DOCSLIB.ORG

Nist Sp 800-113

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Nist Sp 800-113 Special Publication 800-113 Guide to SSL VPNs Recommendations of the National Institute of Standards and Technology Sheila Frankel Paul Hoffman Angela Orebaugh Richard Park NIST Special Publication 800-113 Guide to SSL VPNs Recommendations of the National Institute of Standards and Technology Sheila Frankel Paul Hoffman Angela Orebaugh Richard Park C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 July 2008 U.S. Department of Commerce Carlos M. Gutierrez, Secretary National Institute of Standards and Technology James M. Turner, Deputy Director GUIDE TO SSL VPNS Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-113 Natl. Inst. Stand. Technol. Spec. Publ. 800-113, 87 pages (July 2008) Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessa rily the best available for the purpose. ii GUIDE TO SSL VPNS Acknowledgements The authors, Sheila Frankel of the National Institute of Standards and Technology (NIST), Paul Hoffman of the Virtual Private Network Consortium (VPNC), and Angela Orebaugh and Richard Park of Booz Allen Hamilton, wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content, especially Elaine Barker, Jim St. Pierre and Tim Polk of NIST. The authors would like to acknowledge Tim Grance and Karen Scarfone of NIST for their keen and insightful assistance throughout the development of the document. The authors particularly want to thank Guy Snyder, Darren Hartman and Thang Phan of ICSA Labs for their careful review and valuable contributions to improving the quality of this publication. The authors would also like to express their thanks to Mike Hillhouse of Juniper Networks and Mahesh Jethanandani of Cisco for their worthwhile comments and suggestions. iii GUIDE TO SSL VPNS Table of Contents Executive Summary..............................................................................................................ES-1 1. Introduction ......................................................................................................................1-1 1.1 Authority...................................................................................................................1-1 1.2 Purpose and Scope .................................................................................................1-1 1.3 Audience ..................................................................................................................1-1 1.4 Document Structure .................................................................................................1-1 2. Network and Transport Layer Security ..........................................................................2-1 2.1 The Need for Network and Transport Layer Security...............................................2-1 2.2 Virtual Private Networking (VPN).............................................................................2-4 2.2.1 SSL Portal VPNs ..........................................................................................2-5 2.2.2 SSL Tunnel VPNs.........................................................................................2-5 2.2.3 Administering SSL VPNs..............................................................................2-5 2.3 Summary..................................................................................................................2-6 3. SSL VPN Fundamentals ..................................................................................................3-1 3.1 SSL VPN Architecture..............................................................................................3-1 3.2 SSL VPN Functions .................................................................................................3-2 3.3 SSL VPN Features and Security Services...............................................................3-3 3.3.1 Manageability ...............................................................................................3-4 3.3.2 High Availability and Scalability ....................................................................3-4 3.3.3 Portal Customization ....................................................................................3-5 3.3.4 Authentication...............................................................................................3-5 3.3.5 Encryption and Integrity Protection...............................................................3-6 3.3.6 Access Control .............................................................................................3-6 3.3.7 Endpoint Security Controls ...........................................................................3-8 3.3.8 Intrusion Prevention......................................................................................3-9 3.4 SSL Protocol Basics ................................................................................................3-9 3.4.1 Versions of SSL and TLS .............................................................................3-9 3.4.2 Cryptography Used in SSL Sessions .........................................................3-10 3.4.3 Authentication Used for Identifying SSL Servers........................................3-10 3.5 SSL VPN Challenges.............................................................................................3-11 3.6 Summary................................................................................................................3-12 4. SSL VPN Planning and Implementation.........................................................................4-1 4.1 Identify Requirements ..............................................................................................4-1 4.2 SSL VPNs and FIPS 140-2 Approval.......................................................................4-2 4.2.1 Versions of SSL............................................................................................4-3 4.2.2 Key Establishment Used by SSL..................................................................4-3 4.2.3 Hash Functions Used by SSL.......................................................................4-4 4.2.4 SSL Encryption.............................................................................................4-4 4.2.5 Certificates Used During SSL Negotiations..................................................4-4 4.3 Design the Solution..................................................................................................4-5 4.3.1 Design the Access Control Policy.................................................................4-6 4.3.2 Design the Endpoint Security Policy.............................................................4-9 4.3.3 Select the Authentication Methods .............................................................4-11 4.3.4 Design the Architecture ..............................................................................4-12 iv GUIDE TO SSL VPNS 4.3.5 Cryptography Policy and FIPS Compliance ...............................................4-23 4.3.6 Other Design Decisions..............................................................................4-23 4.3.7 Summary of Design Decisions ...................................................................4-24 4.4 Implement and Test Prototype...............................................................................4-25 4.4.1 Application and Client Interoperability ........................................................4-27 4.5 Deploy the Solution................................................................................................4-28 4.6 Manage the Solution ..............................................................................................4-29 4.7 Summary................................................................................................................4-30 5. SSL VPN Recommended Practices ................................................................................5-1 6. Alternatives to SSL VPNs................................................................................................6-1 6.1 Data Link Layer VPN Protocols ...............................................................................6-1 6.2 Network Layer VPN Protocols .................................................................................6-2
Load more

Recommended publications
  • Your Performance Task Summary Explanation
    Lab Report: 13.3.4 Configure Remote Wipe Your Performance Your Score: 0 of 1 (0%) Pass Status: Not Passed Elapsed Time: 17 seconds Required Score: 100% Task Summary Actions you were required to perform: In Remotely wipe Maggie's iPad Explanation In this lab, your task is to assist Maggie with a remote wipe as follows: Log in to icloud.com using the following credentials: Apple ID: [email protected] Password: maggieB123 Using Find iPhone, select her iPad and erase it. Enter a phone number and message to be displayed on the iPad. Complete this lab as follows: 1. In the URL field in Chrome, enter icloud.com and press Enter. 2. Maximize the window for easier viewing. 3. In the Sign in to iCloud field, enter [email protected] and press Enter. 4. Enter maggieB123 and press Enter. 5. Select Find iPhone. 6. Select All Devices. 7. Select Maggie's iPad. 8. Select Erase iPad. 9. Select Erase. 10. In the Enter AppleID to continue field, enter [email protected] and press Enter. 11. Enter maggieB123 and press Enter. 12. In the Number field, enter a phone number of your choosing to be displayed on the iPad. 13. Click Next. 14. Enter a message of your choosing to be displayed on the iPad. 15. Click Done. 16. Click OK. Lab Report: 13.3.6 Require a Screen Saver Password Your Performance Your Score: 0 of 3 (0%) Pass Status: Not Passed Elapsed Time: 8 seconds Required Score: 100% Task Summary Actions you were required to perform: In Enable the screen saver In Enable the screen saver after 10 minutes In Show the logon screen when the computer wakes Explanation In this lab, your task is to complete the following: Enable the screen saver (you choose the screen saver type to use).
    [Show full text]
  • Ipv4 WAN (Internet) Layer 2 Tunneling Protocol (L2TP) Configuration on RV120W and RV220W
    IPv4 WAN (Internet) Layer 2 Tunneling Protocol (L2TP) Configuration on RV120W and RV220W Objectives Layer 2 Tunneling Protocol (L2TP) establishes a Virtual Private Network (VPN) that allows remote hosts to connect to one another through a secure tunnel. It does not provide any encryption or confidentiality by itself but relies on an encryption protocol that it passes within the tunnel to provide privacy. One of its biggest advantages is that it encrypts the authentication process which makes it more difficult for someone to "listen in" on your transmission to intercept and crack the data. L2TP does not only provide confidentiality but also data integrity. Data integrity is protection against modification of date between the time it left the sender and the time it reached the recipient. This document explains how to configure the IPv4 WAN (Internet) for use with Layer 2 Tunneling Protocol (L2TP) on the RV120W and RV220W. Applicable Devices • RV120W • RV220W Software Version • v1.0.4.17 IPv4 WAN (Internet) L2TP Configuration Step 1. Log in to the web configuration utility and choose Networking > WAN (Internet) > IPv4 WAN(Internet). The IPv4 WAN (Internet) page opens: Step 2. Choose L2TP from the Internet Connection Type drop-down list. Step 3. Enter the username provided from ISP in the User Name field. Step 4. Enter the password provided from ISP in the password field. Step 5. (Optional) Enter the secret pass phrase if provided by the ISP in the Secret field. Step 6. Click the desired radio button for the Connection Type: • Keep Connected — This keeps the device connected to the network for all the time.
    [Show full text]
  • Express Vpn for Windows 10 Download How to Get an Expressvpn Free Trial Account – 2021 Hack
    express vpn for windows 10 download How to Get an ExpressVPN Free Trial Account – 2021 Hack. The best way to make sure ExpressVPN is the right VPN for you is to take it for a test drive before you commit and make sure its features fit your needs. Unlike some other VPNs, ExpressVPN doesn’t have a standard free trial. But it does have a no-questions-asked, 30-day money-back guarantee. So you can test out the VPN with no limitations, risk-free. If at any point during those 30 days, you decide that ExpressVPN isn’t right for you, you can just request a refund. This is super simple: I’ve tested it using several accounts, and got my money back every time. ExpressVPN Free Trial : Quick Setup Guide. It’s easy to set up ExpressVPN and get your 30 days risk-free. Here’s a step-by-step walkthrough that will have you ready in minutes. Head over to the ExpressVPN free trial page, and select, “Start Your Trial Today” to go right to their pricing list. Choose your subscription plan length, and then enter your email address and payment details. Note that longer plans are much cheaper. ExpressVPN’s long-term plans are the most affordable. It’s easy to download the app to your device. The set up for the ExpressVPN app is simple, and fast. Request a refund via live chat. Try ExpressVPN risk-free for 30-days. Free Trial Vs. Money-Back Guarantee. The trial period for ExpressVPN is really a 30-day money-back guarantee, but this is better than a free trial.
    [Show full text]
  • Application Note
    Remote Access Serial Communications - Serial Server RFL eXmux 3500® IP Access Multiplexer The RFL eXmux 3500 is a hardened IP Access Multiplexer engineered for mission critical infrastructures that seamlessly transport voice, serial, video and Ethernet data communications over Ethernet/IP or MPLS networks. The eXmux 3500 is a Layer 2 device with an integrated managed Ethernet switch which allows the eXmux 3500 to be used either in a private network with other eXmux 3500’s or as part of a larger Ethernet/IP/MPLS network. Both fiber (using SFPs) and RJ-45 connections are available for the eXmux 3500; uplink speeds of up to a Gigabit are possible. This application note illustrates the eXmux-3500 IP access multiplexer basic remote access communications with remote devices that has serial (RS232, DB9) interface functionality using the Serial Server IU as depicted in Figure 1 below. LAN 1 LAN 2 PC-1 PC-2 IP Address=10.10.12.100 Remote Access Using Serial Server IP Address=10.10.11.100 ethernet ethernet Ethernet/IP Network P1 P5 P5 P1 SSrv Port 1 eXmux 3500-1 eXmux 3500-2 SSrv Port 2 IP address=10.10.12.12 IP Address=10.10.11.12 RS-232 comm port RS-232 comm port Figure 1…Remote Access Communication Topology Serial Server IU Implementation The Serial Server (SSrv) is an IP-based interface unit (IU) of the eXmux 3500 that supports remote communications to a serial device connected either RS-232 or RS-485/4W using either standard Telnet (Unsecured) or SSH (Secure Shell - Tunneling) IP applications.
    [Show full text]
  • Microsoft DNS
    1 a. Domain Name Service (DNS) encompassing Microsoft DNS From Wikipedia, the free encyclopedia Jump to: navigation, search Microsoft DNS is the name given to the implementation of domain name system services provided in Microsoft Windows operating systems. Contents [hide] 1 Overview 2 DNS lookup client o 2.1 The effects of running the DNS Client service o 2.2 Differences from other systems 3 Dynamic DNS Update client 4 DNS server o 4.1 Common issues 5 See also 6 References 7 External links [edit] Overview The Domain Name System support in Microsoft Windows NT, and thus its derivatives Windows 2000, Windows XP, and Windows Server 2003, comprises two clients and a server. Every Microsoft Windows machine has a DNS lookup client, to perform ordinary DNS lookups. Some machines have a Dynamic DNS client, to perform Dynamic DNS Update transactions, registering the machines' names and IP addresses. Some machines run a DNS server, to publish DNS data, to service DNS lookup requests from DNS lookup clients, and to service DNS update requests from DNS update clients. The server software is only supplied with the server versions of Windows. [edit] DNS lookup client Applications perform DNS lookups with the aid of a DLL. They call library functions in the DLL, which in turn handle all communications with DNS servers (over UDP or TCP) and return the final results of the lookup back to the applications. 2 Microsoft's DNS client also has optional support for local caching, in the form of a DNS Client service (also known as DNSCACHE). Before they attempt to directly communicate with DNS servers, the library routines first attempt to make a local IPC connection to the DNS Client service on the machine.
    [Show full text]
  • GPRS Tunneling Protocol (GTP) Processing
    TECHNOLOGY BRIEF GPRS Tunneling Protocol (GTP) Processing GPRS Tunneling Protocol or GTP for short is a mechanism used exclusively in cellular SUMMARY networks to tunnel IP packets through a mobile network core. The protocol was Comprehensive discussion of GTP introduced in the late 1990s when the first generation of packetized data—known protocol and how an Accolade as General Packet Radio Services or GPRS—was adopted. GPRS is often referred to adapter can help with GTP as 2.5G because it runs over GSM (2nd Generation or 2G mobile technology). GTP deduplication has moved on from those humble beginnings and is used in an updated form in KEY POINTS both 4G (LTE) and emerging 5G cellular networks. The main benefit of GTP is that • GTP is used exclusively in mobile a user’s IP address can be decoupled from routing and related decisions within networks a mobile network core. This is what allows a cellular customer to move around • Accolade ANIC adapters can fully from base station to base station and still maintain uninterrupted connectivity parse GTP packets and offer to external networks such as the Internet. It also allows for multiple services such value added capabilities such as as VoLTE (Voice over LTE) to be provisioned on the same device. In short, GTP is a deduplication crucial tunneling protocol that is indispenable in all modern mobile networks. HOW IT WORKS Figure 1 depicts a mobile phone (referred to as “user equipment” or “UE” in the industry) accessing an Internet web server with IP address 74.125.71.104. The phone or UE is initially connected to base station #1 (referred to as an eNodeB or “eNB” in LTE) and generates a simple IP packet to access the web server.
    [Show full text]
  • Iclab: a Global, Longitudinal Internet Censorship Measurement Platform
    ICLab: A Global, Longitudinal Internet Censorship Measurement Platform Arian Akhavan Niaki∗y Shinyoung Cho∗yz Zachary Weinberg∗x Nguyen Phong Hoangz Abbas Razaghpanahz Nicolas Christinx Phillipa Gilly yUniversity of Massachusetts, Amherst zStony Brook University xCarnegie Mellon University {arian, shicho, phillipa}@cs.umass.edu {shicho, nghoang, arazaghpanah}@cs.stonybrook.edu {zackw, nicolasc}@cmu.edu Abstract—Researchers have studied Internet censorship for remains elusive. We highlight three key challenges that must nearly as long as attempts to censor contents have taken place. be addressed to make progress in this space: Most studies have however been limited to a short period of time and/or a few countries; the few exceptions have traded off detail Challenge 1: Access to Vantage Points. With few ex- for breadth of coverage. Collecting enough data for a compre- ceptions,1 measuring Internet censorship requires access to hensive, global, longitudinal perspective remains challenging. “vantage point” hosts within the region of interest. In this work, we present ICLab, an Internet measurement The simplest way to obtain vantage points is to recruit platform specialized for censorship research. It achieves a new balance between breadth of coverage and detail of measurements, volunteers [37], [43], [73], [80]. Volunteers can run software by using commercial VPNs as vantage points distributed around that performs arbitrary network measurements from each the world. ICLab has been operated continuously since late vantage point, but recruiting more than a few volunteers per 2016. It can currently detect DNS manipulation and TCP packet country and retaining them for long periods is difficult. Further, injection, and overt “block pages” however they are delivered.
    [Show full text]
  • EDS3000 Device Server Command Reference EDS3008/16/32PR EDS3008/16PS
    EDS3000 Device Server Command Reference EDS3008/16/32PR EDS3008/16PS Part Number PMD-00014 Revision B December 2020 Intellectual Property © 2021 Lantronix, Inc. All rights reserved. No part of the contents of this publication may be transmitted or reproduced in any form or by any means without the written permission of Lantronix. Lantronix is a registered trademark of Lantronix, Inc. in the United States and other countries. Patented: http://patents.lantronix.com; additional patents pending. Windows is a registered trademark of Microsoft Corporation. Wi-Fi is registered trademark of Wi-Fi Alliance Corporation. All other trademarks and trade names are the property of their respective holders. Warranty For details on the Lantronix warranty policy, please go to our web site at www.lantronix.com/support/warranty. Contacts Lantronix, Inc. 7535 Irvine Center Drive Suite 100 Irvine, CA 92618, USA Toll Free: 800-526-8766 Phone: 949-453-3990 Fax: 949-453-3995 Technical Support Online: www.lantronix.com/support Sales Offices For a current list of our domestic and international sales offices, go to the Lantronix web site at www.lantronix.com/about/contact. Disclaimer All information contained herein is provided “AS IS.” Lantronix undertakes no obligation to update the information in this publication. Lantronix does not make, and specifically disclaims, all warranties of any kind (express, implied or otherwise) regarding title, non-infringement, fitness, quality, accuracy, completeness, usefulness, suitability or performance of the information provided herein. Lantronix shall have no liability whatsoever to any user for any damages, losses and causes of action (whether in contract or in tort or otherwise) in connection with the user’s access or usage of any of the information or content contained herein.
    [Show full text]
  • DESIGN ALTERNATIVES for Virtual Private Networks
    DESIGN ALTERNATIVES FOR Virtual Private Networks G.I. Papadimitriou1, M. S. Obaidat2, C. Papazoglou3 and A.S. Pomportsis4 1Department of Informatics, Aristotle University, Box 888, 54124 Thessaloniki, Greece 2Department of Computer Science, Monmouth University, W. Long Branch, NJ 07764, USA 3Department of Informatics, Aristotle University, Box 888, 54124 Thessaloniki, Greece 4Department of Informatics, Aristotle University, Box 888, 54124 Thessaloniki, Greece Keywords. Virtual private networks (VPNs), PPTP, L2TP, IPSec, tunneling, encryption, SSL, QoS Abstract. Virtual private networks (VPNs) are becoming more and more important for all kinds of businesses with a wide spectrum of applications and configurations. This paper presents the basic concepts related to VPNs. These include the different types of VPN services, namely Intranet, Extranet and Remote Access VPNs. The concept of tunneling, which is fundamental in VPNs, is discussed in great detail. The tunneling protocols that are employed by VPNs, such as PPTP, L2TP and IPSec are also presented. Furthermore, the issue of Quality of Service, QoS, support in VPN configurations is briefly addressed. 1 Introduction The best way to come up with a definition of the term Virtual Private Network (VPN) is to analyze each word separately. Having done that, Ferguson and Huston (1998) came up with the following definition: A VPN is a communications environment in which access is controlled to permit peer connections only within a defined community of interest, and is constructed through some form of partitioning of a common underlying communications medium, where this underlying communications medium provides services to the network on a non-exclusive basis. Ferguson and Huston also provided a simpler and less formal description.
    [Show full text]
  • Firewalls and Vpns
    Firewalls and VPNs Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-17/ Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 23-1 Overview 1. What is a Firewall? 2. Types of Firewalls 3. Proxy Servers 4. Firewall Location and Configuration 5. Virtual Private Networks These slides are based on Lawrie Brown’s slides supplied with William Stalling’s th book “Cryptography and Network Security: Principles and Practice,” 7 Ed, 2017. Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 23-2 What is a Firewall? Interconnects networks with differing trust Only authorized traffic is allowed Auditing and controlling access Can implement alarms for abnormal behavior Provides network address translation (NAT) and usage monitoring Implements VPNs Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 23-3 Firewall Limitations Cannot protect from attacks bypassing it E.g., sneaker net, utility modems, trusted organisations, trusted services (e.g., SSL/SSH) Cannot protect against internal threats E.g., disgruntled or colluding employees Cannot protect against access via Wireless LAN If improperly secured against external use, e.g., personal hot spots Cannot protect against malware imported via laptops, PDAs, and storage infected outside Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 23-4 Firewalls – Packet Filters Examine each IP packet (no context) and permit or deny according to rules Washington University in St.
    [Show full text]
  • Wireguard in Eduvpn Report
    WireGuard in eduVPN Report Nick Aquina SURF, Utrecht Fontys University of Applied Sciences, Eindhoven INTERNSHIP REPORT FONTYS UNIVERSITY OF APPLIED SCIENCES HBO-ICT Data student: Family name, initials: Aquina, N Student number: project period: (from – till) 31 August 2020 – 22 January 2021 Data company: Name company/institution: SURF Department: Team Security Address: Kantoren Hoog Overborch, 3511 EP Utrecht, Moreelsepark 48 Company tutor: Family name, initials: Spoor, R Position: (Tech) Product Manager University tutor: Family name, initials: Vos, A Final report: Title: WireGuard in eduVPN Date: 12 January 2021 Approved and signed by the company tutor: Date: 12 January 2021 Signature: Preface This report is written for my internship for Fontys. The internship was done at SURF for the eduVPN project. My task was to build a proof of concept in which WireGuard is integrated into eduVPN. This internship took place from September 2020 until January 2021. I would like to thank Arno Vos for his guidance and feedback throughout this internship. I would also like to thank Rogier Spoor for guiding me throughout this internship and inviting me to meetings which gave me a valuable insight into cyber security and technological issues facing members of SURF. And last, but not least, I would like to thank François Kooman for all technical support, advice and code reviews which helped improve the project. All blue text can be clicked to open a hyperlink. 1 Contents Preface . .1 Summary 4 Introduction 5 Free software . .5 The company (SURF) 6 Project 7 Context / Initial situation . .7 Project goal . .7 Assignment . .7 Constraints . .8 Development strategy .
    [Show full text]
  • Vyatta-VPN 6.5R1 V01.Pdf
    VYATTA, INC. | Vyatta System VPN REFERENCE GUIDE Introduction to VPN IPsec Site‐to‐Site VPN Virtual Tunnel Interfaces Remote Access VPN OpenVPN Vyatta Suite 200 1301 Shoreway Road Belmont, CA 94002 vyatta.com 650 413 7200 1 888 VYATTA 1 (US and Canada) COPYRIGHT Copyright © 2005–2012 Vyatta, Inc. All rights reserved. Vyatta reserves the right to make changes to software, hardware, and documentation without notice. For the most recent version of documentation, visit the Vyatta web site at vyatta.com. PROPRIETARY NOTICES Vyatta is a registered trademark of Vyatta, Inc. Hyper‐V is a registered trademark of Microsoft Corporation. VMware, VMware ESX, and VMware server are trademarks of VMware, Inc. XenServer, and XenCenter are trademarks of Citrix Systems, Inc. All other trademarks are the property of their respective owners. RELEASE DATE: October 2012 DOCUMENT REVISION. 6.5R1 v01 RELEASED WITH: 6.5R1 PART NO. A0‐0222‐10‐0016 iii Contents Quick List of Commands . xi List of Examples . xvi Preface . xvii Intended Audience . xviii Organization of This Guide . xviii Document Conventions . xix Vyatta Publications . xx Chapter 1 Introduction to VPN . 1 Types of VPNs . 2 Supported Solutions . 3 Site‐to‐Site with IPsec . 3 Virtual Tunnel Interface. 4 Remote Access Using PPTP . 4 Remote Access Using L2TP and IPsec. 5 Site‐to‐Site and Remote Access Using OpenVPN . 5 Comparing VPN Solutions. 6 PPTP. 7 L2TP/IPsec. 7 Pre‐shared keys (L2TP/IPsec) . 8 X.509 certificates (L2TP/IPsec) . 8 VPNs and NAT . 8 Chapter 2IPsec Site‐to‐Site VPN. 9 IPsec Site‐to‐Site VPN Configuration . 10 IPsec Site‐to‐Site VPN Overview.
    [Show full text]