Tunnels and VPN * s. Administrative submittal instructions
|
|
- Meredith Carter
- 6 years ago
- Views:
Transcription
1 Tunnels and VPN * s November 3, 2017 *virtual private s Administrative submittal instructions answer the lab assignment s questions in written report form, as a text, pdf, or Word document file (no obscure formats please) to csci530l@usc.edu exact subject title must be tunnelslab deadline is start of your lab session the following week reports not accepted (zero for lab) if late you did not attend the lab (except DEN or prior arrangement) subject title deviates 1
2 Administrative employment CS530 will be next offered Fall 2018 lab graders will be needed you are the automatically ideal candidates you must remain a student in Fall 2018 contact me with expression of interest now, or subsequently hiring can only take place next August-September What s s a tunnel? encapsulation of data packets in data packets inner packets opaque to outer packets may or may not be encrypted that s outside tunnel definition 2
3 Lab experiment topology eth0? eth2? eth3? interface names enumerated unpredictably, must be determined every swap-in session; Script nicaddressing provided Tcpdump of ipip packet becomes payload a ping shoots in one side of tunnel endpoint and out the other (simultaneous) IP header starts IP payload starts node3 s red incoming-packet & outgoing-payload are IP-identical* *allowing for TTL decrement and checksum recalc 3
4 Lab tunnels you will build true tunnel non-tunnel channel unencrypted IP over IP encrypted OpenVPN ssh stunnel Tunnels spawn new interfaces Physical (hardware) eth0 eth1 Virtual (software) tunl0 (ip-ip) tap0 (OpenVPN) ipsec0 (IPSec) ppp0 (ppp-ssh) cipcb1 (CIPE) 4
5 Using hardware interfaces eth0 App eth1 (Technical note: the choice of interface by an app is indirect. App source code expresses only an IP address. Downstream, IP software in stack maps the address into an interface via the routing table.) Using software interfaces eth0 App eth1 cipcb1 looks like an interface to an app looks like an app to an interface gets to massage traffic passing through 5
6 What s s a VPN a virtual net overlaid on an underlying net a private net retaining exclusivity through confidentiality implemented by encryption applying cryptographic methods you have studied TUNNELS 6
7 Tunnel within a B C E G H I A D F - Packet stream of protocol X - Packet stream of protocol Y - Packet stream: X over Y or X tunneled in/through Y A packet to be tunneled Source Address Destination Address Data Payload 7
8 Tunnel packet Tunnel Source Address Tunnel Destination Address Tunnel Header Source Address Data Payload Destination Address Tunnel packet s payload is a(nother) packet X over Y tunneling Tunnel Source Address Tunnel Destination Address Tunnel Header Source Address Destination Address Data Payload Packet of protocol X Packet of protocol Y 8
9 Another way to draw it high-level header payload/cargo/freight protocol X mid-level header protocol Y low-level header protocol Z Uses of tunneling carry payloads over domains where otherwise illegal carry protocols that are illegal carry addresses that are illegal apply common services to multiple traffic flows 9
10 Illegal protocols over IP IPX and/or IPv6 Network A IPX and/or IPv6 Network B IP Network C (e.g. the internet) e.g., Netware and/or IPv6 e.g., Netware and/or IPv6 Illegal addresses over IP Private IP Network A Private IP Network B IP Network C (e.g. the internet) e.g., and/or 10. e.g., and/or
11 Applying common services IPX Network A IPX Network B IP Network C (e.g. the internet) crypto and/or compression applied (to entire tunnel) crypto and/or compression applied by e.g. ssh or stunnel (ssl) or OpenVPN or IPSec Layer 3 tunneling example: IP over IP IP header 1 payload layer 3 IP header 2 layer 3 11
12 Layer 3 tunneling example: IPsec IP header 1 payload layer 3 IP header 2 extra security header layer 3 VPNS 12
13 Placement-based Architectures Site-to-site Intranet VPN Remote access VPN Site-to to-site VPN via internet Network A Network B 13
14 Remote access VPN via internet connection Network A Home telecommuter VPN gateway ISP/hotel Road warrior lab exercise product 1 IPIP 14
15 What is it? Conveys an IP packet between machines not as a packet but as cargo in another packet Destination shucks carrier packet, releases cargo as packet into local ing machinery Tunnel since one packet passes through another Implemented in linux by module ipip.o S.S. Badger Conveys a car between states not as a car/motor-vehicle but as cargo in a boat Destination throws away boat, releases car as a motor vehicle onto local roadways Tunnel since one vehicle passes through another Implemented by Lake Michigan Carferry Service 15
16 IP itself is an IP subprotocol IP Header Format Version IHL Type of Service Total Length Identification Flags Fragment Offset Time to Live Protocol Header Checksum Source Address Destination Address Options Padding for IP (6 for TCP 17 for UDP 50 for ESP, etc) Sample LAN Local Network Remote Network A B Some connection D Workstations A and E E Gateways B and D 16
17 Some connection Could be the internet Could be a single intermediate machine Equivalent, for the 2 gateways Sample LAN Local Network Remote Network A eth eth0 B C eth1 eth0 eth1 eth1 D eth0 Workstations Gateways Internet surrogate A and E B and D C (B s ISP; D s ISP) eth0 E 17
18 Wanted: a 2 nd bridge to cross Local Network Remote Network A eth B D eth E tunl0 tunl lab exercise product 2 ssh 18
19 A client-server pair of programs ssh - client /usr/bin/ssh sshd - server /usr/sbin/sshd assigned port number 22 ssh why secure? all session/command traffic passes through ssh/sshd (sshd runs on port 22) encrypted going out/decrypted coming in for duration of session/command uses RSA (public-key) authentication then strong-key symmetrical encryption 19
20 ssh feature: port forwarding Private Network ssh client ssh server :80 ssh port forwarding: correspond some port on the client (e.g., 3000) to some port (e.g., 80) on a machine reachable thru the server. http (web) server Example: in client s browser gets served from ssh syntax Normal log in ssh remote-user@remote-ip e.g., ssh Adding a tunnel root@ ssh -L local-port:target-ip:remote-port remote-user@remote-ip e.g., ssh -L 3000: :80 root@
21 putty putty 21
22 lab exercise product 3 stunnel Encrypt the talk between clients and servers who don t The stunnel program is designed to work as SSL encryption wrapper between remote clients and local (inetd-startable) or remote servers. The concept is that having non-ssl aware daemons running on your system you can easily set them up to communicate with clients over secure SSL channels. stunnel man page 22
23 Ordinary ssl-unaware applications client application server application socket API socket API not encrypted SSL-aware applications client application ssl crypto here server application ssl encrypted 23
24 stunnel 3 TCP conversations a client machine a server machine ssl-unaware client stunnel stunnel ssl-unaware server ssl ssl not encrypted encrypted not encrypted app viewpoint: stunnel-oblivious without stunnel with stunnel ssl-unaware client ssl-unaware server ssl-unaware client ssl-unaware server not encrypted encrypted 24
25 Ports: non-stunnel scenario client application server application talk to remote:60000 listen to stunnel 3 TCP conversations ssl-unaware client stunnel stunnel ssl-unaware server talk to local:2000 listen to local:2000 talk to remote:30000 listen to talk to listen to
26 Vanilla config files # stunnel client client=yes [stunnel service name] accept = :2000 connect = :30000 # stunnel server at cert = /etc/stunnel/stunnel.pem [example service name] accept = connect = stunnel genl case topology LAN with client untrusted net LAN with server a router a router ssl-unaware client stunnel stunnel ssl-unaware server ssl ssl not encrypted encrypted not encrypted 26
27 stunnel server needs certificate create it with cd /etc/stunnel openssl req -new -x509 -days nodes -out stunnel.pem -keyout stunnel.pem reference it in stunnel server s config file stunnel s not really a tunnel stunnel is a conversation endpoint and a (different) conversation startpoint arriving packets are stripped of header at endpoint their content repackaged, new header, at startpoint headers do not nest/accumulate as in tunnels 27
28 True tunneling header 1 payload header 2 headers accumulate Payload forward/relay/proxy header 1 payload header 2 payload headers replace each other 28
29 lab exercise product 4 OpenVPN Lab s OpenVPN tunnel scenarios a routed tunnel, unencrypted a routed tunnel, encrypted using static, preshared secret keys a bridged tunnel, encrypted using SSL 29
30 Given this setup LEFT MIDDLE RIGHT eth0 eth1 eth0 eth0 hub hub 2 configs could make em ping eth0 eth1 eth0 eth0 hub hub 1. Routing make 2 LANs out of it (2 broadcast domains) end-to-end connection achieved by routing the IP packets 2. Bridging make 1 consolidated LAN out of it (single broadcast domain) end-to-end by bridging the ethernet frames 30
31 Info s s usual trans-layer itinerary application application Signals via hub ( layer 1 device ) app app computer A hub computer B 31
32 Frames via bridge ( layer 2 device ) app app computer A bridge computer B Packets via router ( layer 3 device ) app app computer A router computer B 32
33 Note, bridge scenario: frame s s contained packet untouched app app computer A bridge computer B OpenVPN features unique certificate/key-pair for every client choice of ciphers bridged case extends LAN-local IP to remote joiner allows broadcast-dependent apps (printer sharing) makes remoteness transparent routing does it mostly bridging does it entirely 33
34 Summer build-a-test test-lab project at JPL we encompassed DETER experment s DETER Marina del Rey USC/ISI Cyber Defense Research Lab Pasadena JPL/NASA DETER s special risky experiments can admit outlanders Extra fields, you can request: node0/tcp/22 node0/tcp/1194 node0/udp /tcp/ /tcp/ /udp/
35 The resulting benefit DETER experiment nodes now say, You can talk to us and here s s how. What we did over summer vacation with port 1194 access at DETER (namely, OpenVPN) between gateways among workstations, via the gateways port 1194 DETER Marina del Rey gateway workstation JPL Pasadena gateway workstation cost: open inbound port 1194 (at DETER) benefit: free (all-port) crosstalk here 35
36 Virtues of OpenVPN multiplexes all ports/protocols over a single port and protocol (ask DETER for just that one) applies common encryption service to all machines in the 2 s Applying common services A 3-node DETER experiment JPL s CDRL β the internet A B α γ crypto and/or compression applied (to entire tunnel by e.g. OpenVPN or IPSec or ssh or stunnel) Conversations β B (red) γ C (yellow) both served in common C D E 36
37 Info IP over IP IP in IP Tunneling IP Encapsulation within IP Info - ssh Getting Started with ssh ssh resource page free clients for Windows putty OpenSSH for Windows 37
38 Info - stunnel Info OpenVPN client for Windows 38
Tunnel within a network
VPN Tunnels David Morgan Tunnel within a network B C E G H I A D F - Packet stream of protocol X - Packet stream of protocol Y - Packet stream: X over Y or X tunneled in/through Y 1 Packet encapsulation
More informationIPSec. Slides by Vitaly Shmatikov UT Austin. slide 1
IPSec Slides by Vitaly Shmatikov UT Austin slide 1 TCP/IP Example slide 2 IP Security Issues Eavesdropping Modification of packets in transit Identity spoofing (forged source IP addresses) Denial of service
More informationDistributed Systems. 27. Firewalls and Virtual Private Networks Paul Krzyzanowski. Rutgers University. Fall 2013
Distributed Systems 27. Firewalls and Virtual Private Networks Paul Krzyzanowski Rutgers University Fall 2013 November 25, 2013 2013 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive
More informationVirtual Private Networks (VPN)
CYBR 230 Jeff Shafer University of the Pacific Virtual Private Networks (VPN) 2 Schedule This Week Mon September 4 Labor Day No class! Wed September 6 VPN Project 1 Work Fri September 8 IPv6? Project 1
More informationInternet security and privacy
Internet security and privacy IPsec 1 Layer 3 App. TCP/UDP IP L2 L1 2 Operating system layers App. TCP/UDP IP L2 L1 User process Kernel process Interface specific Socket API Device driver 3 IPsec Create
More informationIPSec. Overview. Overview. Levente Buttyán
IPSec - brief overview - security associations (SAs) - Authentication Header (AH) protocol - Encapsulated Security Payload () protocol - combining SAs (examples) Overview Overview IPSec is an Internet
More informationIntroduction to Computer Networks. CS 166: Introduction to Computer Systems Security
Introduction to Computer Networks CS 166: Introduction to Computer Systems Security Network Communication Communication in modern networks is characterized by the following fundamental principles Packet
More informationCisco Cisco Certified Network Associate (CCNA)
Cisco 200-125 Cisco Certified Network Associate (CCNA) http://killexams.com/pass4sure/exam-detail/200-125 Question: 769 Refer to exhibit: Which destination addresses will be used by Host A to send data
More informationINTERNET PROTOCOL SECURITY (IPSEC) GUIDE.
INTERNET PROTOCOL SECURITY (IPSEC) GUIDE www.insidesecure.com INTRODUCING IPSEC NETWORK LAYER PACKET SECURITY With the explosive growth of the Internet, more and more enterprises are looking towards building
More informationNetwork sniffing packet capture and analysis
Network sniffing packet capture and analysis September 29, 2017 Administrative submittal instructions answer the lab assignment s 13 questions in numbered list form, in a Word document file. (13 th response
More informationInternet Layers. Physical Layer. Application. Application. Transport. Transport. Network. Network. Network. Network. Link. Link. Link.
Internet Layers Application Application Transport Transport Network Network Network Network Link Link Link Link Ethernet Fiber Optics Physical Layer Wi-Fi ARP requests and responses IP: 192.168.1.1 MAC:
More informationCSC 4900 Computer Networks: Security Protocols (2)
CSC 4900 Computer Networks: Security Protocols (2) Professor Henry Carter Fall 2017 Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message Integrity 8.4 End point Authentication
More informationLehrstuhl für Netzarchitekturen und Netzdienste Fakultät für Informatik Technische Universität München. ilab. Lab 8 SSL/TLS and IPSec
Lehrstuhl für Netzarchitekturen und Netzdienste Fakultät für Informatik Technische Universität München ilab Lab 8 SSL/TLS and IPSec Outlook: On Layer 4: Goal: Provide security for one specific port SSL
More informationProtocol Architecture (2) Suguru Yamaguchi Nara Institute of Science and Technology Department of Information Science
Protocol Architecture (2) Suguru Yamaguchi Nara Institute of Science and Technology Department of Information Science History of computer network protocol development in 20 th century. Development of hierarchical
More informationInt ernet w orking. Internet Security. Literature: Forouzan: TCP/IP Protocol Suite : Ch 28
Int ernet w orking Internet Security Literature: Forouzan: TCP/IP Protocol Suite : Ch 28 Internet Security Internet security is difficult Internet protocols were not originally designed for security The
More informationIP Security. Have a range of application specific security mechanisms
IP Security IP Security Have a range of application specific security mechanisms eg. S/MIME, PGP, Kerberos, SSL/HTTPS However there are security concerns that cut across protocol layers Would like security
More informationInternet Protocol and Transmission Control Protocol
Internet Protocol and Transmission Control Protocol CMSC 414 November 13, 2017 Internet Protcol Recall: 4-bit version 4-bit hdr len 8-bit type of service 16-bit total length (bytes) 8-bit TTL 16-bit identification
More informationin-the-middle attack
ARP* man-in in-the-middle attack David Morgan October 27, 2017 *address resolution protocol rfc 826 Administrative submittal instructions answer the lab assignment s questions in written report form, as
More informationIPsec (AH, ESP), IKE. Guevara Noubir CSG254: Network Security
IPsec (AH, ESP), IKE Guevara Noubir noubir@ccs.neu.edu Securing Networks Control/Management (configuration) Applications Layer telnet/ftp: ssh, http: https, mail: PGP (SSL/TLS) Transport Layer (TCP) (IPSec,
More informationConfiguring OpenVPN on pfsense
Configuring OpenVPN on pfsense Configuring OpenVPN on pfsense Posted by Glenn on Dec 29, 2013 in Networking 0 comments In this article I will go through the configuration of OpenVPN on the pfsense platform.
More informationSet Up a Remote Access Tunnel (Client to Gateway) for VPN Clients on RV016, RV042, RV042G and RV082 VPN Routers
Set Up a Remote Access Tunnel (Client to Gateway) for VPN Clients on RV016, RV042, RV042G and RV082 VPN Routers Objective A Virtual Private Network (VPN) is a private network that is used to virtually
More informationProtocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE i, IEEE 802.1X P2.
P2 Protocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE 802.11i, IEEE 802.1X P2.2 IP Security IPsec transport mode (host-to-host), ESP and
More informationCS 356 Internet Security Protocols. Fall 2013
CS 356 Internet Security Protocols Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5
More informationNetwork Security Fundamentals
Network Security Fundamentals Security Training Course Dr. Charles J. Antonelli The University of Michigan 2013 Network Security Fundamentals Module 6 Firewalls & VPNs Topics Firewall Fundamentals Case
More informationIntroduction to Information Science and Technology 2017 Networking II. Sören Schwertfeger 师泽仁
II Sören Schwertfeger 师泽仁 Outline Review Network Layer Routing Transport Layer Applications HTTP Demos Internet: Huge network of networks Billions of hosts (computers) Internet Structure Network Edge:
More informationChapter 11 The IPSec Security Architecture for the Internet Protocol
Chapter 11 The IPSec Security Architecture for the Internet Protocol IPSec Architecture Security Associations AH / ESP IKE [NetSec], WS 2008/2009 11.1 The TCP/IP Protocol Suite Application Protocol Internet
More informationNetworking interview questions
Networking interview questions What is LAN? LAN is a computer network that spans a relatively small area. Most LANs are confined to a single building or group of buildings. However, one LAN can be connected
More informationGT Apiary: Remote Honeypots
GT Apiary: Remote Honeypots Undergraduate Special Problem, Summer 2010 George Macon August 4, 2010 a-pi-ar-y n. a place where bees are kept; a collection of beehives. 1 Introduction Honeypots are an important
More informationThe IPsec protocols. Overview
The IPsec protocols -- components and services -- modes of operation -- Security Associations -- Authenticated Header (AH) -- Encapsulated Security Payload () (c) Levente Buttyán (buttyan@crysys.hu) Overview
More informationCOMPUTER NETWORKING LAB EXERCISES (TP) 4
Name 1: Name 2: Group number: COMPUTER NETWORKING LAB EXERCISES (TP) 4 IPV6 December 14, 2009 Abstract In this TP you will revisit some of the basic networking tools that were introduced in TP1, only this
More informationNamed Data Networking (NDN) CLASS WEB SITE: NDN. Introduction to NDN. Updated with Lecture Notes. Data-centric addressing
CLASS WEB SITE: http://upmcsms.weebly.com/ Updated with Lecture Notes Named Data Networking (NDN) Introduction to NDN Named Data Networking (NDN) IP NDN Host-centric addressing Data-centric addressing
More informationIntegrating WX WAN Optimization with Netscreen Firewall/VPN
Application Note Integrating WX WAN Optimization with Netscreen Firewall/VPN Joint Solution for Firewall/VPN and WX Platforms Alan Sardella Portfolio Marketing Choh Mun Kok and Jaymin Patel Lab Configuration
More informationChapter 5 Network Layer
Chapter 5 Network Layer Network Layer IPv4 2 IP Header Application Header + data 3 IP IP IP IP 4 Focus on Transport Layer IP IP 5 Network Layer The Network layer (Layer 3) provides services to exchange
More informationIP Security IK2218/EP2120
IP Security IK2218/EP2120 Markus Hidell, mahidell@kth.se KTH School of ICT Based partly on material by Vitaly Shmatikov, Univ. of Texas Acknowledgements The presentation builds upon material from - Previous
More informationiii PPTP... 7 L2TP/IPsec... 7 Pre-shared keys (L2TP/IPsec)... 8 X.509 certificates (L2TP/IPsec)... 8 IPsec Architecture... 11
iii PPTP................................................................................ 7 L2TP/IPsec........................................................................... 7 Pre-shared keys (L2TP/IPsec)............................................................
More informationInternet Security. - IPSec, SSL/TLS, SRTP - 29th. Oct Lee, Choongho
Internet Security - IPSec, SSL/TLS, SRTP - 29th. Oct. 2007 Lee, Choongho chlee@mmlab.snu.ac.kr Contents Introduction IPSec SSL / TLS SRTP Conclusion 2/27 Introduction (1/2) Security Goals Confidentiality
More informationGrandstream Networks, Inc. GWN7000 OpenVPN Site-to-Site VPN Guide
Grandstream Networks, Inc. GWN7000 OpenVPN Site-to-Site VPN Guide Table of Contents INTRODUCTION... 4 SCENARIO OVERVIEW... 5 CONFIGURATION STEPS... 6 Core Site Configuration... 6 Generate Self-Issued Certificate
More informationCSE509: (Intro to) Systems Security
CSE509: (Intro to) Systems Security Fall 2012 Invited Lecture by Vyas Sekar IPSec 2005-12 parts by Matt Bishop, used with permission Security in Real Life: Motivation Site SF Company X $$$ Site NY Site
More informationLecture 13 Page 1. Lecture 13 Page 3
IPsec Network Security: IPsec CS 239 Computer Software March 2, 2005 Until recently, the IP protocol had no standards for how to apply security Encryption and authentication layered on top Or provided
More informationCSE543 Computer and Network Security Module: Network Security
CSE543 Computer and Network Security Module: Network Security Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 2 Communication Security Want to establish a secure channel
More informationPROGRAMMING Kyriacou E. Frederick University Cyprus. Network communication examples
ACSC424 NETWORK APPLICATION PROGRAMMING Kyriacou E. Frederick University Cyprus communication examples The OSI reference model (proposed by ISO) Application A Application B 2 Application Application Presentation
More informationOn Distributed Communications, Rand Report RM-3420-PR, Paul Baran, August 1964
The requirements for a future all-digital-data distributed network which provides common user service for a wide range of users having different requirements is considered. The use of a standard format
More informationThe IPSec Security Architecture for the Internet Protocol
Chapter 11 The IPSec Security Architecture for the Internet Protocol [NetSec], WS 2005/2006 11.1 Overview Brief introduction to the Internet Protocol (IP) suite Security problems of IP and objectives of
More informationSE 4C03 Winter Final Examination Answer Key. Instructor: William M. Farmer
SE 4C03 Winter 2003 Final Examination Answer Key Instructor: William M. Farmer (1) [2 pts.] Both the source and destination IP addresses are used to route IP datagrams. Is this statement true or false?
More informationGRE Tunnel APPLICATION NOTE
APPLICATION NOTE Used symbols Danger Information regarding user safety or potential damage to the router. Attention Problems that can arise in specific situations. Information, notice Useful tips or information
More informationFirepower Threat Defense Site-to-site VPNs
About, on page 1 Managing, on page 3 Configuring, on page 3 Monitoring Firepower Threat Defense VPNs, on page 11 About Firepower Threat Defense site-to-site VPN supports the following features: Both IPsec
More informationCSC 6575: Internet Security Fall 2017
CSC 6575: Internet Security Fall 2017 Network Security Devices IP Security Mohammad Ashiqur Rahman Department of Computer Science College of Engineering Tennessee Tech University 2 IPSec Agenda Architecture
More informationTransport Level Security
2 Transport Level Security : Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 28 October 2013 css322y13s2l12, Steve/Courses/2013/s2/css322/lectures/transport.tex,
More informationChapter 8 roadmap. Network Security
Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message integrity 8.4 Securing e-mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7 Securing
More informationFirewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.
More informationVirtual Tunnel Interface
This chapter describes how to configure a VTI tunnel. About s, on page 1 Guidelines for s, on page 1 Create a VTI Tunnel, on page 2 About s The ASA supports a logical interface called (VTI). As an alternative
More informationETSF05/ETSF10 Internet Protocols Network Layer Protocols
ETSF05/ETSF10 Internet Protocols Network Layer Protocols 2016 Jens Andersson Agenda Internetworking IPv4/IPv6 Framentation/Reassembly ICMPv4/ICMPv6 IPv4 to IPv6 transition VPN/Ipsec NAT (Network Address
More informationVIRTUAL PRIVATE NETWORK
VIRTUAL PRIVATE NETWORK Virtual Private Networks A virtual private network (VPN) is a private network that interconnects remote (and often geographically separate) networks through primarily public communication
More informationLecture 8. Basic Internetworking (IP) Outline. Basic Internetworking (IP) Basic Internetworking (IP) Service Model
Lecture 8 Basic Internetworking (IP) Reminder: Homework 3, Programming Project 2 due on Tuesday. An example internet is shown at right. Routers or gateways are used to connect different physical networks.
More information20-CS Cyber Defense Overview Fall, Network Basics
20-CS-5155 6055 Cyber Defense Overview Fall, 2017 Network Basics Who Are The Attackers? Hackers: do it for fun or to alert a sysadmin Criminals: do it for monetary gain Malicious insiders: ignores perimeter
More informationChapter 2 - Part 1. The TCP/IP Protocol: The Language of the Internet
Chapter 2 - Part 1 The TCP/IP Protocol: The Language of the Internet Protocols A protocol is a language or set of rules that two or more computers use to communicate 2 Protocol Analogy: Phone Call Parties
More informationNetwork Security. Thierry Sans
Network Security Thierry Sans HTTP SMTP DNS BGP The Protocol Stack Application TCP UDP Transport IPv4 IPv6 ICMP Network ARP Link Ethernet WiFi The attacker is capable of confidentiality integrity availability
More informationThe Internet community has developed application-specific security mechanisms in a number of application areas, including electronic mail (S/MIME,
1 The Internet community has developed application-specific security mechanisms in a number of application areas, including electronic mail (S/MIME, PGP), client/server (Kerberos), Web access (Secure Sockets
More informationDPX8000 Series Deep Service Switching Gateway User Configuration Guide Firewall Service Board Module v1.0
DPX8000 Series Deep Service Switching Gateway User Configuration Guide Firewall Service Board Module v1.0 i Hangzhou DPtech Technologies Co., Ltd. provides full- range technical support. If you need any
More informationSample excerpt. Virtual Private Networks. Contents
Contents Overview...................................................... 7-3.................................................... 7-5 Overview of...................................... 7-5 IPsec Headers...........................................
More informationOpenVPN protocol. Restrictions in Conel routers. Modified on: Thu, 14 Aug, 2014 at 2:29 AM
1/2/2016 OpenVPN protocol : Support Portal OpenVPN protocol Modified on: Thu, 14 Aug, 2014 at 2:29 AM OpenVPN (Open Virtual Private Network) is a means of interconnection of several computers through an
More informationSecure Communications Over a Network
Secure Communications Over a Network Course: MITS:5400G Proffessor: Dr. Xiaodong Lin By: Geoff Vaughan 100309160 March 20th 2012 Abstract The purpose of this experiment is to transmit an encrypted message
More informationLecture 8. Reminder: Homework 3, Programming Project 2 due on Thursday. Questions? Tuesday, September 20 CS 475 Networks - Lecture 8 1
Lecture 8 Reminder: Homework 3, Programming Project 2 due on Thursday. Questions? Tuesday, September 20 CS 475 Networks - Lecture 8 1 Outline Chapter 3 - Internetworking 3.1 Switching and Bridging 3.2
More informationNetwork Security - ISA 656 IPsec IPsec Key Management (IKE)
Network Security - ISA 656 IPsec IPsec (IKE) Angelos Stavrou September 28, 2008 What is IPsec, and Why? What is IPsec, and Why? History IPsec Structure Packet Layout Header (AH) AH Layout Encapsulating
More informationChapter 32 Security in the Internet: IPSec, SSL/TLS, PGP,
Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP, VPN, and Firewalls 32.1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 32.2 Figure 32.1 Common structure
More informationThe Internet Security Protocol, IPsec, incorporates security for network transmission
17 Internet Protocol Security: IPsec The Internet Security Protocol, IPsec, incorporates security for network transmission into the Internet Protocol (IP) directly. IPsec is integrated into the new IPv6
More informationCSCE 715: Network Systems Security
CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina Security in Network Layer Implementing security in application layer provides flexibility in security
More informationNeed For Protocol Architecture
Chapter 2 CS420/520 Axel Krings Page 1 Need For Protocol Architecture E.g. File transfer Source must activate communications path or inform network of destination Source must check destination is prepared
More informationNeed For Protocol Architecture
Chapter 2 CS420/520 Axel Krings Page 1 Need For Protocol Architecture E.g. File transfer Source must activate communications path or inform network of destination Source must check destination is prepared
More informationApplication Note 11. Main mode IPSec between a Windows 2000 / XP (responder) and a Digi Transport Router (initiator)
Application Note 11 Main mode IPSec between a Windows 2000 / XP (responder) and a Digi Transport Router (initiator) November 2015 Contents 1 Introduction... 5 1.1 Outline... 5 2 Assumptions... 6 2.1 Corrections...
More informationLecture 33. Firewalls. Firewall Locations in the Network. Castle and Moat Analogy. Firewall Types. Firewall: Illustration. Security April 15, 2005
Firewalls Lecture 33 Security April 15, 2005 Idea: separate local network from the Internet Trusted hosts and networks Intranet Firewall DMZ Router Demilitarized Zone: publicly accessible servers and networks
More informationSirindhorn International Institute of Technology Thammasat University
Name.............................. ID............... Section...... Seat No...... Sirindhorn International Institute of Technology Thammasat University Course Title: IT Security Instructor: Steven Gordon
More informationMobile Communications Chapter 9: Network Protocols/Mobile IP
Mobile Communications Chapter 9: Network Protocols/Mobile IP Motivation Data transfer Encapsulation Security IPv6 Problems DHCP Ad-hoc s Routing protocols 9.0.1 Motivation for Mobile IP Routing based on
More informationFirewalls. October 13, 2017
Firewalls October 13, 2017 Administrative submittal instructions answer the lab assignment s questions in written report form, as a text, pdf, or Word document file (no obscure formats please) email to
More informationLecture 12 Page 1. Lecture 12 Page 3
IPsec Network Security: IPsec CS 239 Computer Software February 26, 2003 Until recently, the IP protocol had no standards for how to apply security Encryption and authentication layered on top Or provided
More informationELEC / COMP 177 Fall Some slides from Kurose and Ross, Computer Networking, 5 th Edition
ELEC / COMP 177 Fall 2016 Some slides from Kurose and Ross, Computer Networking, 5 th Edition Presentation 2 Security/Privacy Presentations Nov 3 rd, Nov 10 th, Nov 15 th Upload slides to Canvas by midnight
More informationET4254 Communications and Networking 1
Topic 9 Internet Protocols Aims:- basic protocol functions internetworking principles connectionless internetworking IP IPv6 IPSec 1 Protocol Functions have a small set of functions that form basis of
More informationThe World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to
1 The World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to compromises of various sorts, with a range of threats
More informationIntroduction to IPsec. Charlie Kaufman
Introduction to IPsec Charlie Kaufman charliek@microsoft.com 1 IP Security (IPsec) IETF standard for Network Layer security Popular for creating trusted link (VPN), either firewall-firewall, or machine
More informationCS475 Networks Lecture 8 Chapter 3 Internetworking. Ethernet or Wi-Fi).
Assignments Reading for Lecture 9: Section 3.3 3.2 Basic Internetworking (IP) Bridges and LAN switches from last section have limited ability CS475 Networks Lecture 8 Chapter 3 Internetworking is a logical
More informationVPN World. MENOG 16 Istanbul-Turkey. By Ziad Zubidah Network Security Specialist
VPN World MENOG 16 Istanbul-Turkey By Ziad Zubidah Network Security Specialist What is this Van used for?! Armed Van It used in secure transporting for valuable goods from one place to another. It is bullet
More informationComputer Networks Security: intro. CS Computer Systems Security
Computer Networks Security: intro CS 166 - Computer Systems Security A very easy network 3/14/16 Computer Networks: Intro 2 Two philosophers example Translator Language Translator Engineer Communication
More informationChapter 6. IP Security. Dr. BHARGAVI H. GOSWAMI Department of Computer Science Christ University
Chapter 6 IP Security Dr. BHARGAVI H. GOSWAMI Department of Computer Science Christ University +91 9426669020 bhargavigoswami@gmail.com Topic List 1. IP Security Overview 2. IP Security Architecture 3.
More informationVPN Ports and LAN-to-LAN Tunnels
CHAPTER 6 A VPN port is a virtual port which handles tunneled traffic. Tunnels are virtual point-to-point connections through a public network such as the Internet. All packets sent through a VPN tunnel
More informationVirtual Private Networks.
Virtual Private Networks thm@informatik.uni-rostock.de http://wwwiuk.informatik.uni-rostock.de/ Content Virtual Private Networks VPN Basics Protocols (IPSec, PPTP, L2TP) Objectives of VPNs Earlier Companies
More informationSchool of Computer Sciences Universiti Sains Malaysia Pulau Pinang
School of Computer Sciences Universiti Sains Malaysia Pulau Pinang Information Security & Assurance Assignment 2 White Paper Virtual Private Network (VPN) By Lim Teck Boon (107593) Page 1 Table of Content
More informationPresenter John Baker
Presenter John Baker docs@ilikeit.co.uk Training Objectives and Overview Training Assumptions Why? Network design & Information Collation Endpoint Setup Troubleshooting Things to watch out for Review Q&A
More informationECE 435 Network Engineering Lecture 23
ECE 435 Network Engineering Lecture 23 Vince Weaver http://web.eece.maine.edu/~vweaver vincent.weaver@maine.edu 30 November 2017 HW#11 will be posted Announcements Don t forget projects next week Presentation
More informationLayering and Addressing CS551. Bill Cheng. Layer Encapsulation. OSI Model: 7 Protocol Layers.
Protocols CS551 Layering and Addressing Bill Cheng Set of rules governing communication between network elements (applications, hosts, routers) Protocols define: Format and order of messages Actions taken
More informationE : Internet Routing
E6998-02: Internet Routing Lecture 18 Overlay Networks John Ioannidis AT&T Labs Research ji+ir@cs.columbia.edu Copyright 2002 by John Ioannidis. All Rights Reserved. Announcements Lectures 1-18 are available.
More informationCIS 6930/4930 Computer and Network Security. Topic 8.1 IPsec
CIS 6930/4930 Computer and Network Security Topic 8.1 IPsec 1 IPsec Objectives Why do we need IPsec? IP V4 has no authentication IP spoofing Payload could be changed without detection. IP V4 has no confidentiality
More information7th Slide Set Computer Networks
Prof. Dr. Christian Baun 7th Slide Set Computer Networks Frankfurt University of Applied Sciences WS1718 1/49 7th Slide Set Computer Networks Prof. Dr. Christian Baun Frankfurt University of Applied Sciences
More informationNetworking: Network layer
control Networking: Network layer Comp Sci 3600 Security Outline control 1 2 control 3 4 5 Network layer control Outline control 1 2 control 3 4 5 Network layer purpose: control Role of the network layer
More informationVirtual private networks
Technical papers Virtual private networks Virtual private networks Virtual private networks (VPNs) offer low-cost, secure, dynamic access to private networks. Such access would otherwise only be possible
More informationMODULE: NETWORKS MODULE CODE: CAN1102C. Duration: 2 Hours 15 Mins. Instructions to Candidates:
BSc.(Hons) Computer Science with Network Security BEng (Hons) Telecommunications Cohort: BCNS/17B/FT Examinations for 2017-2018 / Semester 2 Resit Examinations for BCNS/15A/FT, BTEL/15B/FT & BTEL/16B/FT
More informationUser Manual. SSV Remote Access Gateway. Web ConfigTool
SSV Remote Access Gateway Web ConfigTool User Manual SSV Software Systems GmbH Dünenweg 5 D-30419 Hannover Phone: +49 (0)511/40 000-0 Fax: +49 (0)511/40 000-40 E-mail: sales@ssv-embedded.de Document Revision:
More informationIPsec NAT Transparency
The feature introduces support for IP Security (IPsec) traffic to travel through Network Address Translation (NAT) or Port Address Translation (PAT) points in the network by addressing many known incompatibilities
More informationChapter 6/8. IP Security
Chapter 6/8 IP Security Prof. Bhargavi H Goswami Department of MCA, Sunshine Group of Institutes, Rajkot, Gujarat, India. Mob: +918140099018. Email: bhargavigoswami@gmail.com Topic List 1. IP Security
More informationAdministrivia CSC458 Lecture 4 Bridging LANs and IP. Last Time. This Time -- Switching (a.k.a. Bridging)
Administrivia CSC458 Lecture 4 Bridging LANs and IP Homework: # 1 due today # 2 out today and due in two weeks Readings: Chapters 3 and 4 Project: # 2 due next week Tutorial today: Joe Lim on project 2
More informationCryptography and Network Security. Sixth Edition by William Stallings
Cryptography and Network Security Sixth Edition by William Stallings Chapter 20 IP Security If a secret piece of news is divulged by a spy before the time is ripe, he must be put to death, together with
More information