VPNs Explained | Site-to-Site + Remote Access

Hey what's up guys welcome to CertBros. In this video we're going to be looking at VPNs. So VPN stands for virtual private network. Its job is to ensure the safe delivery of data across public networks. By doing this it allows the user to send data as if they were directly connected to that private network. Let me show you what I mean. Let's say this is your head office. Now your head office is where all of your business critical servers and applications are located. As well as your head office you also have a smaller branch office. The smaller branch office also needs access to your business critical servers and applications. There are different connectivity options available to you. For example you might use a private MPLS network. This would be a great option however it comes at a price. Internet access however is very affordable. But there is a problem with that. The public internet is full of bad guys and these bad guys are just waiting to get their hands on your company's sweet sweet data. One solution is to use a virtual private network or VPN. A VPN is often described as a tunnel. Your data is encrypted before it passes through the public internet. This way if one of the bad guys does get their hands on your data they won't be able to make any sense of it. Once your data is received it can then be decrypted using a special key so it can be read as normal. There are two main types of VPN. The one you see here is known as a site-to-site VPN. This VPN connects one entire site to another entire site and is always active meaning it's always on. A site-to-site VPN needs to be configured on both networks so it's ideal for situations like this when you have multiple remote sites. But that's not always the case. You may have individual users that work from home, coffee shops or anywhere else in the world. These users still require access to the corporate network but a site-to-site VPN won't work because you have no control over the networks they're connecting from. Instead they can use the second type of VPN. This is called a remote access VPN. A remote access VPN grants access to the corporate network but only for one device. For example a user's laptop in a coffee shop. This is unlike the site-to-site VPN which connects two entire networks. Okay so now we know what a VPN is and the two different types. Let's look at each in a bit more detail. First let's start with site-to-site VPNs. Here we have site A and site B. Both sites are connected to the public internet. Site-to-site VPNs are typically configured on either a router or a firewall on both sites. A popular site-to-site VPN is IPsec. IPsec is a framework or set of rules for creating VPNs over a network. It does not define any one way to create a VPN but rather allows several protocols to be used for each VPN feature. IPsec is often used for site-to-site VPNs but it can also be used for remote access VPNs as well. Once the VPN is established all devices on each site can send data securely over the VPN. So how does this work? Well let's say a host from site A sends some data over to site B. The router will look at this data, see that it's destined for site B and realize it needs to send this over the VPN. Before it can send it over the VPN though it first needs to encrypt the data. It does this by taking the original data and then the encryption key to produce the encrypted data. Let's take a closer look at this. When the IP packet is received it is put through an encryption formula along with the session key which was exchanged previously. Once encrypted the router then encapsulates this data with the VPN header and trailer. Then it adds a new IP header. This new IP header will have the public IP address of the remote site. Now there is a bit more to it when it comes to VPN headers and trailers but this is the general idea. When the router sends the encrypted data the data will make its way over the public internet safely to the Then the encryption process is reversed. Again let's take a closer look. The router receives the encrypted packet. Using that session key that has already been exchanged the router can decrypt the data back to the original form. From there the router can forward this packet onto the destination. Okay so that is a site-to-site VPN. This is great when you want to connect one or more offices together. Sometimes though you need users to be able to connect to the corporate network from anywhere in the world. This could be a coffee shop, on the train or working from home during a pandemic. For this situation a different type of VPN exists. Remote access VPNs. A remote access VPN allows a single device to connect to a corporate network. This could be a laptop, desktop or even a smartphone or tablet. Just like a site-to-site VPN a remote access VPN allows a host computer to safely send and receive encrypted data over the public internet. This is great news if you're connecting to a public wi-fi where you have no idea about who could be snooping. Now unlike site-to-site VPNs which are always running, remote access VPNs require an application on the host to connect back to the corporate network. The corporate network will be listening for these connection requests. An example of a VPN client application is Cisco AnyConnect or OpenVPN. Here is OpenVPN running on my computer. While IPsec is used for site-to-site VPNs, TLS is usually used for remote access VPNs. TLS is the same security protocol used to encrypt your web traffic when connecting to HTTPS sites. It's also handy because some public wi-fi might block IPsec ports whereas TLS usually uses well-known port 443 which is generally allowed. When configuring remote access VPNs you need to decide if you want to use something called a full tunnel or a split tunnel. What does that mean? Well a full tunnel means that once connected to the VPN all traffic from the host will be forwarded to the corporate network. Even if you're just browsing Facebook this will all be tunneled through the corporate network. This is great if you want to enforce your corporate firewall policies. Now a split tunnel means that only traffic destined for the corporate network is sent over the VPN. All other traffic is routed as normal. This is great to save bandwidth and also provide a bit more privacy to your users. Which one you choose is really up to you and your security needs. Now just before I end this video I do want to briefly mention VPN services. In recent years several companies have emerged offering VPN services that promises to keep all of your internet usage private, secure and away from hackers. You've probably seen their adverts. These are like remote access VPNs. You connect to that company's network before they forward it over to the internet. By using these services the idea is that only the VPN provider will see your traffic. So not even your ISP can see what you're doing. Now while there are some understandable reasons to use these services please don't get sucked into some of the scare tactics that most of them use. The reality and what they would have you believe is often quite different. Anyway that's enough for VPNs. You should by now have a good understanding about what they are and how they work. This video is part of the full CCNA course which can be found in the description. So please feel free to go and check that out. If you like this video then don't forget to give it a thumbs up, leave a comment and subscribe. The support from you guys really does help this channel grow. Other than that thank you for watching.