Skip to main content
15 votes
Accepted

netstat -nr returning "0/1" -- what does that mean?

Some VPNs push the default gateway (a /0 netmask) as two /1 networks: 0/1 and 128/1. Since a more specific route always wins, this forces traffic to be routed via the VPN instead of over the default ...
Teun Vink's user avatar
  • 17.4k
9 votes

PPPoE vs L2TP protocols

The most and noticeable different is layer of tunneling. PPPOE is a Layer 2 (Data Link Layer) tunneling protocol while L2TP is a Layer 3 (Network Layer) tunneling protocol. This means that PPPOE can ...
SuB's user avatar
  • 308
8 votes
Accepted

Is VPN a layer 3 concept?

There are layer-2 and layer-3 VPNs. "VPN" is a term used for a tunnel combined with encryption. A tunneling interface encapsulates an inner packet (or frame) in an outer packet. This inner ...
Zac67's user avatar
  • 85.4k
7 votes
Accepted

How do VPN's forward network traffic? (Layer 3)

Take for example the GRE-Header (GRE is a protocol used to realize VPNs - its not often used as its not secure in any way, but the concept with encapsulation is nearly the same in every VPN connection ...
watchme's user avatar
  • 782
7 votes

Difference between WAN and VPN(tunnels)

Originally, WANs were mostly defined by specific layer 1/2 protocols (Frame Relay, HDLC, SONET, etc) that they used, but Ethernet has taken over, and the others are rapidly fading into history. The ...
Ron Trunk's user avatar
  • 67.7k
7 votes
Accepted

Why is VPN not a protocol?

A protocol is a set of rules for how to accomplish something, and network protocols are sets of rules for how to communicate on a network. VPN is a concept, and a VPN uses protocols to accomplish the ...
Ron Maupin's user avatar
  • 99.9k
7 votes

what are the deployment scenarios for L2TP tunnel, GRE tunnel and MPLS Tunnel (l2vpn vpws)

I'm reluctant to answer this question because there are exceptions to just about any scenario. But here goes anyway. Generally speaking: MPLS is commonly used when you want to isolate the data paths ...
Ron Trunk's user avatar
  • 67.7k
6 votes

Confused on perfect forward secrecy, someone kindly help me

The link you provided was broken, so I couldn't validate the context. But, as I contributed to the other thread, I might be in a good place to help contribute to this =). At the end of ISAKMP (Phase ...
Eddie's user avatar
  • 15.1k
6 votes

How do VPN's forward network traffic? (Layer 3)

So the short answer to your question is encapsulation. Meaning there is another set of packet headers put around the packet you are sending to a website that is taken off by the VPN endpoint. Think ...
Nick Pappin's user avatar
5 votes
Accepted

Does all IP traffic go throught a SSL VPN?

This is a feature that most VPN platforms have. It's called 'split-tunneling'. And this is up to the VPN administrator. Some decide to send all traffic through the VPN tunnel and others don't.
Algeriassic's user avatar
5 votes

Does IPv6 remove the need for a VPN?

The primary point of IPv6 is that it restores the original idea of every device having a unique IP address, which restores the end-to-end concept of IP. NAT is a kludge to extend the life of IPv4 ...
Ron Maupin's user avatar
  • 99.9k
5 votes
Accepted

What is OpenVPN?

OpenVPN is both - software (access server and client) and protocol. The protocol uses TLS-encrypted UDP or TCP for transport. It can provide routed or bridged connections. OpenVPN can be used for ...
Zac67's user avatar
  • 85.4k
5 votes
Accepted

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

1 What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied: At your ...
Hung Tran's user avatar
  • 3,754
5 votes
Accepted

VLANS vs. subnets for network security and segmentation

Subnets are the IP stacks way of determining what hosts are "assumed to be on link". If an address is in the same subnet traffic will be sent directly, otherwise it will be sent to a router (by ...
Peter Green's user avatar
  • 13.4k
5 votes
Accepted

How to keep an ASA tunnel up for lifetime?

You should be able to disable this in the group policy attributes. group-policy "policy_name" attributes vpn-idle-timeout none
A-A-Ron's user avatar
  • 636
5 votes
Accepted

IPSec site-to-site with/without NAT

If one site has the internal address space of 11.11.0.0/16 and the other has 10.1.1.0/24, then technically you do not have Overlapping networks on either side of the VPN tunnel. If you want the 11.11....
Eddie's user avatar
  • 15.1k
5 votes
Accepted

Are both VPN and NAT alternative ways to provide access to a private network?

Both VPN and (destination) NAT may be used in that way. Usually, VPN is used when there's a need to access a network, secure all communication, and there's only a limited number of endpoints. VPN ...
Zac67's user avatar
  • 85.4k
5 votes

Is VPN a layer 3 concept?

Is VPN a layer 3 or 5 concept? (seems to me yes?) It's both. And it's others. The VPN software is layers 5-7, whilst commonly L3 routing is used to direct packets trough the VPN. Note that layers ...
vidarlo's user avatar
  • 346
5 votes

Why is VPN not a protocol?

As an alternative to the already excellent answer: You can distinguish protocols from higher level concepts with the following heuristic: Protocols are defined by rules Higher level concepts are ...
jonathanjo's user avatar
  • 16.3k
5 votes

Correct term for networks created for virtual machines and containers?

Under the hood, all virtualization systems, including docker, use the same mechanism: they use a software switch on the host. Such a switch can be called a "virtual switch" (but this is a bit grey ...
JFL's user avatar
  • 19.7k
5 votes
Accepted

Is it possible to build VPN remote access environment without VPN server?

VPN server is a function (or a role) that can be builtin in a router software or installed on a more generic purpose operating system (linux, windows, etc...) It is a matter of choice wether to use ...
JFL's user avatar
  • 19.7k
5 votes

Is Cisco IPsec different from ordinary IPsec?

Both Windows L2TP/IPsec and Cisco IPsec are different from ordinary IPsec. Originally the "ordinary" IPsec handshake protocol (IKEv1) did not have any features to negotiate the client's VPN ...
u1686_grawity's user avatar
5 votes
Accepted

VPNs are working in which layer of the OSI model?

Off the top of my head, the most common would be: IPSEC (Internet Protocol SECurity) SSL (Secure Sockets Layer) PPTP (Point-to-Point Tunnelling Protocol) L2TPv3 (Layer 2 Tunnelling Protocol) As for ...
Benjamin Dale's user avatar
5 votes
Accepted

What is the purpose of a VPN?

A VPN is a tunnel, usually encrypted, that connects two networks together as if they had a direct link between the two networks. Regardless of the number of hops it takes between the two networks, the ...
Ron Maupin's user avatar
  • 99.9k
5 votes
Accepted

Problem with getting IKEv1 tunnel between Cisco and Palo Alto to establish a tunnel more quickly

It seems you have a wider issue that this specific message. 10 minutes to re-established a tunnel is totally abnormal. Here is a few points you should check: don't use IKEv1 anymore, switch to IKEv2 ...
JFL's user avatar
  • 19.7k
5 votes
Accepted

Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway

The comparison as given makes the two solutions seem very similar. Most Zero Trust Network Access implementations do implement the mentioned features but tend to add additional features and components ...
FrameHowitzer's user avatar
4 votes
Accepted

Deploying an IPSEC secure-channel - isakmp SA empty

If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers. In this case there are several problems in your configuration as far as I can ...
0xc3faadd3's user avatar
4 votes

Does one need to personally manage MLPS VPN connection to have MPLS between building or can the ISP provide this connection for you?

MPLS support is only rarely a requirement for enterprise equipment, especially relatively simple setups like the one you describe. MPLS itself is usually hidden away in the carrier networks. For your ...
Jeremy Gibbons's user avatar
4 votes
Accepted

How can I disable temporarily Cisco AnyConnect user from ASDM?

From ASDM: Choose Configuration > Remote Access VPN > AAA/Local Users > Local Users. Select the user you want to configure and click Edit. In the left-hand pane, click VPN Policy. Specify the number ...
hertitu's user avatar
  • 2,658
4 votes
Accepted

Does IPv6 remove the need for a VPN?

I think your idea that consumer and mobile ISPs will give out static IPv6 is optimistic to say the least. Some may do so but many probably will not. VPNs provide two main features. They provide ...
Peter Green's user avatar
  • 13.4k

Only top scored, non community-wiki answers of a minimum length are eligible