An Overview of Remote Access Vpns: Architecture and Efficient Installation
Total Page：16
File Type：pdf, Size：1020Kb
IPASJ International Journal of Information Technology (IIJIT) Web Site: http://www.ipasj.org/IIJIT/IIJIT.htm A Publisher for Research Motivation ........ Email: [email protected] Volume 2, Issue 11, November 2014 ISSN 2321-5976 AN OVERVIEW OF REMOTE ACCESS VPNS: ARCHITECTURE AND EFFICIENT INSTALLATION DR. P. RAJAMOHAN SENIOR LECTURER, SCHOOL OF INFORMATION TECHNOLOGY, SEGi UNIVERSITY, TAMAN SAINS SELANGOR, KOTA DAMANSARA, PJU 5, 47810 PJ, SELANGOR DARUL EHSAN, MALAYSIA. ABSTRACT A Virtual Private Network (VPN) is a private data network that makes use of the public telecommunication infrastructure, maintaining privacy through the use of a tunneling protocol and security procedures. This paper presents the analysis and special performances of in communication especially the Remote Access Virtual Private Networks architectures and efficient installation to achieve by the way of secure alternative to traditional remote access is IP-based Virtual Private Networking (IP- VPN). In IP-VPNs, all connections to corporate intranets are calls to a local ISP, carried by the Internet to a corporate VPN gateway. Keywords:- VPN - Virtual Private Networks, RA-VPN - Remote Access Virtual Private Networks, ISP - Internet Service Provider, RRAS - The Routing and Remote Access Service, RADIUS - Remote Authentication Dial-In User Service. 1. INTRODUCTION A Virtual Private Network (VPN) is a public network being used for private communication. The VPN connection is an authenticated and encrypted communications channel, or tunnel, across this public network, such as the Internet. Because the network is considered insecure, encryption and authentication are used to protect data while in transit. VPN service is considered to be independent, in that client operation is transparent to the user and that all information exchanged between the two hosts World Wide Web, File Transfer Protocol, e-mail, etc. is transmitted across the encrypted channel. A Virtual Private Network (VPN) is a private data network that makes use of the public telecommunication infrastructure, maintaining privacy through the use of a tunneling protocol and security procedures. A virtual private network can be contrasted with a system of owned or leased lines that can only be used by one company. The main purpose of a VPN is to give the company the same capabilities as private leased lines at much lower cost by using the shared public infrastructure.[1]. 1.1 Routing A router is a device that manages the flow of data between network segments, or subnets. A router directs incoming and outgoing packets based on the information about the state of its own network interfaces and a list of possible sources and destinations for network traffic. By projecting network traffic and routing needs based on the number and types of hardware devices and applications used in your environment. We may decide whether to use a dedicated hardware router, a software-based router, or a combination of both. Generally, dedicated hardware routers handle heavier routing demands best, and less expensive software-based routers handle lighter routing loads. A software-based routing solution, such as RRAS in Windows, can be ideal on a small, segmented network with relatively light traffic between subnets. Enterprise network environments that have a large number of network segments and a wide range of performance requirements might need a variety of hardware-based routers to perform different roles throughout the network[1]. 1.2 Remote access By configuring RRAS to act as a remote access server, we can connect remote networks. Remote users can work as if their computers are directly connected to the network. All services typically available to a directly connected user including file and printer sharing, Web server access, and messaging are enabled by means of the remote access connection. An RRAS server provides two different types of remote access connectivity: Virtual Private Networking. A virtual private network (VPN) is a secured, point-to-point connection across a public network, such as the Internet. A VPN client uses special TCP/IP-based protocols called tunneling protocols to make a connection to a port on a remote VPN server. The VPN server accepts the connection, authenticates the connecting user and computer, and then transfers data between the VPN client and the corporate network. Volume 2, Issue 11, November 2014 Page 1 IPASJ International Journal of Information Technology (IIJIT) Web Site: http://www.ipasj.org/IIJIT/IIJIT.htm A Publisher for Research Motivation ........ Email: [email protected] Volume 2, Issue 11, November 2014 ISSN 2321-5976 Dial-Up Networking. In dial-up networking, a remote access client makes a dial-up telephone connection to a physical port on a remote access server by using the service of a telecommunications provider, such as analog telephone or ISDN. Dial-up networking over an analog phone or ISDN is a direct physical connection between the dial-up networking client and the dial-up networking server. Remote access is best defined as providing access to fixed site resources for users who are not at a fixed workstation at that same site's Local Area Network (LAN). The largest remote access user community is mobile or telecommuting users, such as a sales force or field engineering team. Figure - 1 illustrates a traditional remote access network using the Public Switched Telephone Network (PSTN) or the Integrated Services Digital Network (ISDN). Figure - 1. Traditional Remote Access (PSTN/ISDN Transport) Traditional Remote Access connectivity is achieved with users dialing into a dedicated PSTN/ISDN modem pool, maintained either by a corporate Information Systems/Information Technology staff or by the network service provider. A secure alternative to traditional remote access is IP-based Virtual Private Networking (IP-VPN). In IP- VPNs, all connections to corporate intranets are calls to a local ISP, carried by the Internet to a corporate VPN gateway[1]-[3]. 1.3 VPN Connection VPN can be broadly classified into two types of connections. They are: Remote access VPN and Site-to-site VPN. Figure - 1: Classification of VPN connection 1.3.1 Remote Access VPN A Remote Access VPN connection enables a user working at home or on the road to access a server on a private network by using the infrastructure provided by a public network, such as the Internet. From the user’s perspective, the VPN is a point-to-point connection between the client computer and the organization’s server. The infrastructure of the shared or public network is irrelevant because it appears logically as if the data is sent over a dedicated private link. 1.3.2 Site-to-Site VPN A Site-to-Site VPN connection (sometimes called a router-to-router VPN connection) enables an organization to have routed connections between separate offices or with other organizations over a public network while helping to maintain secure communications. When networks are connected over the Internet, as shown in the following figure - 2: a VPN-enabled router forwards packets to another VPN-enabled router across a VPN connection. To the routers, the VPN connection appears logically as a dedicated, data-link layer link. A Site-to-Site VPN connection the calling router authenticates itself to the answering router, and, for mutual authentication, the answering router authenticates itself to the calling router. In a Site-to-Site VPN connection, the packets sent from either router across the VPN connection typically do not originate at the routers. Site to site VPN can be further classified into two types. They are Intranet- based VPN Intranet-Based VPN and Extranet-based VPN[2]. Volume 2, Issue 11, November 2014 Page 2 IPASJ International Journal of Information Technology (IIJIT) Web Site: http://www.ipasj.org/IIJIT/IIJIT.htm A Publisher for Research Motivation ........ Email: [email protected] Volume 2, Issue 11, November 2014 ISSN 2321-5976 Figure - 2: VPN connecting two remote sites across the Internet Intranet-Based VPN : If a Company has more remote locations that it wishes to join in a single private network, it can create an Intranet VPN to connect LAN to LAN. Extranet-Based VPN : When a Company has close relationship with another company, it can build an Extranet VPN that connects LAN to LAN and allows all of the various companies to work in a shared environment. Remote access VPN can be also called as virtual private dial-up network (VPDN). This Remote access VPN establishes the User-to- LAN connection. Thus an authenticated User can logon to the VPN tunnel from anywhere using a laptop[2][3]. 2. AUTHENTICATION Authentication is the first major component of a VPN. Authentication is the process of identifying the entity ( user , router, or network device) requiring access. This authentication is often done by means of a cryptographic function, such as with challenge/response algorithms. The following sections discuss the other authentication methods[3]: Point-to-Point Tunneling Protocol Password Authentication Protocol/Challenge Handshake Protocol (PPTP- PAP/CHAP) Digital certificates RADIUS servers 2. 1 PPTP-PAP/CHAP Password Authentication Protocol (PAP) is the most insecure authentication method available today because both the username and password are sent across the link in clear text. Anyone monitoring the connection could collect and use the information to gain access to the network. The Challenge Handshake Authentication Protocol (CHAP) works as follows : 1. The client establishes a connection with the server and the server sends a challenge back to the client. 2. The client then performs a hash (mathematical) function, adds some extra information, and sends the response back to the server for verification. 3. The server looks in its database and computes the hash with the challenge. 4. If these two answers are the same, authentication succeeds. While CHAP eliminates a dictionary attack, the hashing functions could still be attacked . CHAP also supports the (user transparent) periodic challenge of the client username/password during the session to protect against wire-tapping[2][3].