3.4 Virtual Private Networks & Encryption Protocols

3.4 Virtual Private Networks & Encryption Protocols

Quick Answer: Virtual Private Networks (VPNs) construct secure, encrypted tunnels across untrusted networks like the Internet. Site-to-Site VPNs connect static branch gateways, while Remote Access VPNs connect mobile endpoints. The IPsec framework relies on AH (IP 51) for unencrypted integrity and ESP (IP 50) for full payload encryption, operating in Transport Mode (payload encrypted) or Tunnel Mode (entire packet encapsulated).

Transmitting sensitive business communications across public transit networks exposes data packets to eavesdropping, unauthorized modification, and packet injection. Security technicians deploy Virtual Private Networks (VPNs) and cryptographically enforced protocols to guarantee end-to-end confidentiality, integrity, and origin authentication across untrusted boundaries.

1. Virtual Private Network (VPN) Topologies & Architecture

A Virtual Private Network (VPN) extends a private corporate network across a public infrastructure by constructing an encrypted logical tunnel. Data entering the tunnel is encrypted at one gateway or endpoint and decrypted at the receiving gateway or endpoint.

Site-to-Site VPNs vs. Remote Access VPNs

Full Tunneling vs. Split Tunneling

When configuring Remote Access VPN client profiles, security administrators must select a tunneling policy:

• Full Tunneling: All network traffic originating from the remote endpoint is encapsulated and routed through the encrypted VPN tunnel to the corporate gateway. Internet traffic is inspected by corporate firewalls before being forwarded out to the public Internet.
  • Pros: Enforces corporate security controls consistently; prevents endpoint internet exposure.
  • Cons: Consumes significant corporate gateway internet bandwidth.
• Split Tunneling: Only traffic destined for corporate internal IP addresses (10.0.0.0/8) is routed through the encrypted VPN tunnel. Personal web browsing traffic bypasses the VPN tunnel and routes directly out the endpoint's local internet connection.
  • Pros: Conserves corporate gateway bandwidth and minimizes latency.
  • Cons: Exposes the endpoint to local network threats; permits split-tunnel malware bridging.

2. The IPsec Protocol Suite Architecture

IP Security (IPsec) is a framework of open standards developed by the IETF that operates at OSI Layer 3 (Network Layer). Because IPsec operates at Layer 3, it provides transparent cryptographic protection for all higher-layer protocols (TCP, UDP, HTTP, FTP) without requiring application modifications.

Core IPsec Protocols: AH vs. ESP

IPsec relies on two primary headers to secure IP packets:

1. Authentication Header (AH - IP Protocol 51):
   • Services Provided: Data origin authentication, data integrity (via ICV hash), and anti-replay protection.
   • Confidentiality: NONE. AH does NOT encrypt data. Packets can be read in cleartext by anyone eavesdropping on the network link.
   • NAT Incompatibility: AH calculates an Integrity Check Value (ICV) over immutable fields in the outer IP header (including Source/Destination IP). When a packet crosses a NAT router, NAT alters the IP address, invalidating the AH hash. Consequently, AH is completely incompatible with NAT/PAT.
2. Encapsulating Security Payload (ESP - IP Protocol 50):
   • Services Provided: Complete data confidentiality (encryption via AES-CBC or AES-GCM), data origin authentication, data integrity, and anti-replay protection.
   • NAT Traversal (NAT-T): ESP encrypts payloads and does not include mutable outer IP header fields in its authentication hash. To cross NAT gateways, NAT-Traversal (NAT-T) encapsulates ESP packets inside UDP Port 4500 headers.

Internet Key Exchange (IKEv1 / IKEv2)

IPsec peers establish secure tunnels using IKE (UDP Port 500 / 4500):

• IKE Phase 1: Authenticates IPsec peers (using Pre-Shared Keys or RSA Digital Certificates) and negotiates a secure management channel (ISAKMP / IKE SA) using a Diffie-Hellman (DH) key exchange (e.g., DH Group 14 or Group 19/21 Elliptic Curve).
• IKE Phase 2: Negotiates specific IPsec Security Associations (IPsec SAs) governing data protection parameters (ESP encryption ciphers like AES-256-GCM, HMAC-SHA256 authentication, and SA lifetimes).

3. IPsec Modes: Transport Mode vs. Tunnel Mode

IPsec operates in two distinct encapsulation modes depending on whether data is being secured host-to-host or gateway-to-gateway.

Transport Mode

Encrypts only the Layer 4 payload (TCP/UDP segment and application data) of the IP packet. The original Layer 3 IP header is left unencrypted and intact.

• Primary Use Case: Host-to-Host communications on an internal network where intermediate routers must inspect original destination IP addresses.
• Overhead: Minimal overhead because no additional IP header is appended.

Tunnel Mode

Encrypts the entire original IP packet (Original IP Header + Layer 4 Header + Application Data). IPsec then appends a new outer IP header in front of the encrypted payload.

• Primary Use Case: Gateway-to-Gateway (Site-to-Site) and Client-to-Gateway (Remote Access) VPNs across public transit networks.
• Security Benefit: Completely hides internal network addressing schemes (e.g., internal source 10.1.5.20 sending to internal destination 10.2.8.50). Public routers see only outer gateway IP addresses (e.g., 203.0.113.1 sending to 198.51.100.1).