.g. IP ) Three different protocols –Carrier protocol – e.g. most common is IP –Encapsulating protocol - (GRE, IPSec, L2F, PPTP, L2TP) –Passenger protocol - The original data (IPX, NetBeui, IP)

14. Encapsulating Protocols PPTP vs L2F –PPTP wraps PPP in IPPPTP PPP –L2F uses Layer Two protocols, such as Frame Relay and ATM, for tunneling. L2TP – –supposed to offer the best of PPTP and L2F –Supports multiple concurrent tunnels per client IPSec – broad based open solution for encryption and authentication on a per packet basis  Two modes – tunnel and transport  Integrated with L2TP for security ( transport mode ) Tunnels

15. Encapsulating Protocols PPTP vs L2F –PPTP wraps PPP in IPPPTP –L2F uses Layer Two protocols, such as Frame Relay and ATM, for tunneling. L2TP – –supposed to offer the best of PPTP and L2F –Supports multiple concurrent tunnels per client IPSec – broad based open solution for encryption and authentication on a per packet basis  Two modes – tunnel and transport  Integrated with L2TP for security ( transport mode ) The Point-to-Point Protocol (PPP) provides a method for transmitting datagrams over serial point-to-point links. http://www.cisco.com/warp/public/779/smbiz/service/knowledge/wan/ppp_auth.htm Tunnels

16. PPTP Protocol –Data channel: PPP over IP GRE (Generic Routing Encapsulation) –Encapsulates link layer (PPP), communicates at network layer (IP) –Call setup handled in a control channel Tunnels

17. ISP Gateway PPTP Client Computer PPTP Server Computer PPP Encapsulator IP Packets SMB Packets PPTP Interface SLIP Interface PPP Decapsulator IP Packets PPTP Interface SLIP Interface IP Packets IP GRE Packets SMB Packets PPTP Tunneling Example http://www.ccsi.com/survival-kit/slip-vs-ppp.html Tunnels

18. PPTP Tunneling Example PPTP Interface IP Header TCP Header Payload Data PPP Header IP GRE Header PPP Encapsulator IP Header TCP Header Payload Data PPP Header IP Header TCP Header Payload Data SLIP Interface IP Header TCP Header Payload Data PPP Header IP GRE Header SLIP Header TCP/IP Packet Modem IP GRE is not handled by many firewalls Tunnels

20. PPTP in a Nutshell Tunnels

21. Practical VPN SSH Example

22. What is SSH ? Overview of Secure Shell. SSH is a secure replacement for the “r” utilities. Availability: Downloadable & Commercial versions. Resources: Both commercial and free are widely available. SSH is very popular and there’s a lot of expertise out there

23. SecureCRT The SecureCRT client application combines the secure logon and data transfer capabilities of Secure Shell (SSH) with the reliability, usability, and configurability of a proven Windows® terminal emulator. http://www.vandyke.com/products/securecrt/index.html

24. Simple SSH VPN Host-to-host IP tunneling In SecureCRT: Open session options for a host

25. Simple SSH VPN (2) Now select the “Advanced” button

26. SSH – Port forwarding Open up the remote connection n Open browser or application to 127.0.0.1: –127.0.0.1:8080 in our example n We should now connect to remote service

27. Simple SSH VPN

28. Not Just for Hosts Network to Network

29. VPN on Linux n VPN – HOWTO http://metalab.unc.edu/pub/Linux/docs/HOWTO/mini/VPNhttp://metalab.unc.edu/pub/Linux/docs/HOWTO/mini/VPN n Two Main Ingredients: –ssh/sshd – for privacy –pppd n The pppd commands establish a working connection. It's strictly a bilateral umbilical cord between the VPN servers that extends no mutual connectivity to workstations on the networks. n Mutual Connectivity between workstations: That is done by the route commands. Once these commands have been executed, the two networks have been transparently pooled into a single group of machines, all mutually visible via Internet addresses. n PPP Interface assigned an IP address http://www.linuxjournal.com/article.php?sid=3271

30. Example ssh tunnel here

31. An Interesting challenge VPN for VM Computing on Grids Goals –Security for the VPN  Via ssh –Static address for VMs undergoing migration –Different VMs may communicate with each other –Assume minimum co-operation from the remote host

34. Spawning Networks

35. Main idea: Automating the process of realizing distinct network architectures on demand OS Analogy : “We envision spawning networks as having the capability to spawn not processes but complex network architectures”

36. Spawning Networks Two child networks are spawned by the parent network. The first child network is a Cellular IP virtual network that supports wireless extensions to the parent network. The other child network supports a differentiated services architecture operating over the same network infrastructure. An additional level of nesting is shown where the Cellular IP network spawns a child network.

37. Spawning Networks

38. Genesis kernel has the capability to spawn child network architectures that can support alternative distributed network algos and services

39. Spawning Networks

40. Programmable data path Operate on the same physical node Each routelet corresponds to a distinict virtual network Network inheritance tree

41. Ports and engines are dynamically created during the spawning phase from a set of transport modules, which represent a set of generic routelet plugins Encapsulators, which add specific headers (e.g., RTP, IPv4) to packets at the end systems or routelets Forwarders, which execute particular packet forwarding mechanisms (e.g., IPv6, MPLS, Cellular IP) at routelets Classifiers, which separate packets in order to receive special treatment by routelets Processors, which process packets based on architecturally specific plugins (e.g., police, mark, monitor, shape, filter packets) Schedulers, which regulate the use of virtual link capacity based on a programmable buffer and queue management capability Child ports and engines can be constructed by directly