>> Let's move on to our next section
which covers Remote Access.
We're looking at connecting to
the network without being physically plugged in.
We'll talk a little bit about dial-up,
and then we'll talk about VPN access
through a process we refer to as tunneling.
Let's take a look at dial-up.
Normally, when we're connected
>> to our local area network,
>> we're connected via our network card and that
network card provides Layer 2 framing
for a local network.
But if we take a step back and we think about
our remote access clients, maybe
using a modem to connect into a remote access server,
which is likely not the way
we're communicating mainstream,
but remote access server and modem usage still exists.
But in this case, I've a client who's no
longer connecting to the network via network card,
which means they don't have a device that does
the work that a network card typically does.
One of the things a network card does is provide
Layer 2 framing for LAN connections.
It adds the information that's
necessary to communicate across the LAN.
If we have a client dialing up with a modem,
there is no device to provide that Layer 2 framing.
That's where Point-to-Point Protocol comes in.
PPP is how it's often
referred to, point-to-point protocol through,
is what does that Layer 2 framing
for connections to the WAN.
It was traditionally used with dial-up clients.
But today, now that we're connecting out to
our WANs through our cable modems and DSL modems,
now we have something called PPPoE,
which is Point-to-Point Protocol over Ethernet.
It basically means you're using your network card,
but you're still connecting to
a WAN as opposed to a local area network.
The primary protocol is
going to be allowing us to connect to
a WAN and still have that Layer 2
information added, that's point-to-point protocol.
With point-to-point protocol, it's
not designed to add security,
it's specifically for Layer 2 framing.
For security, there are a handful of
authentication protocols that would be used.
The first which is PAP.
PAP stands for Password Authentication Protocol.
PAP transmits passwords in plain text.
We don't want that anymore.
PAP really is irrelevant for use today.
PAP was replaced by a protocol called CHAP,
Challenge Handshake Authentication Protocol.
Then Microsoft extended beyond that and there's
MS-CHAP and MS-CHAP version 2.
But ultimately, this is something called a challenge
handshake protocol or a challenge response.
Basically, when one device is trying to make
a connection with another
based on the password that's entered,
let's say I've to connect to
a router from one router from another,
I'm setting up a static route,
for instance, there may be a password protection.
Only if I type in the correct password
can my device respond
to a challenge issued by
the server or the system on the other end.
Basically, what it is is
a system where I can prove the password
that's being entered correctly without
having to put the password on network.
Challenge response systems are good
because they do keep the passwords off
the network. That's desirable.
But the problem with CHAP and PAP
also is that they only provide
a means to authenticate using passwords.
There are a lot of ways we can authenticate today.
We can use smartcards, biometrics, cookies,
certificates, tokens, and none of
that can be used with PAP or CHAP.
We needed a protocol that could
extend beyond just passwords and
really provide capabilities to
authenticate in any manner you choose.
That's where EAP, Extensible Authentication Protocol.
EAP extends the capabilities beyond passwords.
You can think of it in that way.
At any point in time
you're using anything beyond
passwords, you're definitely using EAP.
It will also allow you to use passwords as well.
EAP is the way of the future.