VPNs Explained | Site-to-Site + Remote Access

Summary

This video delves into Virtual Private Networks (VPNs), explaining their role in securely transferring data across public networks. It differentiates between two VPN types: site-to-site, which connects entire networks and is always active, and remote access, designed for individual users connecting from various locations. The video outlines how data is encrypted and decrypted using protocols like IPSec for site-to-site and TLS for remote access VPNs. It also touches on the concept of full tunnel versus split tunnel configurations and cautions viewers on the use of VPN services for privacy, emphasizing the importance of understanding their true capabilities.

Takeaways

• 🔒 VPN stands for Virtual Private Network and it ensures the safe delivery of data across public networks.
• 🏢 A VPN creates a secure connection as if the user is directly connected to a private network, useful for businesses with multiple sites.
• 💼 Site-to-site VPNs are used to connect entire networks, like offices, and are always active.
• 🛂 Remote access VPNs allow individual users to connect to a corporate network securely from anywhere.
• 🔑 Data sent over a VPN is encrypted before transmission and decrypted upon receipt using a special key.
• 🛡️ IPsec is a popular protocol used for creating VPNs, suitable for both site-to-site and remote access VPNs.
• 🌐 Site-to-site VPNs are configured on routers or firewalls and work by encrypting and encapsulating data with a VPN header before sending it over the internet.
• 🔒 Remote access VPNs require a client application on the user's device and often use TLS for encryption, similar to HTTPS.
• 📡 Full tunnel VPNs route all traffic through the corporate network, while split tunnel VPNs only route traffic destined for the corporate network.
• 🌐 VPN services offered by companies are similar to remote access VPNs but are intended for personal use to keep internet usage private.

Q & A

What does VPN stand for and what is its primary function?

VPN stands for Virtual Private Network. Its primary function is to ensure the safe delivery of data across public networks by encrypting the data before it passes through the public internet, allowing users to send data as if they were directly connected to a private network.

Why might a company choose to use a VPN instead of a private MPLS network?

A company might choose to use a VPN instead of a private MPLS network because VPNs are often more affordable. While MPLS provides a dedicated and high-quality connection, it comes at a higher cost, whereas internet access, which VPNs use, is more cost-effective.

What are the two main types of VPNs discussed in the script?

The two main types of VPNs discussed in the script are Site-to-Site VPNs and Remote Access VPNs.

How does a Site-to-Site VPN differ from a Remote Access VPN in terms of connectivity?

A Site-to-Site VPN connects one entire site to another entire site and is always active, while a Remote Access VPN grants access to the corporate network but only for one device, such as a user's laptop.

What is the role of IPsec in VPNs?

IPsec is a framework or set of rules for creating VPNs over a network. It is often used for Site-to-Site VPNs but can also be used for Remote Access VPNs. IPsec does not define a single way to create a VPN but allows several protocols to be used for each VPN feature.

Can you explain the process of data encryption and decryption in a Site-to-Site VPN?

In a Site-to-Site VPN, data is encrypted by the sending router using the original data and an encryption key to produce encrypted data. The data is then encapsulated with a VPN header and trailer and a new IP header with the public IP address of the remote site. Upon receipt, the remote router uses the session key to decrypt the data back to its original form before forwarding it to the destination.

What is a full tunnel in the context of Remote Access VPNs?

A full tunnel in Remote Access VPNs means that once connected to the VPN, all traffic from the host is forwarded to the corporate network, even if it's not destined for the corporate network, such as browsing non-work-related websites.

What is a split tunnel and how does it differ from a full tunnel?

A split tunnel means that only traffic destined for the corporate network is sent over the VPN, while all other traffic is routed as normal. This differs from a full tunnel, where all traffic is sent through the VPN, regardless of its destination.

Why might a company choose to use a split tunnel configuration for Remote Access VPNs?

A company might choose to use a split tunnel configuration to save bandwidth and provide a bit more privacy to users by only routing traffic intended for the corporate network through the VPN, allowing other traffic to use the regular internet connection.

What is the purpose of VPN services offered by companies, as mentioned in the script?

VPN services offered by companies are designed to keep all of a user's internet usage private, secure, and away from hackers. Users connect to the VPN provider's network, which then forwards the traffic over the internet, with the idea that only the VPN provider can see the user's traffic, not even the user's ISP.

What advice does the script give regarding the use of commercial VPN services?

The script advises not to get sucked into the scare tactics used by many VPN service advertisements. It suggests that the reality is often different from what they would have you believe, implying that users should be discerning and understand the actual benefits and limitations of such services.