Subject: RE: VPN Questions

From: "Vohra, Meenakshi" <[email-masked]>
Date: Thu, 13 Sep 2001 10:21:57 -0700

for question # 1 , well i guess , VPN at Data Link Layer is not secure
whereas IPSec provides VPN with security through encryption ,
encapsulation..... i think so....
again i think firewall only filters which traffic to allow & which not to
wheres VPN with IPSec secures those packets by encrypting them &
authenticating them
 
Pls. correct me if i am wrong
meenakshi

-----Original Message-----
From: Ashish Chaurasia [mailto:[email-masked]]
Sent: Thursday, September 13, 2001 5:25 PM
To: [email-masked]
Cc: Ashish Chaurasia
Subject: VPN Questions

I m working on VPN using IPSec protocol. But I have some   doubts in my
mind. 
 
1.  What is the advantage of implementing VPN using IPSec protocol that
works at Network layer, even though the implementations of VPN at Data Link
layer are available such as L2TP,L2F, PPTP etc ?
 
2. What extra does VPN support in comparision to the combination of Firewall
and PKI ?
 
3. What are the advantages of having security at Network Layer than having
security at other layers of TCP/IP stack.
 
regards
Ashish

---

From: "Christopher A. Martin" <[email-masked]>
Date: Thu, 13 Sep 2001 13:48:03 -0500

-----Original Message-----
  From: [email-masked]
[mailto:[email-masked]]On Behalf Of Vohra, Meenakshi
  Sent: Thursday, September 13, 2001 12:22 PM
  To: 'Ashish Chaurasia'; [email-masked]
  Subject: RE: VPN Questions

    -----Original Message-----
    From: Ashish Chaurasia [mailto:[email-masked]]
    Sent: Thursday, September 13, 2001 5:25 PM
    To: [email-masked]
    Cc: Ashish Chaurasia
    Subject: VPN Questions

    // Layer 2 VPNs typically offer a form of isolation but not
confidentiality (encryption). Some of them do offer lower forms of
authentication but only IPSec AH offers non-repudiation mechanisms...you are
who you say you are withhout a doubt.
     //

     2. What extra does VPN support in comparision to the combination of
Firewall and PKI ?
    IPSec or layer 2 VPN? In the first case PKI works well with IPSec VPN
and firewall combinations.

    3. What are the advantages of having security at Network Layer than
having security at other layers of TCP/IP stack.
    The lower the layer the quicker the operation...if there were stron
encryption methods at layer 2 comparable to layer three I would recommend
layer 2 but to the best of my experience Layer 3 is the way to go. The
further up the stack you go the more latency is introduced, as would be
noticable at higher traffic rates.

    regards
    Ashish

---

From: "David Goode" <[email-masked]>
Date: Thu, 13 Sep 2001 20:04:58 -0500

First, Most existing layer two mechanisms have been proven to be
insecure, at least at some levels. Thus, the recent popularity of using
IPSec with L2TP etc...

               IPSec was devised during a time in which much encryption was
done at the application layer. Therefore, special ports must be made for
each application that wishes to utilize such mechanisms. IPsec offers the
advantage of working with all communications without any special
altercations as long as IP is used.

The idea is all communications, regardless of origin will pass through the
network layer before making its' way to the chosen media. Therefore, this
offers a convenient place to perform cryptographic functions. In addition,
there is special handling that needs to be used with Layer 2 encryption.
Since tunneling, or encapsulation of IP headers is usually done, such things
as CRC computations must re-calculated after encryption. Also, it is
imperative is such a mode of operation that any QOS bits also be copied into
the external IP header. Strictly speaking, these operations are preformed at
the network later.

 It must be noted that AH does not provide non-repudiation only verification
of integrity.  As a rule of thumb, while secure, DH operations are
susceptible to "man in the middle" attacks. As such, PKI offers added
protection to the authentication of an exchange through non-repudiation.

   There is something to be said for combining some type of firewall
capabilities to a VPN termination point. IPSec by nature guarantees secured
communications,
  but it cannot guarantee the communications being exchanged, does not
contain harmful programs or the like.

  It could be argued, encrypted communications are only as secure as the
entity performing the encryption. In the case of tunnel mode operations,
this is even more important as the data being encrypted is assumed to have
originated from a different entity altogether.

  ~DG

    -----Original Message-----
    From: Ashish Chaurasia [mailto:[email-masked]]
    Sent: Thursday, September 13, 2001 5:25 PM
    To: [email-masked]
    Cc: Ashish Chaurasia
    Subject: VPN Questions

    regards
    Ashish