Virtual private networks or VPNs.
In this lesson, we're going to dive deeper
into VPNs, known as virtual private networks,
and we're going to cover all the things you need
to know about a VPN for your exam.
First, what is a VPN?
Well, a VPN is a virtual private network,
and it's going to be used to extend a private network
across a public network, and enable users to send
and receive data across that shared or public network
as if their computing devices were directly connected
to the private network.
Now with a VPN, your users can work in a remote office
or work from home, and they can telecommute simply
by logging into their laptop
and establishing a secure VPN tunnel
to the organization's network,
regardless of where it sits in the world.
To do this, they're going to connect
to a VPN device sitting at the headquarters data center,
and then they're going to establish a secure tunnel
using a VPN protocol
in order to allow a secure connection
for that corporate user over an untrusted or public network,
something like the internet.
Now, this allows them to then reach
into the corporate network and be connected to the intranet
as if they were sitting right at their desk in their office.
VPNs can be configured as a site to site VPN,
a client to site VPN or a clientless VPN.
With a site to site VPN,
we can connect two offices together.
With a client to site VPN,
we're more concerned with connecting a single remote user
back to a corporate network, as I described earlier
with the user who needed a telecommute.
When we talk about a clientless VPN,
these are usually going to be used with web browsing.
Alright, let's dive a little bit deeper
and talk about a site to site VPN.
Now, a site to site VPN is used to interconnect two sites
and provide an inexpensive alternative
to dedicated lease lines.
For example, let's pretend
I have a branch office in California
and my headquarters is in Washington, DC.
Now, if I want to be able to connect my remote regional office
in California to my headquarters office in Washington, DC,
I could buy a dedicated lease line
from a telecommunications provider,
and they would give a direct connection
that covers over 3,000 miles in distance
between these two sites.
Even if I got a low speed T1 connection,
this would be very expensive.
Now, on the other hand, I could use a site to site VPN
and I can save a lot of money.
Instead of using that dedicated lease line,
I could simply create a VPN tunnel from the regional office
back to the headquarters over the public internet
using the internet connectivity
that's already in that office.
This solution might cost me 50 or $100 per month
for a standard cable modem
or a fiber modem service from the local ISP.
Once that VPN tunnel is established,
it's going to take all the traffic
from the regional office in California
and run it back to the headquarters in Washington DC
over the internet within this secure tunnel.
And then once it gets to Washington DC,
it's going to be decrypted
and put back inside of my corporate network.
Now, when a California user wants
to go to google.com, for instance,
that data's going to go from California to Washington, DC,
out the Washington DC's office internet connection
to visit that website, get the information, send it back
to the Washington, DC's office internet connection,
and then back through the VPN to that California user
where they'll be able to view the website they requested.
By using this site to site VPN, all the traffic
that goes back and forth between California and Washington
is going to be encrypted and secure,
so no one can see the internal network traffic that's going
through this external public internet connection.
Now, when we deal with a client to site VPN,
on the other hand, we're going to be sending data
from a single host like a laptop
or cell phone or smartphone or tablet,
and connecting it back to our headquarters office.
This is going to be done instead of going
from router to router.
We're going from client to router.
This allows a remote user to be able to connect
back to the head office,
and that's why we call it a client to site.
Now, in addition to site to site
and client to site VPNs, we also have to decide
whether or not we're going to use a full tunnel
or a split tunnel VPN configuration.
Both full tunnel and split tunnel VPNs can be used
with either a site to site or client to site model.
Now, a full tunnel VPN is usually used by default
in most organizations,
and it's what I described earlier.
With a full tunnel VPN,
we're going to route and encrypt all the traffic requests
through the VPN connection back to the headquarters
regardless of where the destination
of that service is located.
This is considered more secure.
But when we're connected using a full tunnel,
the clients are considered to be fully part
of the headquarters network when they're connected.
This means if you're trying to access a local area resource
like a wireless printer in your home office,
you're not going to be able to do that
because that wireless printer in your home office
is not connected to the headquarters network
like your laptop is over that client to site VPN.
Conversely, though, you could still print
to the printers in the headquarters office
even if you're connected using a full tunnel VPN,
because you could be sitting in a hotel room
halfway around the world,
but logically, you're still sitting in your office
at the corporate headquarters.
Now, a split tunnel VPN, on the other hand,
is going to divide your traffic and network requests
and then route them
to the appropriate connection or network.
With a split tunnel VPN, we're going to route
and encrypt the traffic bound
for the headquarters over the VPN,
and we're going to send all the other traffic
out the regular internet.
So let's pretend that I'm using a client to site VPN
on my laptop with a split tunnel configuration
from my home office.
The VPN here is going to decide which traffic goes
back over the VPN and gets sent over to the headquarters,
and what traffic goes over the internet.
So if I'm trying to access a file server
or a Microsoft Exchange mail server
that's back on the headquarters network,
those packets will get encrypted
and routed over the VPN to the headquarters.
But if I need to attend a Zoom conference
or access Office 365, or traffic outbound for the internet,
I'm simply going to bypass that encrypted VPN connection
and go directly out my internet connection
to those public websites.
Now, this is why we call it a split tunnel,
because we have an encrypted VPN tunnel for traffic
that needs to go to the headquarters,
and another unencrypted tunnel that takes a direct path
out to the internet from your ISP.
The challenge when using a split tunnel is
that they can be less secure
because there is a possibility
that an attacker could connect to your device
over that unencrypted internet tunnel,
and then they could pivot through your laptop
and send data over the VPN back to the headquarters network.
For this reason, if you're connecting the VPN
over an untrusted network
like wifi at a hotel or a coffee shop,
you should never use a split tunnel,
and instead, you should be using a full tunnel.
Now, a split tunnel does give you better performance
because it's going to route all your internet-based traffic
directly to those servers
and bypass the entire company headquarters network.
So as you see, it becomes a trade off
between security and performance.
If you want more security, use a full tunnel VPN.
If you want better performance, use a split tunnel VPN.
So at this point, we've talked about two main types of VPNs,
a site to site VPN, and a client to site VPN.
But there is one more type of VPN that we need to discuss,
and it's known as a clientless VPN.
Now, a clientless VPN is used
to create a secure, remote access VPN tunnel
using a web browser without requiring any software
or hardware clients to be used.
In fact, using this type of VPN
is something you do every day without even knowing it.
A clientless VPN is used by your web browser
when it makes a secure connection to an e-commerce
or other secure website using HTTPS.
This can be done using an SSL or TLS tunnel
by using those protocols.
Now, SSL, or the secure socket layer
is going to provide cryptography and reliability
using the upper layers of the OSI model,
specifically layers five, six, and seven.
In recent years, SSL has become a bit outdated
and less secure.
So most clientless VPNs are now using TLS,
which is transport layer security
to provide secure web browsing over HTTPS.
So when you logged into this website to watch this video,
you had to enter your username and password,
and you saw that little green padlock
in the upper left corner of the address bar.
That's how you knew you had a secure connection using HTTPS.
That means you are using either SSL or TLS
to create that secure clientless VPN tunnel
from your web browser and your computer
to my servers so you can pull these videos.
Now, SSL and TLS both use TCP
to establish their secure connections
between a client and a server,
but this can slow down your connection
because TCP has a lot more overhead
than a UDP connection does.
So if you want, you can instead opt to use DTLS
or the Datagram Transport Layer Security,
which is essentially a UDP-based version
of the TLS protocol.
This provides the same level of security as TLS,
but it does operate a bit faster
because there's less overhead inside the UDP protocol.
Now, DTLS is an excellent choice to use
when you're wanting to do things like video streaming,
and things like voiceover IP
over secure and encrypted tunnels.
This provides the end user with security over UDP,
and prevents eavesdropping, tampering, and message forgery
inside that clientless VPN connection.
Now, there are a few older VPN protocols
you need to be aware of as well.
This includes things like L2TP, L2F and PPTP.
L2TP is the Layer 2 Tunneling Protocol.
L2TP was a very early VPN
and was invented all the way back in the '80s and '90s.
Unfortunately, L2TP lacks the security features
like encryption by default.
So if you're going to use L2TP, you have to combine it
with another protocol to provide encryption
for your VPN tunnel when you're using L2TP.
Even though it's an older protocol, it's still used
by a lot of modern networks by combining
with that extra encryption layer for protection.
L2F or layer two forwarding is a VPN protocol
that was originally developed by Cisco
to provide a tunneling protocol
for the point-to-point protocol or PPP.
Unfortunately, it also lacks the native security
and encryption features,
just like the Layer 2 Tunneling Protocol.
For this reason, L2F has lost most of its popularity,
and it's not used in most modern networks.
PPTP or the Point-to-Point Tunneling Protocol is
an older version of the VPN protocol as well,
and it was used for dial-up networks.
PPTP also lacks the native security features,
but Microsoft Windows has added security features
to their implementation of PPTP.
Therefore, if you're using a VPN through Windows with PPTP,
you can still consider this to be pretty secure.
All these VPN types can still be used today.
It's just a matter of how secure
you need your implementation to be,
and if you need to add an additional layer of encryption
to provide a more secure tunnel.
But in most modern VPNs, you're going to see overwhelmingly
that IPSec or IP security is being used.
Now, IPSec is used in virtual private networks
to provide authentication and encryption of packets
to create a secure encrypted communication path
between two computers
over an internet protocol-based network.
Remember, there are three main types of VPNs:
site to site, client to site and clientless.
Also, remember, there are two methods
of communication using a VPN.
You can use full tunnel or split tunnel.
Finally, remember there are several VPN protocols
you can use to establish those VPNs.
You can use the L2TP, L2F, PPTP and IPSec.