Describe IPsec remote access and site-to-site VPNs

What a VPN is and why it matters

A virtual private network (VPN) carries private traffic across a public or untrusted network, most often the Internet, in a way that keeps it confidential and unaltered. Without a VPN, a branch office connecting to headquarters over the Internet would either need an expensive dedicated leased line or would send its data in the open where anyone along the path could read it. A VPN gives the security of a private line at Internet prices.

VPN benefits the exam expects you to list:

• Confidentiality: data is encrypted so eavesdroppers see only ciphertext.
• Integrity: hashing detects any modification in transit.
• Authentication: each end proves who it is (pre-shared key or certificate) before data flows.
• Anti-replay: sequence numbers prevent an attacker from capturing packets and resending them later.
• Cost: uses cheap Internet connectivity instead of private WAN circuits.
• Scalability and flexibility: adding a site or a remote user is a configuration change, not a new circuit.

IPsec basics

IPsec (IP Security) is a suite of open-standard protocols from the IETF that provides these services at Layer 3, so it protects any application riding on IP without the application knowing. Its components:

• Encryption algorithms for confidentiality: DES and 3DES (legacy, weak), AES (128, 192, or 256-bit; the modern choice).
• Hashing (HMAC) algorithms for integrity and origin authentication: MD5 (weak), SHA (SHA-1, SHA-256, and up).
• Authentication methods for the peers: pre-shared keys (PSK) or digital certificates (RSA signatures).
• Diffie-Hellman (DH) key exchange: a method that lets two parties agree on a shared secret key over an insecure channel without ever sending the key itself. DH groups (1, 2, 5, 14, 19, 20, and so on) indicate key strength; higher is stronger.

IPsec uses two protocols to actually protect packets:

Because AH provides no confidentiality and its integrity check covers the IP header (which NAT changes), ESP is used almost universally.

IPsec has two modes:

• Transport mode: only the payload of the original IP packet is protected; the original IP header stays. Used for host-to-host protection or when another tunneling protocol (such as GRE) already provides a new header.
• Tunnel mode: the entire original IP packet, header included, is encrypted and wrapped in a brand-new IP header whose source and destination are the VPN gateways. The default for site-to-site VPNs; the internal addresses are hidden.

IKE: building the tunnel

Before any data can be encrypted, the two ends must authenticate each other and agree on algorithms and keys. That negotiation is handled by IKE (Internet Key Exchange), which runs over UDP port 500 (and UDP 4500 when NAT traversal is needed). The result of a negotiation is a security association (SA), a set of agreed parameters.

• IKE Phase 1 authenticates the peers (PSK or certificates), runs Diffie-Hellman, and creates one secure, bidirectional management channel called the ISAKMP SA or IKE SA. In IKEv1 this uses either main mode (six messages, more secure) or aggressive mode (three messages, faster).
• IKE Phase 2 negotiates, inside the protection of Phase 1, the actual IPsec SAs used to encrypt data. IPsec SAs are unidirectional, so a pair is created, one per direction. In IKEv1 this is called quick mode. Phase 2 SAs are rekeyed periodically, by time or by bytes transferred.

IKEv2 is the modern replacement for IKEv1; it is simpler (fewer messages), supports built-in NAT traversal and EAP authentication, and is what current Cisco remote-access IPsec uses. Conceptually it still has an initial exchange (like Phase 1) and child SA creation (like Phase 2).

Site-to-site IPsec VPN

A site-to-site VPN connects two networks, for example a branch and headquarters, through a tunnel built between two VPN gateways (routers or firewalls). The key idea is that the tunnel is transparent to the hosts: a PC in the branch sends a normal packet to a server at HQ; the branch router recognizes that the destination is across the tunnel (traffic is selected by an ACL or a tunnel interface), encrypts it in tunnel mode, and sends it to the HQ router’s public address; the HQ router decrypts it and forwards the original packet. No software on the PC, no user login; it is always on. Site-to-site VPNs are almost always IPsec.

A limitation: plain IPsec can protect only unicast IP traffic. It does not natively carry multicast or broadcast, which means routing protocols such as OSPF (multicast 224.0.0.5) cannot run through a bare IPsec tunnel. The standard solution is GRE over IPsec: GRE (Generic Routing Encapsulation, IP protocol 47) is a simple tunneling protocol that can encapsulate any traffic, including multicast and non-IP protocols, but provides no security. Wrapping GRE inside IPsec gives you GRE’s flexibility with IPsec’s protection. The GRE tunnel appears as a virtual Tunnel interface on the router over which OSPF or EIGRP runs normally.

For a large hub-and-spoke network, configuring a separate tunnel between every pair of sites does not scale. Cisco’s DMVPN (Dynamic Multipoint VPN) solves this with multipoint GRE, NHRP (Next Hop Resolution Protocol), and IPsec so that spokes discover each other and build tunnels on demand. Other Cisco site-to-site technologies you might see named are FlexVPN (IKEv2-based) and GETVPN. For the CCNA you only need to recognize DMVPN as a scalable, dynamic site-to-site IPsec solution.

Remote access VPN

A remote access VPN connects a single device, such as a laptop or phone, to the corporate network. The user runs VPN client software; Cisco’s client is Cisco Secure Client (formerly AnyConnect). The client builds a tunnel to a VPN headend, typically a Cisco ASA or Secure Firewall (Firepower), and the user’s device then behaves as if it were on the corporate LAN.

Remote access VPNs are commonly built with SSL/TLS (the same protocols that protect HTTPS, using TCP port 443, and sometimes DTLS over UDP for performance) because TLS passes through virtually every firewall and hotel network. They can also use IPsec with IKEv2. Unlike site-to-site, a remote access VPN is not transparent: the user must install the client, authenticate (often with MFA), and start the session, and the tunnel exists only while that user is connected.