2022 Developer Survey is open! Take survey.

Hot answers tagged

37 votes
Accepted

Why use SSH and VPN in combination?

The reasoning behind your current setup is probably some combination of the following three reasons. The VPN is a security solution for outside your company's network (See #1 below). SSH however, ...
user avatar
  • 551
22 votes

Why use SSH and VPN in combination?

SSH is an extremely popular target for brute-forcing attempts. If you have an SSH server directly on the Internet, within minutes, you will see login attempts with all kinds of user names (and ...
user avatar
16 votes
Accepted

In IPsec VPN, how is the pre-shared key encrypted?

You've asked a great question. The question seems very simple, but in fact the answer is somewhat more complex. I'll do my best to answer it in a succinct manner. Also, since you mentioned ISAKMP, ...
user avatar
  • 13.9k
15 votes
Accepted

Why would a VPN require a T1?

First of all, T1 gives you around 1.5Mbit/s in both directions, not 3Mbit/s. If you're seeing 3Mbit/s, it may be bundled from two separate lines. Now, for VPN, if that's IP-based VPN as 99% of VPNs ...
user avatar
11 votes
Accepted

netstat -nr returning "0/1" -- what does that mean?

Some VPNs push the default gateway (a /0 netmask) as two /1 networks: 0/1 and 128/1. Since a more specific route always wins, this forces traffic to be routed via the VPN instead of over the default ...
user avatar
  • 15.6k
10 votes

How can I reset a VPN tunnel on a Cisco ASA?

I just came across a new way that I was never aware of before and offers the same information you find in the ASDM interface, including the feature to logoff a vpn session. Issue this for example to ...
user avatar
  • 201
10 votes

Why would a VPN require a T1?

There is no technical reason for requiring a leased line or similar for the VPN if another (cheaper) option is adequately fast and sufficiency low latency. It may be that the leased line comes with ...
user avatar
8 votes
Accepted

Backup IP for site 2 site VPN (Juniper SRX)

Junos does have DPD and you can use it in conjunction with multiple endpoint IP addresses in a single IKE tunnel. There is a bit of info about it here (which I've copied below) http://kb.juniper.net/...
user avatar
8 votes

PPPoE vs L2TP protocols

The most and noticeable different is layer of tunneling. PPPOE is a Layer 2 (Data Link Layer) tunneling protocol while L2TP is a Layer 3 (Network Layer) tunneling protocol. This means that PPPOE can ...
user avatar
  • 258
8 votes
Accepted

Is VPN a layer 3 concept?

There are layer-2 and layer-3 VPNs. "VPN" is a term used for a tunnel combined with encryption. A tunneling interface encapsulates an inner packet (or frame) in an outer packet. This inner ...
user avatar
  • 69.7k
7 votes
Accepted

Routing protocol for Large scale hub and spoke VPN

I think BGP is probably your best bet in this situation. The number of tail sites you have quickly exceeds the benefits of most IGPs. BGP would allow you to achieve all of your desired ...
user avatar
  • 5,449
7 votes
Accepted

Cisco ASA VPN with split-dns on a Windows VPN client

Experiment There is a lot of conflicting information about what actually happens on a Windows client when using split-dns. So much that I decided to gather some evidence and see where it points. I ...
user avatar
  • 884
7 votes

Why would a VPN require a T1?

Why can't we just put a VPN on a normal cable connection? You can. I VPN to the office from my phone reasonably frequently. What technology you use for the transport layer is ultimately irrelevant: ...
user avatar
7 votes

Why use SSH and VPN in combination?

The VPN allows you to connect to your employer's private network and acquire an IP address of that private network. Once you're connected to the VPN, it's like you are using one of the computers ...
user avatar
  • 1,289
7 votes

IPSec based VPN using Openswan - IP confusion

Most of your answers can be found here: http://linux.die.net/man/5/ipsec.conf To speak through them however: left will specify the IP address of the left peer, as it is seen from the right peer. ...
user avatar
  • 13.9k
7 votes
Accepted

How do VPN's forward network traffic? (Layer 3)

Take for example the GRE-Header (GRE is a protocol used to realize VPNs - its not often used as its not secure in any way, but the concept with encapsulation is nearly the same in every VPN connection ...
user avatar
  • 772
7 votes

Difference between WAN and VPN(tunnels)

Originally, WANs were mostly defined by specific layer 1/2 protocols (Frame Relay, HDLC, SONET, etc) that they used, but Ethernet has taken over, and the others are rapidly fading into history. The ...
user avatar
  • 62.1k
7 votes
Accepted

Why is VPN not a protocol?

A protocol is a set of rules for how to accomplish something, and network protocols are sets of rules for how to communicate on a network. VPN is a concept, and a VPN uses protocols to accomplish the ...
user avatar
  • 92.9k
6 votes
Accepted

Cisco IPSEC VPN fail Stage 2

Access lists aren't a problem here. The output from show cypro isakmp sa tells you that the key negotiation is failing (MM_NO_STATE). The log entry says that the hub wants to use a transform set (...
user avatar
  • 62.1k
6 votes
Accepted

Can we change peer IP of IPSec VPN tunnel in one line?

Can I change that simply by typing the following in conf t: In your example, issuing crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3 will append 0.9.8.7 6.5.4.3 to your existing peer list for ...
user avatar
  • 1,626
6 votes

In MPLS VPN, Which one become first? MPLS Label tag or VPN encapsulation?

I think your question is not truly correct. First of all, as explain here "an MPLS VPN is a VPN that is built on top of an MPLS network, usually from a service provider, to deliver connectivity ...
user avatar
  • 161
6 votes

Confused on perfect forward secrecy, someone kindly help me

The link you provided was broken, so I couldn't validate the context. But, as I contributed to the other thread, I might be in a good place to help contribute to this =). At the end of ISAKMP (Phase ...
user avatar
  • 13.9k
6 votes

How do VPN's forward network traffic? (Layer 3)

So the short answer to your question is encapsulation. Meaning there is another set of packet headers put around the packet you are sending to a website that is taken off by the VPN endpoint. Think ...
user avatar
5 votes

How can I connect two different locations through our ISP?

IPSec VPN Virtual Private Network (VPN) over the Internet with IPSec protocols for authentication and encryption. Using a Firewall w/VPN is typical here. A hub-and-spoke model is generally deployed....
user avatar
5 votes
Accepted

Split Horizon, and mGRE/NHRP

The split horizon rule is essentially: Don't advertise a route out of the same interface you learned it from. With hub and spoke networks and mGRE, the hub is connected to the spokes by a single (...
user avatar
  • 62.1k
5 votes

In IPsec VPN, how is the pre-shared key encrypted?

Your answer is in your question: The Diffie-Hellman exchange is used to generate a common key to securely exchange a common key (i.e. pre-share). See this: https://security.stackexchange.com/...
user avatar
  • 62.1k
5 votes
Accepted

After upgrading ASA, client VPN failing from site with active LAN to LAN tunnel

Yes, the device can be instructed to accept the client VPN connections from the peer that it already has an open tunnel with. This is done by updating the dynamic map to include new entries with a ...
user avatar
5 votes
Accepted

Does all IP traffic go throught a SSL VPN?

This is a feature that most VPN platforms have. It's called 'split-tunneling'. And this is up to the VPN administrator. Some decide to send all traffic through the VPN tunnel and others don't.
user avatar
5 votes

Does IPv6 remove the need for a VPN?

The primary point of IPv6 is that it restores the original idea of every device having a unique IP address, which restores the end-to-end concept of IP. NAT is a kludge to extend the life of IPv4 ...
user avatar
  • 92.9k
5 votes
Accepted

What is OpenVPN?

OpenVPN is both - software (access server and client) and protocol. The protocol uses TLS-encrypted UDP or TCP for transport. It can provide routed or bridged connections. OpenVPN can be used for ...
user avatar
  • 69.7k

Only top scored, non community-wiki answers of a minimum length are eligible