What Is a VPN?
A Virtual Private Network (VPN) creates a private, encrypted "tunnel" through a public, insecure network (usually the internet) so that two endpoints — a remote user and a company network, or two company sites — can communicate as if they were on the same local, trusted network.
VPN Architecture — the moving parts
A typical VPN deployment links a Head Office, one or more Branch/Home Offices, and telecommuters/traveling staff. Each end has a piece of VPN hardware or software:
- Head office: a VPN concentrator and a router with a VPN module
- Branch office: a router with a VPN module / its own concentrator
- Home office: a PC with VPN client software
- Telecommuter/traveler: a laptop with VPN client, often connecting via 3G/CDMA/HSDPA mobile broadband or a broadband modem
All of these talk to each other across the Internet, which acts as the (untrusted) transport medium.
Mnemonic — Why Build a VPN?
"EXTRA GLOBAL SIMPLE PRODUCTIVE SAVINGS" → the six official benefits: Extend geographic connectivity, reduce operational costs vs traditional WANs (Savings), reduce transit/travel time (Productive for remote users), Improve productivity, Simplify network topology, provide Global networking opportunities. Picture a business traveler saving money and time by tunneling in instead of flying to head office.
How a VPN Works
Establishing a VPN connection is a sequence: connect to the internet, authenticate, then tunnel securely.
Client connects to the Internet
The client willing to reach the company's network first gets basic internet connectivity (ISP, Wi-Fi, mobile data, etc.).
Client initiates a VPN connection
The client reaches out to the company's VPN server (often sitting behind, or integrated with, a firewall).
Endpoints authenticate
Before the tunnel opens, both ends must be authenticated — via passwords, biometrics, personal data, or a combination.
Secure access is granted
Once authenticated, the client can securely access resources on the company's internal network as if physically present.
An authorized host runs VPN client software that handles authorization and encryption transparently. An unauthorized host attempting the same connection is stopped — usually at a firewall with VPN capability guarding the internal network — because it can't complete authentication or doesn't hold the right encryption material.
VPN Components
Four core pieces make up any VPN deployment:
VPN Concentrators
A VPN Concentrator is a dedicated network device that creates and manages secure VPN connections — essentially a specialized VPN router. It's typically deployed to support remote-access or site-to-site VPNs at scale (e.g., the classic Cisco VPN 3000 series).
What it does with tunnels
It uses tunneling protocols to negotiate security parameters, create and manage tunnels, encapsulate and transmit/receive packets through the tunnel, and de-encapsulate them on arrival. Functionally, it's a bi-directional tunnel endpoint.
| # | Function of a VPN Concentrator |
|---|---|
| 01 | Encrypts and decrypts data |
| 02 | Authenticates users |
| 03 | Manages data transfer across the tunnel |
| 04 | Negotiates tunnel parameters |
| 05 | Manages security keys |
| 06 | Establishes tunnels |
| 07 | Assigns user addresses |
| 08 | Manages inbound/outbound data transfers as a tunnel endpoint or router |
Where it sits
In a typical network diagram, the concentrator sits between the Internet-facing router/firewall (public/untrusted segment) and the private, trusted segment holding file servers, mail servers, intranet servers, and the authentication server.
VPN Types & Categories
The two headline categories students must distinguish: Client-to-Site (Remote-Access) and Site-to-Site VPNs.
Lets individual hosts — telecommuters, mobile users — establish a secure connection to a company network over the internet. Each host runs VPN client software (or a web-based client). The VPN encrypts packets sent to the VPN gateway at the network edge. The gateway receives packets and closes the VPN connection once the transfer completes.
Extends a company's network so different physical locations can access shared resources — it connects a branch/remote office network to headquarters. Also called LAN-to-LAN or L2L VPN. Split into two sub-types: Intranet-based (between sites of one organization) and Extranet-based (between different organizations, e.g., business partners/clients).
Mnemonic — Remote-Access vs Site-to-Site
"ONE PERSON vs TWO PLACES" — Remote-Access = one person's device reaching into the network (traveler, telecommuter). Site-to-Site = two whole networks talking to each other permanently (branch ↔ HQ), like two houses connected by a permanent secret hallway instead of one visitor using a doorbell.
Hardware VPNs vs Software VPNs
A dedicated hardware VPN appliance connects routers/gateways to communicate securely over an insecure channel. Designed purely as a VPN endpoint and can link multiple LANs. Products: Cisco VPN 3000 series concentrators / 3002 hardware clients / 7600 routers, SonicWALL PRO series, Juniper NetScreen, WatchGuard Firebox X.
VPN software installed/configured on routers, servers, firewalls, or as a gateway. Advantages: no extra devices, low-cost, easy to deploy, doesn't change the target network. Disadvantages: extra processing burden on the host device, generally less secure and more attack-prone. Products: CheckPoint VPN-1, NETGEAR ProSafe VPN, Cisco AnyConnect.
Selecting an Appropriate VPN
Choose a VPN solution by weighing: Compatibility, Vendor Support, Scalability and Capacity, organizational Need, Security requirements, and Cost.
VPN Core Functionality
Three functions make a VPN a VPN: encapsulation, encryption, and authentication.
1. Encapsulation
Packets sent over a VPN are wrapped ("encapsulated") inside another packet carrying a different source/destination IP. This hides the original source and destination, protecting data integrity. Common encapsulation protocols:
- Point-to-Point Tunneling Protocol (PPTP)
- Layer 2 Tunneling Protocol (L2TP)
- Secure Shell (SSH)
- Socket Secure (SOCKS)
Originating computer 10.0.50.3 sends a packet. The VPN router encapsulates it, giving the outer packet its own address (192.168.50.1). Anyone sniffing the internal LAN sees only the router's IP as the encapsulated packet's source — the true origin (10.0.50.3) is concealed inside.
2. Encryption
Packets are encrypted to preserve confidentiality; only the holder of the correct decryption key can read them. Certificates, managed by a Certificate Authority (CA)/certificate server, are commonly used to distribute keys to VPN users at branch/home offices.
Common VPN encryption technologies:
- Triple Data Encryption Standard (3DES)
- Secure Sockets Layer (SSL)
- OpenVPN
3. Authentication
Users must authenticate before accessing VPN resources; digital certificates are a common mechanism. Common authentication techniques: IPSec, MS-CHAP, Kerberos.
Packet sent unencrypted
From the source network toward the destination VPN router.
Packet encrypted & encapsulated
The originating VPN router wraps and secures it before sending over the internet.
Authorization requested
The receiving VPN router requests authorization for the incoming tunnel/session.
Database check decides success
If successful, the packet is delivered to Network 2. If not, it's refused and an error is returned to the sender.
Mnemonic — The 3 Core VPN Functions
"WRAP IT, LOCK IT, PROVE IT" — Wrap it = Encapsulation (hide the real source/destination inside another packet). Lock it = Encryption (scramble contents so only the key-holder can read it). Prove it = Authentication (confirm you're really who you say you are before you're let in).
VPN Technologies: Trusted, Secure, Hybrid
This is a different axis of classification — not by architecture, but by how trust and encryption are handled.
Predate the universal internet. Companies leased dedicated circuits from a communications provider and used them just like private physical cables. The organization knows and controls the transmission pathway. The provider maintains integrity/security of the path — but there is no encryption. Built using ATM circuits, frame-relay circuits, or MPLS.
Emerged once the internet became the standard corporate communications medium. A vendor protocol encrypts traffic at the origin and decrypts at the destination. Even if an attacker intercepts the traffic, they cannot read it. Secure VPNs protect confidentiality/integrity of data, but — unlike trusted VPNs — they do not guarantee/control the transmission path.
Hybrid VPNs
A Secure VPN is run as a segment inside a larger Trusted VPN, forming a Hybrid VPN. The secure portion can be administered either by the customer or by the provider that supplies the trusted portion. Think of it as "encrypted island inside a leased-line ocean."
Mnemonic — Trusted vs Secure
"TRUSTED = PATH, SECURE = PACKET" — Trusted VPN cares about controlling the path (leased circuit, no encryption). Secure VPN cares about protecting the packet itself (encryption, but no control over the path it travels). Hybrid = both combined.
VPN Topologies
A VPN topology defines how peers/networks within the VPN connect to one another. Four topologies appear in the slides: Hub-and-Spoke, Point-to-Point, Full Mesh, and Star.
Mnemonic — Four Topologies
"HUB, POINT, MESH, STAR" → think of a bicycle wheel (Hub-and-spoke: everything to the center), two friends texting directly (Point-to-point: peer to peer), a spider web (Mesh: everyone to everyone), and bank branches that can't gossip with each other (Star: only to HQ, never sideways).
VPN Security Risks
Even a well-designed VPN can be undermined by these eight weaknesses:
| # | Risk |
|---|---|
| 01 | VPN Fingerprinting |
| 02 | Insecure Storage of Authentication Credentials |
| 03 | Username Enumeration Vulnerabilities |
| 04 | Offline Password Cracking |
| 05 | Man-in-the-Middle Attacks |
| 06 | Lack of Account Lockout |
| 07 | Poor Default Configurations |
| 08 | Poor Guidance and Documentation |
Exam angle
Notice these risks are mostly about authentication weaknesses (storage, enumeration, cracking, lockout) rather than the tunnel's cryptography itself — attackers usually go after the login, not the encrypted pipe.
Securing the VPN: Firewalls, IPsec, AAA, RADIUS
Firewalls
Firewalls establish a protective barrier between the VPN and the internet. Before deploying a VPN, a good firewall must already be in place. It should be configured to restrict open ports and the types of packets/protocols allowed to reach the VPN.
IPsec Server — Tunnel vs Transport Mode
The IPsec server strengthens VPN security via strong encryption and authentication algorithms. It supports two encryption modes:
Both the header and payload of each packet are encrypted. Used site-to-site, protects the whole original packet.
Only the payload of each packet is encrypted; the header stays visible. Typically used end-to-end between two hosts.
AAA Server
The AAA server establishes secure access in a remote-access VPN environment and performs three checks:
Mnemonic — AAA
"WHO, WHAT, DID" — Authentication = Who are you. Authorization = What can you do. Accounting = what you Did. Same order as a security guard checking your ID, checking your clearance level, then logging your visit in the book.
RADIUS (Remote Access Dial-In User Service)
RADIUS is the simplest way to centralize authentication in VPNs. It's a software application running on a server with access to all users in the domain. In a VPN environment, RADIUS manages both authentication and authorization, cutting total cost of ownership by managing credentials from one central location.
User attempts VPN connection
The VPN server contacts the RADIUS server.
RADIUS authenticates via a Windows domain
Using both a username and password, typically checked against a Windows domain controller.
Dial-in access is checked
If credentials are correct and dial-in access is granted, the user is allowed onto the VPN.
VPN equipment verifies conditions
The VPN gear must securely talk to the RADIUS server and confirm the user meets any additional conditions before granting network access.
VPN Client → Internet → VPN Gateway → DualShield RADIUS Server + DualShield Authentication Server → Corporate Network (Active Directory, HTTP resources).
Connecting to a VPN: SSH+PPP, SSL+PPP, and Concentrators
SSH and PPP
PPP and SSH are integrated into kernels that use VPNs, and both work well with dynamic IP addresses. While configuring multiple tunnels to a computer, every tunnel's IP address must be unique. Client and server maintain PPP processes to communicate, and PPP processes exchange data over the SSH connection.
SSL and PPP
PPP running over an SSL connection. SSL provides built-in support for host authentication via digital certificates. Establishing the connection involves an initial handshake for secure communication: "Hello" messages establish SSL version, supported cipher suites, and some random data; the key is determined separately from the handshake; then data is transferred over the link.
Connecting via a Concentrator
The concentrator is an expert mechanism that allows connections from VPN peers, validates its clients, and insists on the VPN's security policies. It reduces the operating cost of VPN administration and encryption from gateways/local hosts.
Configuring the connection: configure the concentrator, set up the client software, and require the client to use that software to use the VPN.
Exam Tips & Tricks
Site-to-Site = LAN-to-LAN / L2L
Remember these are all the same thing — an exam question might use any of the three names.
Tunnel mode encrypts everything
Tunnel mode = header + payload encrypted. Transport mode = payload only. Tunnel mode is the "fuller" protection.
Trusted VPN ≠ encrypted
A classic trick question: Trusted VPNs (leased circuits, MPLS, ATM, frame-relay) do NOT inherently encrypt data — that's the Secure VPN's job.
Star topology's single point of failure
Star topology stops lateral attacks between branches, but if the central hub goes down, ALL branches lose connectivity — a classic trade-off question.
RADIUS handles both AA
RADIUS in a VPN context does Authentication AND Authorization — remember it's not just a password checker.
VPN's 3 core functions
If asked "what makes a VPN a VPN" — the answer is always Encapsulation + Encryption + Authentication, not just encryption alone.
Quick Reference — Everything at a Glance
| Topic | Key Point |
|---|---|
| VPN | Encrypted tunnel over an insecure network (internet) linking hosts/networks securely. |
| VPN Architecture | Head office concentrator/router ↔ Internet ↔ branch/home office router or PC/laptop with VPN client. |
| How VPN Works | Connect to internet → initiate VPN → authenticate endpoints → gain secure access. |
| Why build a VPN | Extend geographic reach, cut WAN costs, reduce travel time, boost productivity, simplify topology, enable global networking. |
| VPN Components | VPN client, Network Access Server (NAS), Tunnel Terminating Device/VPN server, VPN protocol. |
| VPN Concentrator | Dedicated device/bi-directional tunnel endpoint; encrypts/decrypts, authenticates, manages keys/tunnels/addresses. |
| Remote-Access (Client-to-Site) VPN | Individual hosts (telecommuters) connect to the company network via client software and a VPN gateway. |
| Site-to-Site VPN | Connects whole networks (branch ↔ HQ); AKA LAN-to-LAN/L2L; Intranet-based or Extranet-based. |
| Hardware VPN | Dedicated appliance endpoint connecting multiple LANs (Cisco, SonicWALL, Juniper, WatchGuard). |
| Software VPN | Installed on routers/servers/firewalls; cheap & easy but adds processing load and is less secure. |
| Selecting a VPN | Base decision on compatibility, vendor support, scalability/capacity, need, security, cost. |
| Encapsulation | Wraps the original packet in a new one with a different IP to hide source/destination (PPTP, L2TP, SSH, SOCKS). |
| Encryption | Scrambles packet contents for confidentiality (3DES, SSL, OpenVPN); keys distributed via CA/certificate server. |
| Authentication | Confirms identity before granting access (IPSec, MS-CHAP, Kerberos); failed auth = packet refused + error to sender. |
| Trusted VPN | Leased circuits (ATM/frame-relay/MPLS); controls the path, but not encrypted. |
| Secure VPN | Encrypts traffic end-to-end; protects confidentiality/integrity but doesn't control the transmission path. |
| Hybrid VPN | A Secure VPN segment running inside a larger Trusted VPN. |
| Hub-and-Spoke Topology | Each spoke (branch) tunnels to a central hub (main office); optional secondary hubs for resilience. |
| Point-to-Point Topology | Two peer sites connect directly; only IPsec or IPsec/GRE; either peer can initiate. |
| Full Mesh Topology | Every peer has a unique tunnel to every other peer; redundant, no single bottleneck. |
| Star Topology | Branches connect only to HQ, never to each other; contains breaches but HQ is a single point of failure. |
| VPN Security Risks | Fingerprinting, insecure credential storage, username enumeration, offline cracking, MITM, no account lockout, poor defaults, poor documentation. |
| Firewalls + VPN | Firewall sits between VPN and internet, restricting ports/protocols before implementing a VPN. |
| IPsec Tunnel Mode | Encrypts header + payload (whole packet). |
| IPsec Transport Mode | Encrypts payload only, header stays visible. |
| AAA Server | Authentication (who), Authorization (what allowed), Accounting (what done) — used in remote-access VPNs. |
| RADIUS | Centralized VPN authentication + authorization; VPN server queries RADIUS, which checks against a domain controller/AD. |
| SSH + PPP | PPP processes communicate over an SSH connection; works well with dynamic IPs; each tunnel needs a unique IP. |
| SSL + PPP | PPP over SSL; handshake negotiates version/cipher suite; certificate-based host authentication. |
| Concentrator connection | Configure the concentrator + set up matching client software on the user's machine. |