Instructor: In this lesson,
we're going to cover all the things you need to know
about a VPN for your exam.
First, what is a VPN?
Well, a VPN is a virtual private network,
and it's going to be used to extend a private network
across a public network and enable users
to send and receive data across that shared public network
as if their computing devices were directly connected
to the private network.
Now with a VPN, your users can work in a remote office
or work from home, and they can telecommute
simply by logging into their laptop
and establishing a secure VPN tunnel
to the organization's network,
regardless of where it sits in the world.
To do this, they're going to connect to a VPN device sitting
at the headquarters data center.
And then, they're going to establish a secure tunnel
using a VPN protocol in order to allow a secure connection
for that corporate user over an untrusted or public network,
something like the internet.
Now, this allows 'em to then reach
into the corporate network and be connected to the internet
as if they were sitting right at their desk in their office.
VPNs can be configured as a site-to-site VPN,
a client-to-site VPN, or a clientless VPN.
With a site-to-site VPN,
we can connect two offices together.
With a client-to-site VPN,
we're more concerned with connecting a single remote user
back to a corporate network,
as I described earlier with the user
who needed to telecommute.
When we talk about a clientless VPN,
these are usually going to be used with web browsing.
All right, let's dive a little bit deeper and talk
about a site-to-site VPN.
Now a site-to-site VPN is used to interconnect two sites,
and provide an inexpensive alternative
to dedicated leased lines.
For example, let's pretend
I have a branch office in California
and my headquarters is in Washington, DC.
Now, if I want to be able to connect my remote regional office
in California to my headquarters office in Washington, DC,
I could buy a dedicated lease line
from a telecommunications provider,
and they would give me a direct connection that covers
over 3,000 miles in distance between these two sites.
Even if I got a low speed T1 connection,
this would be very expensive.
Now, on the other hand, I could use a site-to-site VPN,
and I can save a lot of money.
Instead of using that dedicated leased line,
I could simply create a VPN tunnel
from the regional office
back to the headquarters over the public internet
using the internet connectivity
that's already in that office.
This solution might cost me 50 or $100 per month
for a standard cable modem,
or fiber modem service from the local ISP.
Once that VPN tunnel is established,
it's going to take all the traffic from the regional office
in California, and run it back to the headquarters
in Washington, DC over the internet
within this secure tunnel.
And then once it gets to Washington, DC,
it's going to be decrypted
and put back inside of my corporate network.
Now, when a California user
wants to go to google.com, for instance.
That data's going to go from California to Washington, DC
out the Washington, DC's office internet connection
to visit that website,
get the information,
send it back to the Washington, DC's
office internet connection,
and then back through the VPN to that California user
where they'll be able to view the website they requested.
By using this site-to-site VPN,
all the traffic that goes back and forth
between California and Washington
is going to be encrypted and secure.
So no one can see the internal network traffic
that's going through
this external public internet connection.
Now, when we deal with a client-to-site VPN
on the other hand,
we're going to be sending data from a single host
like a laptop or cell phone or smartphone or tablet,
and connecting it back to our headquarters office.
This is going to be done instead
of going from router-to-router,
we're going from client-to-router.
This allows a remote user to be able to connect back
to the head office.
And that's why we call it a client-to-site.
Now, in addition to site-to-site and client-to-site VPNs,
we also have to decide whether or not we're going to use
a full tunnel or a split tunnel VPN configuration.
Both full tunnel and split tunnel VPNs
can be used with either a site-to-site
or client-to-site model.
Now a full tunnel VPN is usually used
by default in most organizations.
And it's what I described earlier.
With a full tunnel VPN, we're going to route and encrypt
all the traffic requests through the VPN connection
back to the headquarters,
regardless of where the destination
of that service is located.
This is considered more secure,
but when we're connected using a full tunnel,
the clients are considered to be fully part
of the headquarters network when they're connected.
This means if you're trying to access a local area resource
like a wireless printer in your home office,
you're not going to be able to do that
because that wireless printer in your home office
is not connected to the headquarters network
like your laptop is over that client-to-site VPN.
Conversely though, you can still print to the printers
in the headquarters office,
even if you're connected using a full tunnel VPN
because you could be sitting in a hotel room halfway
around the world, but logically, you're still sitting
in your office at the corporate headquarters.
Now, a split tunnel VPN on the other hand
is going to divide your traffic and network request,
and then route them
to the appropriate connection or network.
With a split tunnel VPN,
we're going to route and encrypt the traffic bound
for the headquarters over the VPN,
and we're going to send all the other traffic
out the regular internet.
So let's pretend that I'm using a client-to-site VPN
on my laptop with a split tunnel configuration
from my home office.
The VPN here is going to decide which traffic
goes back over the VPN,
and gets sent over to the headquarters
and what traffic goes over the internet.
So if I'm trying to access a file server
or a Microsoft Exchange Mail Server
that's back on the headquarters network,
those packets will get encrypted
and routed over the VPN to the headquarters.
But if I need to attend a Zoom conference
or access Office 365 or traffic outbound for the internet,
I'm simply going to bypass that encrypted VPN connection,
and go directly out my internet connection
to those public websites.
Now, this is why we call it a split tunnel
because we have an encrypted VPN tunnel for traffic
that needs to go to the headquarters,
and another unencrypted tunnel that takes a direct path
out to the internet from your ISP.
The challenge when using a split tunnel
is that they can be less secure
because there is a possibility that an attacker
could connect to your device over
that unencrypted internet tunnel,
and then they could pivot through your laptop
and send data over the VPN,
back to the headquarters network.
For this reason, if you're connecting the VPN
over an untrusted network, like Wifi at a hotel
or a coffee shop, you should never use a split tunnel.
And instead, you should be using a full tunnel.
Now, a split tunnel does give you better performance
because it's going to route all your internet-based traffic
directly to those servers
and bypass the entire company headquarters network.
So as you see,
it becomes a trade-off between security and performance.
If you want more security, use a full tunnel VPN.
If you want better performance, use a split tunnel VPN.
So at this point, we've talked about two main types of VPNs,
a site-to-site VPN and a client-to-site VPN.
But there is one more type of VPN that we need to discuss.
And it's known as a clientless VPN.
Now, a clientless VPN is used to create a secure,
remote access VPN tunnel using a web browser
without requiring any software or hardware clients
to be used.
In fact, using this type of VPN
is something you do every day without even knowing it.
A clientless VPN is used by your web browser
when it makes a secure connection to an eCommerce
or other secure website using HTTPS.
This can be done using an SSL or TLS tunnel
by using those protocols.
Now SSL, or the Secure Socket Layer,
has become a bit outdated and less secure.
So most clientless VPNs are now using TLS,
which is Transport Layer Security
to provide secure web browsing over HTTPS.
So when you logged into this website to watch this video,
you had to enter your username and password,
and you saw that little green padlock
in the upper-left corner of the address bar.
That's how you knew you had a secure connection using HTTPS.
That means you're using either SSL
or TLS to create that secure, clientless VPN tunnel
from your web browser and your computer
to my servers so you can pull these videos.
Finally, remember there are three main types of VPNs:
site-to-site, client-to-site, and clientless.
Also, remember there are two methods of communication
using a VPN.
You can use full tunnel or split tunnel.