Scribd Logo
Upload

Welcome to Scribd!

  • 21 views

    VPN Technology: Burhan Cheema CCIE#44786 1

    Uploaded by

    Burhan Cheema
    The document compares three VPN technologies: MPLS, IPsec, and SSL. It provides a table that summarizes key factors such as topology, authentication, confidentiality, scalability, management, required VPN clients, and place in the network for each technology. MPLS is described as site-to-site with hub-and-spoke or full mesh topologies. It has strong scalability and requires one-time provisioning of devices. IPsec can be site-to-site or remote access, with authentication through certificates or preshared keys. SSL is described as remote access from endpoints to load balanced head-ends, with no required management of clients.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    VPN Technology: Burhan Cheema CCIE#44786 1

    Uploaded by

    Burhan Cheema
    21 views4 pages
    The document compares three VPN technologies: MPLS, IPsec, and SSL. It provides a table that summarizes key factors such as topology, authentication, confidentiality, scalability, management, required VPN clients, and place in the network for each technology. MPLS is described as site-to-site with hub-and-spoke or full mesh topologies. It has strong scalability and requires one-time provisioning of devices. IPsec can be site-to-site or remote access, with authentication through certificates or preshared keys. SSL is described as remote access from endpoints to load balanced head-ends, with no required management of clients.

    Original Title

    VPN Technology

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document compares three VPN technologies: MPLS, IPsec, and SSL. It provides a table that summarizes key factors such as topology, authentication, confidentiality, scalability, management, required VPN clients, and place in the network for each technology. MPLS is described as site-to-site with hub-and-spoke or full mesh topologies. It has strong scalability and requires one-time provisioning of devices. IPsec can be site-to-site or remote access, with authentication through certificates or preshared keys. SSL is described as remote access from endpoints to load balanced head-ends, with no required management of clients.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    21 views4 pages

    VPN Technology: Burhan Cheema CCIE#44786 1

    Uploaded by

    Burhan Cheema
    The document compares three VPN technologies: MPLS, IPsec, and SSL. It provides a table that summarizes key factors such as topology, authentication, confidentiality, scalability, management, required VPN clients, and place in the network for each technology. MPLS is described as site-to-site with hub-and-spoke or full mesh topologies. It has strong scalability and requires one-time provisioning of devices. IPsec can be site-to-site or remote access, with authentication through certificates or preshared keys. SSL is described as remote access from endpoints to load balanced head-ends, with no required management of clients.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    You are on page 1of 4

    Burhan Cheema 1

    CCIE#44786

    VPN Technology
    The main focus of this chapter is on VPN technology, protocols, and concepts. This chapter presents a
    comparison of multiprotocol label switching (MPLS), IP security (IPsec), and Secure Socket Layer (SSL) to
    give you a good understanding about the benefits and shortfalls of choosing each technology for a VPN
    solution. This is a standalone section that can be read without working through Chapter 1, "The VPN
    Technology Promise: Secure Access from Anywhere to Anything." Even though this chapter is more
    technical in nature, it is essential for managers and CIOs of organizations considering deployment of a
    VPN solution to review this material. The comparisons in this chapter help develop an appreciation for
    the design considerations, deployment challenges, and management of technology for a successful VPN
    solution implementation.

    Choosing the Right VPN Solution—A Technology Primer

    In this technology primer, three technologies are discussed with VPN deployment in mind, and a
    comparison is provided because the main focus of this Short Cut is making a decision about how to
    implement a VPN. You can learn specifics about the technology, protocols, and concepts in detail from
    several other Short Cuts after you've made your initial decisions. This chapter helps you compare key
    factors for the following three VPN technologies before you make your implementation decision:

     MPLS
     IPsec
     SSL
     

    Note - For a detailed look at MPLS-based VPNs, consider reading MPLS and VPN
    Architectures, by Ivan Pepelnjak and Jim Guichard.
     

    For a detailed look at IPsec VPNs, consider reading IPSec VPN Design, by Vijay Bollapragada, Mohamed
    Khalid, and Scott Wainner.

    Comparison of MPLS, IPsec, and SSL Deployments

      MPLS-Based VPN IPsec-Based VPN SSL-Based VPN


    Topology Site-to-site VPN: Site-to-site VPN: Mainly Remote-access VPN:
    Hub-and-spoke or hub-and-spoke and dual Endpoint to endpoint
    full-mesh. hub for backup. with load balancing at
    Remote-access VPN: Mainly head-end.
    VPN head-end with
    redundancy.
    IPsec Session Establishes VPN Authenticates through Handshake process with
    Burhan Cheema 2
    CCIE#44786

    Authentication membership during digital certificate or extension allows clients


    provisioning, based preshared key. to initiate session with
    on logical port and Drops packets that do not virtual server.
    unique route conform to the security
    descriptor. policy.
    Defines access to a
    VPN service group
    during service
    configuration, denies
    unauthorized access.
    Confidentiality Separates traffic, Uses a flexible suite of Encrypts traffic using
    which achieves same encryption and tunneling standard symmetric
    results delivered in mechanisms at the IP ciphers.
    trusted Frame Relay network layer.
    or ATM network
    environments.
    Service-Level Enables SLA with a Does not address QoS and Not applicable; service
    Agreements scalable, robust QoS SLA directly, although Cisco provider network is
    Based on mechanism and IPsec VPN deployments can unaware of SSL traffic.
    Quality of traffic engineering preserve packet
    Service capability. classification for QoS within
    an IPsec tunnel.
    Scalability Highly scalable Site-to-site VPN; Acceptable Load-balancing required
    because no site-to- scalability in most typical at the head-end because
    site peering is hub-and-spoke SSL requires point-to-end
    required. deployments. point connection.
    Capable of Scalability becomes Not applicable on the
    supporting tens of challenging for a very large, client site because
    thousands of VPNs fully meshed IPsec VPN service provider network
    over the same deployment; may require is unaware of SSL traffic.
    network. supplemental planning and
    coordination to address key
    distribution, key
    management, and peering
    configuration.
    Remote-access VPN:
    Scalability at the head-end
    is addressed with VPN
    concentrator type of
    device.
    Burhan Cheema 3
    CCIE#44786

    Management MPLS monitoring, Reduces operational No need to manage


    traffic engineering expense through client, because SSL
    required. centralized network-level support is standard from
    Requires one-time provisioning for IPsec VPN endpoints.
    provisioning of terminating on CPE. Head-end needs
    customer edge and Uses centralized monitoring and capacity
    provider edge provisioning for IPsec VPN management to ensure
    devices to enable the terminating in the network that SSL connection per
    site to become a equipment. Typically second and number of
    member of an MPLS mapping to designated simultaneous SSL
    VPN group. instance of MPLS VRF. connections can be
    Can be deployed across any terminated at the head-
    existing IP networks or the end.
    Internet.
    Head-end needs to ensure
    that IPsec connection
    initiated IKE sessions per
    second and number of
    simultaneous IKE
    negotiations can be
    processed.
    VPN Client Transparent to the Is required for client- Is not required; relies on
    endpoint because initiated IPsec VPN web browser.
    label-switching deployments.
    knowledge is not Cisco VPN client software is
    required. supported by Microsoft
    MPLS VPN is a Windows, Solaris, Linux,
    network-based VPN and Macintosh operating
    service; users do not systems.
    need VPN clients to
    interact with the
    network.
    Place in Core network. Local loop, edge, and off Local loop, edge, and off
    Network net. net.
    Transparency Resides at the Resides at the network Resides at the session
    network layer. layer. layer.
    Transparent to Transparent to applications. Currently, many TCP-
    applications. based applications work
    with SSL; however, voice
    and video for remote
    Burhan Cheema 4
    CCIE#44786

    clients generally do not


    run over SSL connection.

    You might also like