51-10-38 DATA COMMUNICATIONS MANAGEMENT VIRTUAL PRIVATE NETWORKS: SECURE REMOTE ACCESS OVER THE INTERNET John R. Vacca INSIDE Remote User Access over the Internet; Connecting Networks over the Internet; Connecting Computers over the Intranet; User Authentication; Address Management; Data Encryption; Key Management; Multiprotocol Support; Point-to-Point Tunneling Protocol (PPTP); Layer 2 Tunneling Protocol (L2TP); IP Security Protocol (IPSec); Integrated RAS-VPN Clients; Proxy Servers; Information Technology Groups (ITGs); Secure Internet Access; High-Speed Internet Access; RAS Reporting; Internet Usage Chargeback INTRODUCTION The components and resources of one network over another network are connected via a Virtual Private Network (VPN). As shown in Exhibit 1, VPNs accomplish this by allowing the user to tunnel through the Inter- PAYOFF IDEA net or another public network in a There is no doubt about it: Virtual Private Net- manner that lets the tunnel partici- works (VPNs) are hot. Secure remote access pants enjoy the same security and over the Internet and telecommuting needs are features formerly available only in escalating. Distributed enterprise models like ex- private networks. tranets are also increasing. The use of VPN tech- nologies by enterprises or corporations require Using the routing infrastructure pragmatic, secure Internet remote access solu- provided by a public internetwork tions that must be easy to use, economical, and (such as the Internet), VPNs allow flexible enough to meet all of their changing telecommuters, remote employees needs. In this article, the reader will learn how en- terprises or corporations like Microsoft; UUnet like salespeople, or even branch of- Technologies, Inc., Telco Research, and ATCOM, fices to connect in a secure fashion Inc. are saving more than $28 million every year to an enterprise server located at the by using VPNs to do secure remote access over edge of the enterprise local area net- the Internet by their traveling employees and work (LAN). The VPN is a point-to- sales reps. The reader will also learn how to make secure Internet remote access information tech- point connection between the user’s nology (IT) solutions easy to use and easy to man- computer and an enterprise server age by telecommunications managers (TMs). 08/99 Auerbach Publications © 1999 CRC Press LLC EXHIBIT 1 — Virtual Private Network from the user’s perspective. It also appears as if the data is being sent over a dedicated private link because the nature of the intermediate in- ternetwork is irrelevant to the user. As previously mentioned, while maintaining secure communications, VPN technology also allows an en- terprise to connect to branch offices or to other enterprises (extranets) over a public internetwork (such as the Internet). The VPN connection across the Internet logically operates as a wide area network (WAN) link between the sites. In both cases, the secure connection across the inter- network appears to the user as a private network communication (de- spite the fact that this communication occurs over a public internetwork); hence the name Virtual Private Network. VPN technology is designed to address issues surrounding the current enterprise trend toward increased telecommuting, widely distributed glo- bal operations, and highly interdependent partner operations. Here, workers must be able to connect to central resources and communicate with each other. And, enterprises need to efficiently manage inventories for just-in-time production. An enterprise must deploy a reliable and scalable remote access solu- tion to provide employees with the ability to connect to enterprise com- puting resources regardless of their location. Enterprises typically choose one of the following: • an IT department-driven solution, where an internal information sys- tems department is charged with buying, installing, and maintaining enterprise modem pools and a private network infrastructure • value-added network (VAN) solutions, where an enterprise pays an outsourced enterprise to buy, install, and maintain modem pools and a telco infrastructure The optimum solution in terms of cost, reliability, scalability, flexible administration and management, and demand for connections is provid- ed by neither of these traditional solutions. Therefore, it makes sense to find a middle ground where the enterprise either supplements or replac- es its current investments in modem pools and its private network infra- structure with a less-expensive solution based on Internet technology. In this manner, the enterprise can focus on its core competencies with the assurance that accessibility will never be compromised, and that the most economical solution will be deployed. The availability of an Inter- net solution enables a few Internet connections (via Internet service providers, or ISPs) and deployment of several edge-of-network VPN server computers to serve the remote networking needs of thousands or even tens of thousands of remote clients and branch offices, as de- scribed next. VPN Common Uses The next few subsections of this article describe in more detail common VPN situations. Secure Remote User Access over the Internet. While maintaining privacy of information, VPNs provide remote access to enterprise re- sources over the public Internet. A VPN that is used to connect a remote user to an enterprise intranet is shown in Exhibit 2. The user first calls a local ISP Network Access Server (NAS) phone number, rather than mak- ing a leased-line, long-distance (or 1-800) call to an enterprise or out- sourced NAS. The VPN software creates a virtual private network between the dial-up user and the enterprise VPN server across the Inter- net using the local connection to the ISP. Connecting Networks over the Internet. To connect local area net- works at remote sites, there exist two methods for using VPNs: using dedicated lines to connect a branch office to an enterprise LAN, or a dial- up line to connect a branch office to an enterprise LAN. Using Dedicated Lines to Connect a Branch Office to an Enterprise LAN. Both the branch office and the enterprise hub routers can use a local dedicated circuit and local ISP to connect to the Internet, rather than us- ing an expensive long-haul dedicated circuit between the branch office and the enterprise hub. The local ISP connections and the public Internet are used by the VPN software to create a virtual private network between the branch office router and the enterprise hub router. Using a Dial-Up Line to Connect a Branch Office to an Enterprise LAN. The router at the branch office can call the local ISP, rather than having a router at the branch office make a leased-line, long-distance or (1-800) call to an enterprise or outsourced NAS. Also, in order to create a VPN between the branch office router and the enterprise hub router across the Internet, the VPN software uses the connection to the local ISP as shown in Exhibit 3. The facilities that connect the branch office and enterprise offices to the Internet are local in both cases. To make a connection, both cli- ent/server, and server/server VPN cost savings are largely predicated on the use of a local access phone number. It is recommended that the en- terprise hub router that acts as a VPN server be connected to a local ISP with a dedicated line. This VPN server must be listening 24 hours per day for incoming VPN traffic. Connecting Computers over an Intranet The departmental data is so sensitive that the department’s LAN is phys- ically disconnected from the rest of the enterprise internetwork in some EXHIBIT 2 — Using a VPN to Connect Remote Client Private LAN EXHIBIT 3 — Using a VPN to Connect Two Remote Sites enterprise internetworks. All of this creates information accessibility problems for those users not physically connected to the separate LAN, although the department’s confidential information is protected. VPNs allow the department’s LAN to be separated by a VPN server (see Exhibit 4), but physically connected to the enterprise internetwork. One should note that the VPN server is not acting as a router between the enterprise internetwork and the department LAN. A router would in- terconnect the two networks, thus allowing everyone access to the sen- sitive LAN. The network administrator can ensure that only those users on the enterprise internetwork who have appropriate credentials (based on a need-to-know policy within the enterprise) can establish a VPN with the VPN server and gain access to the protected resources of the depart- ment by using a VPN. Additionally, all communication across the VPN can be encrypted for data confidentiality. Thus, the department LAN can- not be viewed by those users who do not have the proper credentials. BASIC VPN REQUIREMENTS Normally, an enterprise desires to facilitate controlled access to enterprise resources and information when deploying a remote networking solution. In order to easily connect to enterprise local area network (LAN) resourc- es, the solution must allow freedom for authorized remote clients. And, in order to share resources and information (LAN-to-LAN connections), the solution must also allow remote offices to connect to each other. Finally, as the data traverses the public Internet, the solution must ensure the pri- vacy and integrity of data. Also, in the case of sensitive data traversing an enterprise internetwork, the same concerns apply. A VPN solution should therefore provide all of the following at a minimum: • Address management: the solution must assign a client’s address on the private net, and must ensure that private addresses are kept private EXHIBIT 4 — Using a VPN to Connect to Two Computers on the Same LAN Using a VPN to Connect Two • Data encryption: data carried on the public network must be ren- dered unreadable to unauthorized clients on the network • Key management: the solution must generate and refresh encryption keys for the client and server • Multiprotocol support: the solution must be able to handle common protocols used in the public network; these include Internet Protocol (IP), Internet Packet Exchange (IPX), etc.