VPNs Explained | Site-to-Site + Remote Access
CertBros
https://www.youtube.com/watch?v=CWy3x3Wux6o

Transkript (automatisch erstellt)

0:00 hey what's up guys welcome to serpros in this video we're going to be looking at [Music]
0:14 vpns so vpn stands for virtual private network its job is to ensure the safe delivery of data
0:24 across public networks by doing this it allows the user to send data as if they were directly connected to that private network
0:33 let me show you what i mean let's say this is your head office now your head office is where all of your business critical servers
0:41 and applications are located as well as your head office you also have a smaller branch office the smaller branch office also needs
0:50 access to your business critical servers and applications there are different connectivity options available to you for example you might use a private mpls
1:00 network this would be a great option however it comes at a price internet access however is very
1:07 affordable but there is a problem with that the public internet is full of bad guys and these bad guys
1:15 are just waiting to get their hands on your company's sweet sweet data one solution is to use a virtual private network
1:23 or vpn a vpn is often described as a tunnel your data is encrypted before it passes through the public internet
1:32 this way if one of the bad guys does get their hands on your data they won't be able to make any sense of it once your data is received
1:40 it can then be decrypted using a special key so it can be read as normal there are two main types of vpn the one you see here
1:49 is known as a site-to-site vpn this vpn connects one entire site to another entire site and is always active meaning
1:59 it's always on a site-to-site vpn needs to be configured on both networks so it's ideal for situations
2:07 like this when you have multiple remote sites but that's not always the case you may have individual users that work
2:14 from home coffee shops or anywhere else in the world these users still require access to the corporate
2:21 network but a side-to-side vpn won't work because you have no control over the networks they're connecting from
2:28 instead they can use the second type of vpn this is called a remote access vpn a remote access vpn grants access to the
2:37 corporate network but only for one device for example a user's laptop in a coffee shop this is unlike the
2:44 site-to-site vpn which connects to entire networks okay so now we know what a vpn is and the two different types let's look
2:53 at each in a bit more detail first let's start with site-to-site vpns here we have site a and site b both
3:05 sites are connected to the public internet site-to-site vpns are typically configured on either a router or a firewall
3:13 on both sites a popular site-to-site vpn is ipsec ipsec is a framework or set of rules for creating vpns over a network
3:24 it does not define any one way to create a vpn but rather allows several protocols to be used for each vpn feature
3:33 ipsec is often used for site-to-site vpns but it can also be used for remote access vpns as well once the vpn is established all devices
3:43 on each site can send data securely over the vpn so how does this work well let's say a host from site a sends
3:53 some data over to site b the router will look at this data see that it's destined for site b and
4:00 realize it needs to send this over the vpn before it can send it over the vpn though it first
4:06 needs to encrypt the data it does this by taking the original data and then the encryption key to produce the encrypted
4:15 data let's take a closer look at this when the ip packet is received it is put through an encryption formula along with the session key which was
4:25 exchanged previously once encrypted the router then encapsulates this data with the vpn
4:33 header and trailer then it adds a new ip header this new ip header will have the public ip address of the remote
4:42 site now there is a bit more to it when it comes to vpn headers and trailers but this is the general idea
4:50 when the router sends the encrypted data the data will make its way over the public internet safely to the remote site then the
4:58 encryption process is reversed again let's take a closer look the router receives the encrypted packet using that session key that has already
5:07 been exchanged the router can decrypt the data back to the original form from there the router can forward this packet onto the destination
5:19 okay so that is a site to cite vpn this is great when you want to connect one or more offices together sometimes though you need users
5:28 to be able to connect to the corporate network from anywhere in the world this could be a coffee shop on the train or working
5:36 from home during a pandemic for this situation a different type of vpn exists
5:44 remote access vpns a remote access vpn allows a single device to connect to a corporate network this could be a laptop desktop or even a
5:55 smartphone or tablet just like a site-to-site vpn a remote access vpn allows a host computer to safely send and receive encrypted
6:04 data over the public internet this is great news if you're connecting to a public wi-fi where you have no idea about who could be snooping now unlike
6:13 sites like vpns which are always running remote access vpns require an application on the host to connect back to the corporate network the
6:22 corporate network will be listening for these connection requests an example of a vpn client application is cisco anyconnect
6:30 or openvpn here is openvpn running on my computer while ipsec is used for site-to-site vpns tls is usually used for remote access vpns
6:44 tls is the same security protocol used to encrypt your web traffic when connecting to https sites it's also handy
6:52 because some public wi-fi might block ipsec ports whereas tls usually uses well-known port 443
6:59 which is generally allowed when configuring remote access vpns you need to decide if you want to use something called a
7:07 full tunnel or a split tunnel what does that mean well a full tunnel means that once connected to the vpn
7:14 all traffic from the host will be forwarded to the corporate network even if you're just browsing facebook this will all be tunneled through the
7:21 corporate network this is great if you want to enforce your corporate firewall policies now a split tunnel means that only
7:29 traffic destined for the corporate network is sent over the vpn all other traffic is rooted as normal
7:37 this is great to save bandwidth and also provide a bit more privacy to your users which one you choose is really up to you and your security needs
7:47 now just before i end this video i do want to briefly mention vpn services in recent years several companies have emerged
7:55 offering vpn services that promises to keep all of your internet usage private secure and away from hackers you've probably seen
8:03 their adverts these are like remote access vpns you connect to that company's network before they forward it over to the
8:11 internet by using these services the idea is that only the vpn provider will see your traffic so not even your isp can see what you're
8:19 doing now while there are some understandable reasons to use these services please don't get sucked into some of the
8:26 scare tactics that most of them use the reality and what they would have you believe is often quite different anyway that's enough for vpns you should
8:35 by now have a good understanding about what they are and how they work this video is part of the full ccna course which can be found
8:42 in the description so please feel free to go and check that out if you like this video then don't forget to give it a thumbs up leave a comment
8:50 and subscribe the support from you guys really does help this channel grow other than that thank you for watching