virtual private network (VPN) A technology for securely connecting a computer or network to a remote network over an intermediate network such as the Internet. Overview The term virtual private network (VPN) is used in various senses in the industry to describe a variety of technologies, but in essence it can have one of two meanings: ? Using an insecure public network such as the Internet to connect two networks (or to connect a network and a remote computer) ? Making this connection secure by employing technologies such as tunneling, authentication, and encryption The two main types of VPNs are ? Network-network: A branch office network of an enterprise is connected by a VPN to corporate headquarters. Network-network VPNs offer a low-cost alternative to deploying expensive dedicated leased lines such as T1 lines at all branch offices (corporate headquarters still requires a leased line for its VPN gateway, however, to provide enough bandwidth for its branch office VPN connections). In spite of the cost advantage, however, networknetwork VPNs have been slow to gain a foothold in the enterprise due to the proven reliability of leased lines and the relative unreliability of the Internet in comparison. ? Host-network: A mobile knowledge worker uses his or her laptop or Personal Digital Assistant (PDA) and modem to dial in to a local Internet service provider (ISP) to connect securely to a company intranet or portal using an encrypted VPN connection. Using VPNs this way has proliferated in the enterprise as it is more cost-effective than traditional remote access solutions involving modem pools, dedicated phone lines, and toll-free numbers. virtual private network (VPN) virtual private network (VPN) Architecture VPNs are based on a client/server architecture: VPN client: This system initiates the VPN connection with the VPN server. For a typical host-network VPN scenario, the remote user first establishes a dial-up connection with a local ISP to connect to the Internet, and then once online, the client contacts the VPN server to connect to the corporate intranet. VPN server: This system authenticates the VPN client, negotiates which tunneling and encryption protocols to use, and establishes the secure VPN connection. The result is the formation of a secure encrypted tunnel that connects the VPN client to the VPN server. The effect is transparent—that is, as if both client and server were on the same local area network (LAN). For the connection to work, however, the VPN client must be assigned an Internet Protocol (IP) address that makes it appear to the VPN server as if it is on the same LAN as the server. VPN clients thus generally have two IP addresses, one for the VPN connection and one for the intermediate or transit network (the Internet). Two VPN tunneling protocols are in use today: Microsoft Corporation’s Point-to-Point Tunneling Protocol (PPTP) and Cisco Systems’ Layer 2 Tunneling Protocol (L2TP). Both protocols are essentially extensions of the industry standard Point-to-Point Protocol (PPP) and are used to encapsulate PPP frames within IP datagrams for transmission over the Internet. In other words, VPNs employ two layers of encapsulation: ? First the IP datagrams from the client and server are encapsulated with PPP headers to form PPP frames for transmission through the serial interface to the modem or leased line. ? Then the PPP frames are encapsulated again with IP headers (and PPTP or L2TP headers) to form IP packets for routing over the Internet. The result of using PPTP or L2TP is to create a virtual PPP connection between the VPN client and server. In short, the VPN connection behaves as if it were a dedicated point-to-point serial link but packets are actually routed across the Internet. How a VPN connection works between a network and a remote host. Note that L2TP does not include a mechanism for encrypting VPN communications, so it must be combined with Internet Protocol Security (IPsec) when used to create a VPN connection. Implementation VPNs are typically implemented in one of two ways: Customer premises equipment (CPE): Here the VPN server is owned and operated by the private company and is located at the periphery of their corporate LAN. Such VPN servers may be routers, access servers, firewall appliances, or standard PC servers running VPN-enabled software such as Microsoft Windows 2000 Server. ? Service provider: Corporate VPN needs can also be outsourced to VPN service providers, typically telcos, ISPs, or application service providers (ASPs). The service provider maintains the VPN server at the edge of its own network and parcels out VPN services to companies on a monthly leased basis. In this scenario the customer only requires a standard “dumb” router for Internet access at its end, not a VPN-enabled router. A third kind of VPN implementation involves using permanent virtual circuits (PVCs) carrying IP over public frame relay networks. This method is employed mainly for enterprise network-network VPNs. Marketplace A popular Linux-based VPN/firewall appliance is VelociRaptor from Cobalt Networks, which employs Cobalt’s hardware and Raptor’s firewall software to provide a secure VPN solution for the small business and remote office markets. Another popular VPN appliance is the Alcatel 7137 Secure VPN Gateway, originally developed by TimeStep (now part of Alcatel). Cisco Systems offers many different VPN-enabled routers and access servers, including the Cisco VPN 3005 Concentrator, which supports up to 100 concurrent users. For the Small Office/Home Office (SOHO) business environment, the Cisco PIX Firewall 506 is a small unit the size of a pocketbook that can support 10 simultaneous VPN connections. Another market contender is the VPN-1 Appliance from Check Point Software Technologies, which includes their widely used Firewall-1 product bundled in a Nokia appliance. Check Point also offers a VPN-1 Gateway for high-end corporate VPN connectivity. 3Com Corporation, Avaya, CoSine Communications, Data Fellows Corporation, Indus River Networks, Intel Corporation, Lucent Technologies, RadGuard, RedCreek Communications, and many other companies offer VPN solutions ranging from VPN gateways and appliances to software products. Examples of service providers offering standard IP VPN services include Aventail Corporation, Genuity, UUNET, Qwest Communications International, and others. Providers of frame relay-based VPN services include AT&T, Equant, Infonet, MCI/Worldcom, Sprint Corporation, and others. Telera offers a nationwide Voice over IP (VOIP)-enabled managed VPN that employs VPN gateways stationed at colocation centers around the United States. Prospects The future of network-network VPNs and corporate host-network VPN gateways may be Digital Subscriber Line (DSL), a technology that provides high-speed Internet access at costs vastly lower than leased lines such as T1 lines. The main issue with most enterprises is that DSL has yet to prove itself as reliable a technology as the more costly leased lines, which are a mature technology that has been around for many years. Nevertheless, the combination of a DSL connection with VPN software to provide security is a tantalizing one for IT departments in times of shrinking budgets. Notes Although VPNs typically use the Internet as their transit network, it is also possible to run a VPN over a corporate IP LAN to create a “LAN within a LAN” for secure communications across the network. For More Information Visit the VPN Consortium at www.vpnc.org. See Also: application service provider (ASP), Digital Subscriber Line (DSL), firewall, frame relay, Internet, Internet Protocol Security (IPsec), Internet service provider (ISP), Layer 2 Tunneling Protocol (L2TP), permanent virtual circuit (PVC), Point-to-Point Protocol (PPP), Point-to-Point Tunneling Protocol (PPTP), T1, wide area network (WAN)