37
votes
Accepted
Why use SSH and VPN in combination?
The reasoning behind your current setup is probably some combination of the following three reasons.
The VPN is a security solution for outside your company's network (See #1 below). SSH however, ...
- 551
23
votes
Why use SSH and VPN in combination?
SSH is an extremely popular target for brute-forcing attempts. If you have an SSH server directly on the Internet, within minutes, you will see login attempts with all kinds of user names (and ...
- 499
16
votes
Accepted
In IPsec VPN, how is the pre-shared key encrypted?
You've asked a great question. The question seems very simple, but in fact the answer is somewhat more complex. I'll do my best to answer it in a succinct manner. Also, since you mentioned ISAKMP, ...
- 14.3k
15
votes
Accepted
Why would a VPN require a T1?
First of all, T1 gives you around 1.5Mbit/s in both directions, not 3Mbit/s. If you're seeing 3Mbit/s, it may be bundled from two separate lines.
Now, for VPN, if that's IP-based VPN as 99% of VPNs ...
- 4,020
14
votes
Accepted
netstat -nr returning "0/1" -- what does that mean?
Some VPNs push the default gateway (a /0 netmask) as two /1 networks: 0/1 and 128/1. Since a more specific route always wins, this forces traffic to be routed via the VPN instead of over the default ...
- 16.4k
10
votes
Why would a VPN require a T1?
There is no technical reason for requiring a leased line or similar for the VPN if another (cheaper) option is adequately fast and sufficiency low latency.
It may be that the leased line comes with ...
- 201
9
votes
PPPoE vs L2TP protocols
The most and noticeable different is layer of tunneling. PPPOE is a Layer 2 (Data Link Layer) tunneling protocol while L2TP is a Layer 3 (Network Layer) tunneling protocol. This means that PPPOE can ...
- 288
8
votes
Accepted
Is VPN a layer 3 concept?
There are layer-2 and layer-3 VPNs. "VPN" is a term used for a tunnel combined with encryption.
A tunneling interface encapsulates an inner packet (or frame) in an outer packet. This inner ...
- 76.9k
7
votes
Why would a VPN require a T1?
Why can't we just put a VPN on a normal cable connection?
You can. I VPN to the office from my phone reasonably frequently.
What technology you use for the transport layer is ultimately irrelevant: ...
7
votes
Why use SSH and VPN in combination?
The VPN allows you to connect to your employer's private network and acquire an IP address of that private network. Once you're connected to the VPN, it's like you are using one of the computers ...
- 1,299
7
votes
IPSec based VPN using Openswan - IP confusion
Most of your answers can be found here:
http://linux.die.net/man/5/ipsec.conf
To speak through them however:
left will specify the IP address of the left peer, as it is seen from the right peer. ...
- 14.3k
7
votes
Accepted
How do VPN's forward network traffic? (Layer 3)
Take for example the GRE-Header (GRE is a protocol used to realize VPNs - its not often used as its not secure in any way, but the concept with encapsulation is nearly the same in every VPN connection ...
- 782
7
votes
Difference between WAN and VPN(tunnels)
Originally, WANs were mostly defined by specific layer 1/2 protocols (Frame Relay, HDLC, SONET, etc) that they used, but Ethernet has taken over, and the others are rapidly fading into history. The ...
- 65k
7
votes
Accepted
Why is VPN not a protocol?
A protocol is a set of rules for how to accomplish something, and network protocols are sets of rules for how to communicate on a network.
VPN is a concept, and a VPN uses protocols to accomplish the ...
- 96.7k
7
votes
what are the deployment scenarios for L2TP tunnel, GRE tunnel and MPLS Tunnel (l2vpn vpws)
I'm reluctant to answer this question because there are exceptions to just about any scenario. But here goes anyway. Generally speaking:
MPLS is commonly used when you want to isolate the data paths ...
- 65k
6
votes
In MPLS VPN, Which one become first? MPLS Label tag or VPN encapsulation?
I think your question is not truly correct.
First of all, as explain here
"an MPLS VPN is a VPN that is built on top of an MPLS network, usually from a service provider, to deliver connectivity ...
- 161
6
votes
Confused on perfect forward secrecy, someone kindly help me
The link you provided was broken, so I couldn't validate the context.
But, as I contributed to the other thread, I might be in a good place to help contribute to this =).
At the end of ISAKMP (Phase ...
- 14.3k
6
votes
How do VPN's forward network traffic? (Layer 3)
So the short answer to your question is encapsulation. Meaning there is another set of packet headers put around the packet you are sending to a website that is taken off by the VPN endpoint.
Think ...
- 81
5
votes
Accepted
After upgrading ASA, client VPN failing from site with active LAN to LAN tunnel
Yes, the device can be instructed to accept the client VPN connections from the peer that it already has an open tunnel with.
This is done by updating the dynamic map to include new entries with a ...
- 615
5
votes
In IPsec VPN, how is the pre-shared key encrypted?
Your answer is in your question: The Diffie-Hellman exchange is used to generate a common key to securely exchange a common key (i.e. pre-share).
See this: https://security.stackexchange.com/...
- 65k
5
votes
Accepted
Is a VPN concentrator different from a VPN gateway?
Yes, though they are often used interchangeably.
A VPN gateway may refer to a router, firewall, or VPN Concentrator that provides Virtual Private Networks.
A VPN Concentrator is a dedicated [VPN ...
- 7,039
5
votes
Accepted
Does all IP traffic go throught a SSL VPN?
This is a feature that most VPN platforms have. It's called 'split-tunneling'.
And this is up to the VPN administrator. Some decide to send all traffic through the VPN tunnel and others don't.
- 166
5
votes
Does IPv6 remove the need for a VPN?
The primary point of IPv6 is that it restores the original idea of every device having a unique IP address, which restores the end-to-end concept of IP. NAT is a kludge to extend the life of IPv4 ...
- 96.7k
5
votes
Accepted
What is OpenVPN?
OpenVPN is both - software (access server and client) and protocol. The protocol uses TLS-encrypted UDP or TCP for transport. It can provide routed or bridged connections. OpenVPN can be used for ...
- 76.9k
5
votes
Accepted
Site-to-Site IPsec VPN tunnel with an additional remote network/subnet
1
What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied:
At your ...
- 3,754
5
votes
Accepted
VLANS vs. subnets for network security and segmentation
Subnets are the IP stacks way of determining what hosts are "assumed to be on link". If an address is in the same subnet traffic will be sent directly, otherwise it will be sent to a router (by ...
- 12.3k
5
votes
Accepted
How to keep an ASA tunnel up for lifetime?
You should be able to disable this in the group policy attributes.
group-policy "policy_name" attributes
vpn-idle-timeout none
- 536
5
votes
Accepted
IPSec site-to-site with/without NAT
If one site has the internal address space of 11.11.0.0/16 and the other has 10.1.1.0/24, then technically you do not have Overlapping networks on either side of the VPN tunnel.
If you want the 11.11....
- 14.3k
5
votes
Accepted
Are both VPN and NAT alternative ways to provide access to a private network?
Both VPN and (destination) NAT may be used in that way.
Usually, VPN is used when there's a need to access a network, secure all communication, and there's only a limited number of endpoints. VPN ...
- 76.9k
5
votes
Is VPN a layer 3 concept?
Is VPN a layer 3 or 5 concept? (seems to me yes?)
It's both. And it's others. The VPN software is layers 5-7, whilst commonly L3 routing is used to direct packets trough the VPN. Note that layers ...
- 337
Only top scored, non community-wiki answers of a minimum length are eligible