-: VPNs.
Virtual private networks, or VPNs,
allow end users to create a tunnel
over an untrusted network like the Internet
and remotely and securely connect back
to our enterprise networks.
These VPN connections provide
a layer of encryption around that connection,
creating this virtual and secure circuit
between your end user's device
and the VPN concentrator that terminates that connection
back inside our enterprise networks.
VPNs are commonly used by teleworkers
and traveling employees so that they can remotely access
the corporate resources, things like
our intranets and our file servers.
This type of VPN is what we call a remote access VPN
or a client-to-site VPN, because one person
is connecting back to the larger site.
Now, in addition to this, VPNs can also be used
to connect two different sites together.
So, instead of having to purchase
a dedicated lease line between two offices,
I can use the Internet as my transport path.
For example, if a company has a small satellite office
in Washington DC and wants to connect it back
to their headquarters out in San Francisco,
it could be less expensive to implement a site-to-site VPN
instead of having to purchase a dedicated lease line
that goes that 3,000 miles between those two cities.
Now, when you're creating a site-to-site VPN connection,
routers on both sides are going to be configured
with an encryption key and this key's going to be used
to encrypt all of the traffic between the sites
to keep it safe from prying eyes
and confidential as it goes over
that untrusted and dirty Internet between the two locations.
VPNs rely on two different protocols
when they're being operated.
One is called the point-to-point tunneling protocol
and the other one is the layer two tunneling protocol.
These are their underlying connection protocols
and we're going to discuss them both in depth when we get
to the security protocols lesson later on in this course.
For your organization to allow VPN connections, though,
you have to have a server sitting there
and answering all of those requests for connection.
If you don't want to have a dedicated server to do that,
you can, instead, buy a hardware device
known as a VPN concentrator.
Now, a VPN concentrator can allow
hundreds of simultaneous VPN connections
from all of your remote workers to easily connect
back into your company's intranet,
and this frees up your server.
One area of concern we have with VPNs is how do we ensure
that clients aren't using split tunneling?
Well, when they're using split tunneling,
what this means is that a remote worker's device
will use their own Internet connection
for their web request, but they're going to use
your VPN connection for all of their intranet requests
like your file server request.
Now, this is efficient from a bandwidth perspective,
because they don't have to send
all of their requests over the VPN to your company
and then out to the Internet and then back to the company
and then back over the VPN to get to them.
But by doing split tunneling,
you are allowing a security risk to occur.
This is because your company now has an alternate path
to the Internet because it can go from your file servers
out to the remote worker's laptop
and then out to the Internet,
bypassing a lot of your network perimeter defenses.
This can be prevented by proper configuration
of your client's VPNs, as well as utilizing
proper network segmentation for your VPN concentrator
and its connections to the Internet,
so you can avoid split tunneling
and get all the benefits of VPNS.