Gilbert Held is an award winning author and lecturer. Gil has written over 50 technical books and 400 articles over the past 30 years. In addition, Gil has earned many accolades and has been presented with an award from the Association of American Publishers. He has also been selected by Federal Computer Week to join the Federal 100, a list of the top 100 persons in academia, industry and the Federal Government that have made a significant impact upon the equipment acquisition process.

• Preface xiiiAcknowledgements xvChapter 1 Introduction to Virtual Private Networking 11.1 THE VPN CONCEPT 11.1.1 DEFINITION 11.1.2 TYPES OF VPNS 21.1.3 CATEGORIES OF VPNS 41.1.4 INFRASTRUCTURE 81.1.5 BENEFITS OF USE 91.1.6 DISADVANTAGES OF VPNS 121.1.7 VPN PROTOCOLS 141.1.8 SUMMARY 171.1.9 ALTERNATIVES TO VPNS 181.1.10 ECONOMIC ISSUES 191.1.11 OTHER ALTERNATIVES 201.2 BOOK PREVIEW 201.2.1 UNDERSTANDING AUTHENTICATION AND CRYPTOLOGY 211.2.2 UNDERSTANDING THE TCP/IP PROTOCOL SUITE 211.2.3 LAYER 2 VPN TECHNIQUES 211.2.4 HIGHER LAYER VPNS 221.2.5 VPN HARDWARE AND SOFTWARE 221.2.6 SERVICE PROVIDER-BASED VPNS 22Chapter 2 Understanding Authentication and Encryption 232.1 AUTHENTICATION 232.1.1 PASSWORD AUTHENTICATION PROTOCOL 242.1.2 CHALLENGE-HANDSHAKE AUTHENTICATION PROTOCOL 272.1.3 EXTENSIBLE AUTHENTICATION PROTOCOL – TRANSPORT LEVEL SECURITY 302.1.4 TOKEN AUTHENTICATION 302.2 ENCRYPTION 312.2.1 GENERALMETHOD OF OPERATION 312.2.2 PRIVATE VERSUS PUBLIC KEY SYSTEMS 332.2.3 PUBLIC KEY ENCRYPTION 342.2.4 THE RSA ALGORITHM 352.2.5 DIGITAL CERTIFICATES 402.2.6 HASHING AND DIGITAL SIGNATURES 49Chapter 3 Understanding the TCP/IP Protocol Suite 533.1 FRAME FORMATION 533.1.1 HEADER SEQUENCING 543.1.2 SEGMENTS AND DATAGRAMS 543.1.3 ICMP MESSAGES 553.1.4 ON THE LAN 563.1.5 DATAFLOW CONTROL FIELDS 563.2 THE NETWORK LAYER 573.2.1 THE IPV4 HEADER 573.2.2 SUBNETTING 613.2.3 THE SUBNETMASK 633.2.4 THEWILDCARDMASK 633.2.5 ICMP 653.3 THE TRANSPORT LAYER 693.3.1 TRANSPORT LAYER PROTOCOLS 693.3.2 THE TCP HEADER 693.3.3 THE UDP HEADER 703.3.4 SOURCE AND DESTINATION PORT FIELDS 713.4 PROXY SERVICES AND NETWORK ADDRESS TRANSLATION 733.4.1 PROXY SERVICE 733.4.2 NETWORK ADDRESS TRANSLATION 743.4.3 TYPES OF ADDRESS TRANSLATION 753.4.4 VPN CONSIDERATIONS 76Chapter 4 Layer 2 Operations 794.1 THE POINT-TO-POINT PROTOCOL 794.1.1 COMPONENTS 794.1.2 PPP ENCAPSULATION 804.1.3 LINK CONTROL PROTOCOL OPERATIONS 834.1.4 MULTILINK PPP 894.2 POINT-TO-POINT TUNNELING PROTOCOL 904.2.1 IMPLEMENTATIONMODELS 904.2.2 NETWORKING FUNCTIONS 934.2.3 ESTABLISHING THE PPTP TUNNEL 954.2.4 PPTP ENCAPSULATED PACKETS 954.2.5 THE PPTP CONTROL CONNECTION PACKET 964.2.6 CONTROL CONNECTION PROTOCOL OPERATION 1114.2.7 PPTP DATA TUNNELING 1124.3 LAYER TWO FORWARDING 1154.3.1 EVOLUTION 1154.3.2 OPERATION 1154.3.3 THE L2F PACKET FORMAT 1164.3.4 TUNNEL OPERATIONS 1184.3.5 MANAGEMENTMESSAGES 1194.4 LAYER TWO TUNNELING PROTOCOL 1194.4.1 OVERVIEW 1204.4.2 ARCHITECTURALMODELS 1204.4.3 THE L2TP PACKET FORMAT 1214.4.4 CONTROLMESSAGES 1244.4.5 PROTOCOL OPERATIONS 127Chapter 5 Higher Layer VPNs 1335.1 UNDERSTANDING IPSEC 1335.1.1 OVERVIEW 1345.1.2 TOPOLOGIES SUPPORTED 1345.1.3 SPECIFYING SESSION PARAMETERS 1355.1.4 THE SPI 1375.1.5 PROTOCOLS 1375.1.6 AUTHENTICATION HEADER 1395.1.7 ENCAPSULATING SECURITY PAYLOAD 1425.1.8 OPERATIONS 1465.1.9 KEYMANAGEMENT 1525.2 WORKING WITH IPSEC 1575.2.1 CONFIGURING IPSEC POLICIES 1575.2.2 ADDING THE IPSEC SNAP-IN 1585.2.3 CREATING AN IPSEC POLICY 1615.2.4 WORKING WITH IPSEC FILTERS 1725.3 SSL AND TLS 1875.3.1 RATIONALE FOR SSL 1875.3.2 OVERVIEW OF SSL 1885.3.3 SSL OPERATION 1905.3.4 MESSAGE EXCHANGE 1905.3.5 CIPHER SUITES 1945.3.6 THE NETILLA SECURITY PLATFORM 1975.3.7 SUMMARY 201Chapter 6 VPN Hardware and Software 2036.1 USING THE ASANTE VPN SECURITY ROUTER 2036.1.1 OVERVIEW 2046.1.2 CONFIGURATION ACCESS 2046.1.3 WIRELESS CONSIDERATIONS 2056.1.4 VPN OPERATIONS 2096.1.5 CLIENT-TO-NETWORK 2156.2 WINDOWS VPN SOFTWARE 2166.2.1 USING AWINDOWS XP CLIENT 2176.2.2 CREATING THE VPN 2176.3 WORKING WITHWINDOWS 2000 SERVER 2336.3.1 INSTALLING RRAS 2346.3.2 ENABLING RRAS 2346.3.3 CONFIGURING RRAS 2396.3.4 CREATING A TEST ACCOUNT 2546.3.5 TESTING THE CONNECTION 256Chapter 7 Service Provider-Based VPNs 2617.1 RATIONALE FOR USE 2627.1.1 ECONOMICS 2627.1.2 PERSONNEL LIMITATIONS 2637.1.3 RELIABILITY 2647.1.4 COMMUNICATIONS UNITY 2657.1.5 MANAGEMENT 2667.1.6 INSTALLATION AND SUPPORT 2667.1.7 PACKAGED SECURITY 2677.2 TRANSPORT FACILITIES AND VPN OPERATION 2677.2.1 HARDWARE-BASED SWITCHING 2687.2.2 SOFTWARE-BASED SWITCHING 2697.3 SERVICE LEVEL AGREEMENTS 2717.3.1 SLAMETRICS 2717.3.2 SLA LIMITATIONS 2757.4 VPN SERVICE PROVIDER OVERVIEW 2767.4.1 AT&T CORPORATION 2777.4.2 LEVEL 3 COMMUNICATIONS 2797.4.3 SPRINT 2797.4.4 VERIZON 280Appendix A VPN Checklist 283Index 287

Gilbert Held is an award winning author and lecturer. Gil has written over 50 technical books and 400 articles over the past 30 years. In addition, Gil has earned many accolades and has been presented with an award from the Association of American Publishers. He has also been selected by Federal Computer Week to join the Federal 100, a list of the top 100 persons in academia, industry and the Federal Government that have made a significant impact upon the equipment acquisition process.

• Preface xiiiAcknowledgements xvChapter 1 Introduction to Virtual Private Networking 11.1 THE VPN CONCEPT 11.1.1 DEFINITION 11.1.2 TYPES OF VPNS 21.1.3 CATEGORIES OF VPNS 41.1.4 INFRASTRUCTURE 81.1.5 BENEFITS OF USE 91.1.6 DISADVANTAGES OF VPNS 121.1.7 VPN PROTOCOLS 141.1.8 SUMMARY 171.1.9 ALTERNATIVES TO VPNS 181.1.10 ECONOMIC ISSUES 191.1.11 OTHER ALTERNATIVES 201.2 BOOK PREVIEW 201.2.1 UNDERSTANDING AUTHENTICATION AND CRYPTOLOGY 211.2.2 UNDERSTANDING THE TCP/IP PROTOCOL SUITE 211.2.3 LAYER 2 VPN TECHNIQUES 211.2.4 HIGHER LAYER VPNS 221.2.5 VPN HARDWARE AND SOFTWARE 221.2.6 SERVICE PROVIDER-BASED VPNS 22Chapter 2 Understanding Authentication and Encryption 232.1 AUTHENTICATION 232.1.1 PASSWORD AUTHENTICATION PROTOCOL 242.1.2 CHALLENGE-HANDSHAKE AUTHENTICATION PROTOCOL 272.1.3 EXTENSIBLE AUTHENTICATION PROTOCOL – TRANSPORT LEVEL SECURITY 302.1.4 TOKEN AUTHENTICATION 302.2 ENCRYPTION 312.2.1 GENERALMETHOD OF OPERATION 312.2.2 PRIVATE VERSUS PUBLIC KEY SYSTEMS 332.2.3 PUBLIC KEY ENCRYPTION 342.2.4 THE RSA ALGORITHM 352.2.5 DIGITAL CERTIFICATES 402.2.6 HASHING AND DIGITAL SIGNATURES 49Chapter 3 Understanding the TCP/IP Protocol Suite 533.1 FRAME FORMATION 533.1.1 HEADER SEQUENCING 543.1.2 SEGMENTS AND DATAGRAMS 543.1.3 ICMP MESSAGES 553.1.4 ON THE LAN 563.1.5 DATAFLOW CONTROL FIELDS 563.2 THE NETWORK LAYER 573.2.1 THE IPV4 HEADER 573.2.2 SUBNETTING 613.2.3 THE SUBNETMASK 633.2.4 THEWILDCARDMASK 633.2.5 ICMP 653.3 THE TRANSPORT LAYER 693.3.1 TRANSPORT LAYER PROTOCOLS 693.3.2 THE TCP HEADER 693.3.3 THE UDP HEADER 703.3.4 SOURCE AND DESTINATION PORT FIELDS 713.4 PROXY SERVICES AND NETWORK ADDRESS TRANSLATION 733.4.1 PROXY SERVICE 733.4.2 NETWORK ADDRESS TRANSLATION 743.4.3 TYPES OF ADDRESS TRANSLATION 753.4.4 VPN CONSIDERATIONS 76Chapter 4 Layer 2 Operations 794.1 THE POINT-TO-POINT PROTOCOL 794.1.1 COMPONENTS 794.1.2 PPP ENCAPSULATION 804.1.3 LINK CONTROL PROTOCOL OPERATIONS 834.1.4 MULTILINK PPP 894.2 POINT-TO-POINT TUNNELING PROTOCOL 904.2.1 IMPLEMENTATIONMODELS 904.2.2 NETWORKING FUNCTIONS 934.2.3 ESTABLISHING THE PPTP TUNNEL 954.2.4 PPTP ENCAPSULATED PACKETS 954.2.5 THE PPTP CONTROL CONNECTION PACKET 964.2.6 CONTROL CONNECTION PROTOCOL OPERATION 1114.2.7 PPTP DATA TUNNELING 1124.3 LAYER TWO FORWARDING 1154.3.1 EVOLUTION 1154.3.2 OPERATION 1154.3.3 THE L2F PACKET FORMAT 1164.3.4 TUNNEL OPERATIONS 1184.3.5 MANAGEMENTMESSAGES 1194.4 LAYER TWO TUNNELING PROTOCOL 1194.4.1 OVERVIEW 1204.4.2 ARCHITECTURALMODELS 1204.4.3 THE L2TP PACKET FORMAT 1214.4.4 CONTROLMESSAGES 1244.4.5 PROTOCOL OPERATIONS 127Chapter 5 Higher Layer VPNs 1335.1 UNDERSTANDING IPSEC 1335.1.1 OVERVIEW 1345.1.2 TOPOLOGIES SUPPORTED 1345.1.3 SPECIFYING SESSION PARAMETERS 1355.1.4 THE SPI 1375.1.5 PROTOCOLS 1375.1.6 AUTHENTICATION HEADER 1395.1.7 ENCAPSULATING SECURITY PAYLOAD 1425.1.8 OPERATIONS 1465.1.9 KEYMANAGEMENT 1525.2 WORKING WITH IPSEC 1575.2.1 CONFIGURING IPSEC POLICIES 1575.2.2 ADDING THE IPSEC SNAP-IN 1585.2.3 CREATING AN IPSEC POLICY 1615.2.4 WORKING WITH IPSEC FILTERS 1725.3 SSL AND TLS 1875.3.1 RATIONALE FOR SSL 1875.3.2 OVERVIEW OF SSL 1885.3.3 SSL OPERATION 1905.3.4 MESSAGE EXCHANGE 1905.3.5 CIPHER SUITES 1945.3.6 THE NETILLA SECURITY PLATFORM 1975.3.7 SUMMARY 201Chapter 6 VPN Hardware and Software 2036.1 USING THE ASANTE VPN SECURITY ROUTER 2036.1.1 OVERVIEW 2046.1.2 CONFIGURATION ACCESS 2046.1.3 WIRELESS CONSIDERATIONS 2056.1.4 VPN OPERATIONS 2096.1.5 CLIENT-TO-NETWORK 2156.2 WINDOWS VPN SOFTWARE 2166.2.1 USING AWINDOWS XP CLIENT 2176.2.2 CREATING THE VPN 2176.3 WORKING WITHWINDOWS 2000 SERVER 2336.3.1 INSTALLING RRAS 2346.3.2 ENABLING RRAS 2346.3.3 CONFIGURING RRAS 2396.3.4 CREATING A TEST ACCOUNT 2546.3.5 TESTING THE CONNECTION 256Chapter 7 Service Provider-Based VPNs 2617.1 RATIONALE FOR USE 2627.1.1 ECONOMICS 2627.1.2 PERSONNEL LIMITATIONS 2637.1.3 RELIABILITY 2647.1.4 COMMUNICATIONS UNITY 2657.1.5 MANAGEMENT 2667.1.6 INSTALLATION AND SUPPORT 2667.1.7 PACKAGED SECURITY 2677.2 TRANSPORT FACILITIES AND VPN OPERATION 2677.2.1 HARDWARE-BASED SWITCHING 2687.2.2 SOFTWARE-BASED SWITCHING 2697.3 SERVICE LEVEL AGREEMENTS 2717.3.1 SLAMETRICS 2717.3.2 SLA LIMITATIONS 2757.4 VPN SERVICE PROVIDER OVERVIEW 2767.4.1 AT&T CORPORATION 2777.4.2 LEVEL 3 COMMUNICATIONS 2797.4.3 SPRINT 2797.4.4 VERIZON 280Appendix A VPN Checklist 283Index 287

Gilbert Held is an award winning author and lecturer. Gil has written over 50 technical books and 400 articles over the past 30 years. In addition, Gil has earned many accolades and has been presented with an award from the Association of American Publishers. He has also been selected by Federal Computer Week to join the Federal 100, a list of the top 100 persons in academia, industry and the Federal Government that have made a significant impact upon the equipment acquisition process.

• Preface xiiiAcknowledgements xvChapter 1 Introduction to Virtual Private Networking 11.1 THE VPN CONCEPT 11.1.1 DEFINITION 11.1.2 TYPES OF VPNS 21.1.3 CATEGORIES OF VPNS 41.1.4 INFRASTRUCTURE 81.1.5 BENEFITS OF USE 91.1.6 DISADVANTAGES OF VPNS 121.1.7 VPN PROTOCOLS 141.1.8 SUMMARY 171.1.9 ALTERNATIVES TO VPNS 181.1.10 ECONOMIC ISSUES 191.1.11 OTHER ALTERNATIVES 201.2 BOOK PREVIEW 201.2.1 UNDERSTANDING AUTHENTICATION AND CRYPTOLOGY 211.2.2 UNDERSTANDING THE TCP/IP PROTOCOL SUITE 211.2.3 LAYER 2 VPN TECHNIQUES 211.2.4 HIGHER LAYER VPNS 221.2.5 VPN HARDWARE AND SOFTWARE 221.2.6 SERVICE PROVIDER-BASED VPNS 22Chapter 2 Understanding Authentication and Encryption 232.1 AUTHENTICATION 232.1.1 PASSWORD AUTHENTICATION PROTOCOL 242.1.2 CHALLENGE-HANDSHAKE AUTHENTICATION PROTOCOL 272.1.3 EXTENSIBLE AUTHENTICATION PROTOCOL – TRANSPORT LEVEL SECURITY 302.1.4 TOKEN AUTHENTICATION 302.2 ENCRYPTION 312.2.1 GENERALMETHOD OF OPERATION 312.2.2 PRIVATE VERSUS PUBLIC KEY SYSTEMS 332.2.3 PUBLIC KEY ENCRYPTION 342.2.4 THE RSA ALGORITHM 352.2.5 DIGITAL CERTIFICATES 402.2.6 HASHING AND DIGITAL SIGNATURES 49Chapter 3 Understanding the TCP/IP Protocol Suite 533.1 FRAME FORMATION 533.1.1 HEADER SEQUENCING 543.1.2 SEGMENTS AND DATAGRAMS 543.1.3 ICMP MESSAGES 553.1.4 ON THE LAN 563.1.5 DATAFLOW CONTROL FIELDS 563.2 THE NETWORK LAYER 573.2.1 THE IPV4 HEADER 573.2.2 SUBNETTING 613.2.3 THE SUBNETMASK 633.2.4 THEWILDCARDMASK 633.2.5 ICMP 653.3 THE TRANSPORT LAYER 693.3.1 TRANSPORT LAYER PROTOCOLS 693.3.2 THE TCP HEADER 693.3.3 THE UDP HEADER 703.3.4 SOURCE AND DESTINATION PORT FIELDS 713.4 PROXY SERVICES AND NETWORK ADDRESS TRANSLATION 733.4.1 PROXY SERVICE 733.4.2 NETWORK ADDRESS TRANSLATION 743.4.3 TYPES OF ADDRESS TRANSLATION 753.4.4 VPN CONSIDERATIONS 76Chapter 4 Layer 2 Operations 794.1 THE POINT-TO-POINT PROTOCOL 794.1.1 COMPONENTS 794.1.2 PPP ENCAPSULATION 804.1.3 LINK CONTROL PROTOCOL OPERATIONS 834.1.4 MULTILINK PPP 894.2 POINT-TO-POINT TUNNELING PROTOCOL 904.2.1 IMPLEMENTATIONMODELS 904.2.2 NETWORKING FUNCTIONS 934.2.3 ESTABLISHING THE PPTP TUNNEL 954.2.4 PPTP ENCAPSULATED PACKETS 954.2.5 THE PPTP CONTROL CONNECTION PACKET 964.2.6 CONTROL CONNECTION PROTOCOL OPERATION 1114.2.7 PPTP DATA TUNNELING 1124.3 LAYER TWO FORWARDING 1154.3.1 EVOLUTION 1154.3.2 OPERATION 1154.3.3 THE L2F PACKET FORMAT 1164.3.4 TUNNEL OPERATIONS 1184.3.5 MANAGEMENTMESSAGES 1194.4 LAYER TWO TUNNELING PROTOCOL 1194.4.1 OVERVIEW 1204.4.2 ARCHITECTURALMODELS 1204.4.3 THE L2TP PACKET FORMAT 1214.4.4 CONTROLMESSAGES 1244.4.5 PROTOCOL OPERATIONS 127Chapter 5 Higher Layer VPNs 1335.1 UNDERSTANDING IPSEC 1335.1.1 OVERVIEW 1345.1.2 TOPOLOGIES SUPPORTED 1345.1.3 SPECIFYING SESSION PARAMETERS 1355.1.4 THE SPI 1375.1.5 PROTOCOLS 1375.1.6 AUTHENTICATION HEADER 1395.1.7 ENCAPSULATING SECURITY PAYLOAD 1425.1.8 OPERATIONS 1465.1.9 KEYMANAGEMENT 1525.2 WORKING WITH IPSEC 1575.2.1 CONFIGURING IPSEC POLICIES 1575.2.2 ADDING THE IPSEC SNAP-IN 1585.2.3 CREATING AN IPSEC POLICY 1615.2.4 WORKING WITH IPSEC FILTERS 1725.3 SSL AND TLS 1875.3.1 RATIONALE FOR SSL 1875.3.2 OVERVIEW OF SSL 1885.3.3 SSL OPERATION 1905.3.4 MESSAGE EXCHANGE 1905.3.5 CIPHER SUITES 1945.3.6 THE NETILLA SECURITY PLATFORM 1975.3.7 SUMMARY 201Chapter 6 VPN Hardware and Software 2036.1 USING THE ASANTE VPN SECURITY ROUTER 2036.1.1 OVERVIEW 2046.1.2 CONFIGURATION ACCESS 2046.1.3 WIRELESS CONSIDERATIONS 2056.1.4 VPN OPERATIONS 2096.1.5 CLIENT-TO-NETWORK 2156.2 WINDOWS VPN SOFTWARE 2166.2.1 USING AWINDOWS XP CLIENT 2176.2.2 CREATING THE VPN 2176.3 WORKING WITHWINDOWS 2000 SERVER 2336.3.1 INSTALLING RRAS 2346.3.2 ENABLING RRAS 2346.3.3 CONFIGURING RRAS 2396.3.4 CREATING A TEST ACCOUNT 2546.3.5 TESTING THE CONNECTION 256Chapter 7 Service Provider-Based VPNs 2617.1 RATIONALE FOR USE 2627.1.1 ECONOMICS 2627.1.2 PERSONNEL LIMITATIONS 2637.1.3 RELIABILITY 2647.1.4 COMMUNICATIONS UNITY 2657.1.5 MANAGEMENT 2667.1.6 INSTALLATION AND SUPPORT 2667.1.7 PACKAGED SECURITY 2677.2 TRANSPORT FACILITIES AND VPN OPERATION 2677.2.1 HARDWARE-BASED SWITCHING 2687.2.2 SOFTWARE-BASED SWITCHING 2697.3 SERVICE LEVEL AGREEMENTS 2717.3.1 SLAMETRICS 2717.3.2 SLA LIMITATIONS 2757.4 VPN SERVICE PROVIDER OVERVIEW 2767.4.1 AT&T CORPORATION 2777.4.2 LEVEL 3 COMMUNICATIONS 2797.4.3 SPRINT 2797.4.4 VERIZON 280Appendix A VPN Checklist 283Index 287