In this lesson, we're going to discuss
a lot of the different types of remote access options
that you may be supporting as a network technician
or network administrator.
These different methods will allow a client
to access a server
or a network device remotely over your network.
Now, as an administrator, you're going to be using
some of these methods to reach
into the command line interface of your routers,
your switches, and your firewalls as well
in order for you to be able
to modify their settings and configurations
as part of your job functions.
Now, there are many ways to access this data remotely,
and you can also control these devices remotely as well.
So in this lesson, we're going to discuss Telnet,
SSH, RDP, RDG,
VNC, VDI,
In-Band versus Out-of-Band Management and APIs.
Now, the first thing we need to talk about
with remote access technology is Telnet.
Now, Telnet operates on Port 23
and Telnet is used to send text-based commands
to remote devices
and is considered a very old networking protocol.
Everything you do in Telnet is going to be text-based,
and here you can see that I'm connecting over Telnet
to rainmaker.wunderground.com.
By doing this, I can then look up
the daily weather for my area.
Now, one of the biggest drawbacks using Telnet is
that it sends everything over the network in plain text
or unencrypted formats.
Now, in this case, I really don't care
that I'm sending things in plain text
because the only information I have to send to the server is
the three digit airport code
for the city that I want to check the weather within.
But if I'm going to send something private
like my social security number or my password,
or my credit card number,
then I would never ever want to use Telnet for that.
Remember, Telnet should never, never, not ever be used
for anything when you're connecting
to one of your secure devices.
Anything like a router or a switch or a firewall.
Because when you're configuring them,
everything will be sent in plain text,
including your commands, your username, your passwords,
your access control list, all of that stuff.
Instead, we always want to use
an encrypted text space remote access technology,
something like Secure Shell.
This brings us to our second remote access technology,
which is Secure Shell.
Now Secure Shell or SSH is going to operate over Port 22.
Secure Shell is also known as SSH,
and it works just like Telnet,
but it's going to encrypt everything
that's being sent and received
between the client and the server,
the router or the switch that you're communicating with.
Therefore, you're going to have much better security
when you're using SSH than when you're using Telnet.
Remember, anytime you need to connect to a networking device
to configure it in the Command line interface,
you should always be doing this over SSH using Secure Shell.
This will ensure you have an encrypted connection
to that device.
The third remote access technology we need to discuss is
known as RDP or the Remote Desktop Protocol.
Now, the Remote Desktop Protocol operates over report 3389,
and it's a proprietary protocol developed by Microsoft,
which provides users with a graphical interface
to connect to another computer over a network connection.
While RDP is not really useful
if you're trying to talk to a router,
a switch, or a firewall,
it is really useful when you're trying to remotely access
and control a Windows server or client machine.
For example, if your SIEM or network management system
operates on a Windows machine,
you can RDP into it as a way to connect to it
over your local area network.
RDP is going to provide you with a graphical user interface
known as a GUI or GUI.
This allows you to access a server and desktop
and control it using your mouse and keyboard.
Now, when you're remotely connected to this machine,
it's going to act just as if you were sitting in front of it,
but you could do it from across the network
or across the world.
For example, here you can see there are three devices
and they're all connecting to a Windows seven machine.
You have a Macintosh laptop,
you have an iPad or an Android tablet,
and you have a cell phone,
and all of these are able to reach in
and do the communication using RDP,
just as if I had a mouse and keyboard
sitting right in front of that workstation.
RDP is going to allow you to connect to these devices
from across your network or across the world
depending on how you have it configured.
Now, the remote desktop protocol itself is not considered
to be a secure protocol.
Instead, you need to secure that connection
by using something else to tunnel it over.
For example, you can use a remote desktop gateway or RDG
to create a secure connection between you
and that gateway and then tunnel into the RDP session.
Or you can use a VPN, like a virtual private network.
Now, our fourth remote access technology
we need to discuss is the RDG or the Remote Desktop Gateway.
Now, a remote desktop gateway is a window server
that's going to have the role of creating a secure connection
using either SSL or TLS protocols to a server via RDP.
So if you're using an RDG to secure your RDP client,
this will allow you to create
those secure server connections.
This way, you wouldn't have to run a VPN
to create an encrypted tunnel
because RDG is already going to create
that encrypted tunnel using SSL or TLS protocols.
A remote desktop gateway provides
several security features for you
in terms of securing RDP connections.
This includes things like creating encrypted tunnels
like a VPN would, controlling access to network resources
based on permissions in group roles,
maintaining and enforcing authorization policies,
and monitoring the status of the gateway
and any RDP connections passing through that gateway.
If you're running a Windows server 2008 or newer,
you definitely should be using this RDG
or Remote Desktop Gateway
to better protect your RDP connections.
Now, the fifth remote access technology
we need to discuss is VNC or Virtual Network Computing.
VNC operates over port 5900
and was originally designed for thin client architectures
and things like Virtual Desktop Infrastructure or VDI.
VNC operates a lot like RDP,
but unlike RDP, which only operates
on Windows clients and servers,
VNC is truly cross-platform,
and it can be used on Linux, OS X
or Windows clients and servers.
The sixth remote access technology to discuss is
virtual desktop infrastructure or VDI,
which I just mentioned that we use that
with VNC a lot of times.
Now, virtual desktop infrastructure is used
to host a desktop environment on a centralized server.
VDI is a form of desktop virtualization
and allows a specific desktop image
to be run within a virtual machine
and delivered to an end user over a network.
In cloud computing,
we call this Desktop as a Service or DaaS.
Now, when you're using VDI, you can access it
through a virtual desktop,
either by using a web browser
on a regular Desktop or laptop,
or you can use a specialized thin client device
that uses a PXE network boot image
to load up a specialized client
that can connect to that centralized server
and provide access to the virtual desktop.
Our seventh remote access technology
or concept that we need to talk about is known
as In-Band versus Out-of-Band Management.
Now, In-Band management refers to managing devices
through the use of Telnet or SSH protocols over the network.
For example, if you're going to be using a workstation
on your local area network to configure your LAN routers,
you can connect to those using SSH
by simply connecting to the gateway over Port 22.
This would be considered an In-Band management
because you're using the same network
that you're configuring.
Now Out-of-Band Management on the other hand,
is used when you have an alternate path
or alternate management network
to connect to the different network devices
for configuring them.
This is considered a best practice in security.
For example, in the last
large scale enterprise network I worked on,
we had a production network
with the users we're connected to,
everyone's workstations were there,
be able to do their work on a daily basis,
and they could access our servers and the internet.
From this network,
you couldn't connect to the routers and switches
in order to configure them though.
Instead, we had a separate network
called a management network,
which was an Out-of-Band Network.
This was a more secure network
and it was limited in its functions.
If I need to configure the routers or switches,
I would connect to the Out-of-Band Network
and then I could talk to those routers and switches
and configure them.
Another Out-of-Band Management connection would be
if you had a laptop and you directly connected
to the switch or router using
a serial connection or a console port.
Now, this direct connection is going to be established
when you need to configure the router or switch,
and when you're done doing that configuration,
you'd unplug it and disconnect it.
This is a truly Out-of-Band solution.
Now, the goal with using an Out-of-Band solution is
to prevent a regular user's machine
from being able to connect
to the management interfaces of your devices.
This way, if a user's computer is taken over by an attacker,
they would then be unable to cause large scale havoc
across your network.
Now, by using an Out-of-Band network,
you can provide separation of data
between your production networks
and your management networks,
which gives you additional layers of security.
Now, Out-of-Band networks do require
additional configuration and equipment to implement though.
If you want to be able to have
a management network and a user network,
you're going to need two sets of routers
and two sets of switches,
and all that starts to get very expensive over time.
Now, it is considered a best practice,
especially in large scale networks,
where you can't physically walk
to every single switch or router that you want to reconfigure,
so in those cases, you definitely need
to have a management network.
Our eighth remote access technology we need
to talk about is known as APIs.
An API or Application programming interface is
a set of protocols and routines for building
and interacting with software applications.
Essentially, it serves as an intermediary
between different systems, allowing them to communicate
and exchange data with each other.
This is a key concept when discussing
the use of service-oriented architectures
to be able to include different systems
and piece them all together.
APIs allow for automated administration,
management and monitoring of cloud services
as well as many other different types of applications.
They're typically built using
either the Representational State Transfer known as REST,
or the Simple Object Access Protocol known as SOAP.
When considering APIs, it's always important
to think about their role in the integration
that you're going to create,
because APIs allow for direct integration
of different third party applications
into your own web applications,
and they provide a means
for integrating different cloud services
by configuring, provisioning and automating
a bunch of different business functions for us.
Remember, there are different types of remote access options
that you may be supporting as a network technician
or network administrator.
These different methods will allow a client
to access a server or a network device remotely
over your network.
Now, as an administrator,
you're going to be using some of these methods
to reach into the command line interface
of your routers, your switches, and your firewalls as well
in order for you to be able to modify their settings
and configurations using Telnet,
SSH, RDP, RDG,
VNC, VDI, In-Band versus Out-of-Band Management and APIs.