- [Instructor] Virtual private networks
extend private networks across an untrusted network.
Usually this untrusted network is the Internet.
This can be used for secure communications
between offices that share files, voice traffic,
or, really, anything that can be transported over TCPIP.
VPNs provide anti-replay,
which prevents man-in-the-middle attacks.
Data integrity,
which ensures packets aren't manipulated in transit.
Confidentiality,
which means no one can eavesdrop on communications.
And authentication, which proves that either endpoint is
who they say they are.
I'll use the Internet for this example.
Our remote office will create a secure tunnel
between itself and the central office.
When doing so, the two routers will create
what's called a VPN tunnel.
The word tunnel is quite fitting,
as once it's established, everything that moves through it
will be protected, even over the Internet.
The term tunnel doesn't necessarily imply
that all traffic moving through it is encrypted,
but it's trivial to add encryption.
Thus it will be implied moving forward.
Most site-to-site encryption is done via IPSec,
which is a framework for securing IP networks.
Being a framework,
it has the ability to support many different protocols
and levels of encryption.
Once both sides have agreed upon a set of options,
it will encrypt traffic as it leaves one site,
then decrypt it at the far side
for delivery to its final destination.
IPSec VPNs can be created directly or via tunnel interfaces.
Whenever possible, provided the hardware supports it,
I always prefer a tunnel interface,
as it generally makes things simpler.
A tunnel interface,
like a generic routing encapsulation, or GRE,
is usually my go-to.
A GRE tunnel creates a logical interface
that routing policies can easily be applied to.
By default, GRE tunnels provide no encryption.
Once the tunnel is established,
IPSec can be used to encrypt the GRE traffic
as it moves between devices,
thus protecting everything that moves inside.
Securing traffic between sites
is just one piece of the puzzle.
What can be done for road warriors?
While IPSec has been used in the past,
it's far more common to use something like
the Transport Layer Security, or TLS protocol,
for these remote user sessions.
TLS is most often seen used to secure HTTPS communications.
The Cisco AnyConnect client,
which is a client software loaded on an end user's device,
creates a secure connection to a remote location using TLS.
I use VPN tunnels extensively.
In fact, I can't imagine building a network
where they aren't employed in some fashion.