Virtual Private Networks (VPNs) through Tunneling

Virtual Private Networks (VPNs) through Tunneling

Point-to-Point Tunneling Protocol (PPTP)| is a legacy protocol that relies on Generic Routing Encapsulation (GRE) to build the tunnel between the endpoints.

The security architect and security professional both need to consider known weaknesses, such as the issues identified with PPTP, when planning for the deployment and use of remote access technologies.

PPTP is based on Point-to-Point Protocol (PPP), so it does offer authentication by way of password authentication protocol (PAP), challenge-handshake authentication protocol (CHAP), or extensible authentication protocol (EAP). As a legacy protocol, it has a large installed base, which may force organizations to allow its use despite its limitations. Fortunately, more secure alternatives exist and are widely available.

Layer 2 Tunneling Protocol (L2TP)

Layer 2 Tunneling Protocol (L2TP) is a hybrid of Layer 2 Forwarding (L2F) and PPTP. It allows callers over a serial line using PPP to connect over the internet to a remote network. L2TP does not provide encryption, but it relies upon IPSec to provide encryption. L2TP is based on PPP so it does offer authentication by way of PAP, CHAP, and EAP. Again, IPSec can provide authentication.

Encryption via Secure Socket Layer (SSL)

Even though users employ a web browser, created the opportunity to implement TLS VPNs are not restricted to applications virtual private networks (VPNs), which that use HTTP. With the aid of plug-ins, in essence created a tunnel between two such as Java, users can have access to IP addresses by encrypting the original IP back-end databases, and other non-webbased applications. TLS VPNs have several packet, including its header. advantages over IPSec. They are easier SSL has since been determined to be to deploy on client workstations than insecure, and therefore should not be used.

IPSec because they require a web browser

It has been replaced by Transport Layer only, and almost all networks permit

Security (TLS), which is fully compatible.

outgoing HTTP.

Both SSL and TLS VPNs rely upon PKI to generate a secure session key.

TLS VPNs can be operated through a proxy server. In addition, applications

Remote users employ a web browser can restrict users' access based on to access applications that are in the criteria, such as the network the user is organization's network.

on, which is useful for building extranets with several organizations.

Tunneling Firewalls And Other Restrictions

Control of HTTP tunneling can happen on the firewall or the proxy server. It should be noted, however, that in the case of peerto-peer protocols, this would require a "deny by default" policy. Blocking instant messaging without providing a legitimate alternative is not likely to foster user acceptance and might give users incentive to use even more dangerous workarounds.

Also note that inbound file transfers can result in circumvention of policy, etc., or restrictions in place, for the spreading of malware.

An effective countermeasure can be found in active antivirus scanning on the client, which should be enabled anyway.