3

As the following picture shows, it is possible to categorize VPNs in two general categories:

  • Client-based VPNs
  • Network-based VPNs

VPNs are working in which layer of the OSI model?

When it is required to choose a VPN for implementation in a network, how can we decide which one can meet the purpose?
Other than a technical issue, there are other key-value such:

  • Cost
  • Security
  • Reliability
  • Availability of Service

How to create a matrix and figure out which one is more appropriate?

Improve this question
2
  • schoolwork is off-topic here
    – Mike Pennington
    Commented Jun 4, 2019 at 13:27
  • 1
    Nothing in the real world actually follows the OSI model. The IP services model is much closer to what OSes use, but that is still just a model that nothing is required to follow.
    – Ron Maupin ♦
    Commented Apr 27, 2020 at 13:00

2 Answers 2

Reset to default
6

Off the top of my head, the most common would be:

  • IPSEC (Internet Protocol SECurity)
  • SSL (Secure Sockets Layer)
  • PPTP (Point-to-Point Tunnelling Protocol)
  • L2TPv3 (Layer 2 Tunnelling Protocol)

As for which layers they are each working at, it really comes down to what you mean by "working".

L2TPv3, PPTP and IPSEC all establish and operate over the top of IP connections (Network Layer). PPTP uses TCP and GRE, while L2TP and IPSEC Aggressive-mode rely on UDP (all Transport Layer protocols).

SSL VPN (which isn't really standardised) relies on HTTPS/TLS depending on the implementation, so you could say it operates at the Application Layer.

Having said all this, once the tunnels have been established, they act more like Network layer interfaces, with PPTP allowing certain non-IP protocols to be tunnelled and L2TPv3 which behaves more like a Data-Link Layer interface, allowing pretty much any L2 frame to be encapsulated.

Improve this answer
5
  • 2
    ... and sshuttle and pure ssh tunneling, and MPLS VPN, and GRE VPNs, and openvpn and... there are too many to list... nor should we bother with trying... it's just a poorly-defined question
    – Mike Pennington
    Commented Jun 4, 2019 at 13:18
  • 1
    Good point on ssh - it and OpenVPN are both in the same boat as SSL VPN. I'm going to be contentious, and say I don't really count MPLS and GRE as VPNs since they aren't encrypted. Now I'll sit back and watch the fireworks ; )
    – Benjamin Dale
    Commented Jun 6, 2019 at 0:50
  • 1
    Regarding MPLS and GRE VPNs, a lot depends on the intent of the asker. However, IETF regards MPLS and GRE VPNs as real VPNs; encryption is a different requirement. See the discussion here for a citation from IETF about this debate.
    – Mike Pennington
    Commented Jun 6, 2019 at 0:56
  • 1
    Yeah, I'm all about the "P" standing for privacy, and privacy being encryption rather than just logical separation, but each to their own
    – Benjamin Dale
    Commented Jun 6, 2019 at 1:55
  • 1
    The definition of "Private": belonging to or for the use of one particular person or group of people only. VPN stands for Virtual Private Network (Private is certainly different than Privacy). Even ATM and Frame Relay were considered VPNs, but had no default encryption.
    – Mike Pennington
    Commented Jun 6, 2019 at 1:58
3

There are several types of VPNs, depending on how you count. Two of the most common are IPSec and SSL VPNs.

VPNs do not fit very well into the OSI model -- they were developed after the model was created. Also, as has been stated many times on this forum, the OSI model is just an idealized model of how things "ought to work." It's not an accurate representation of how things actually work.

Improve this answer
1
  • Your update doesn’t really change my answer.
    – Ron Trunk
    Commented Apr 26, 2020 at 12:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.