Making sense of remote access

Security for your data
Although it's important that passwords be encrypted in the authentication process, it's also desirable to encrypt the data that is transmitted after authentication takes place. You can provide data encryption using link encryption or end-to-end encryption. With link encryption, the data is encrypted only on the link (i.e., only to the remote access server); with end-to-end encryption, the data is encrypted from the client application to the server hosting the resource being accessed. In a Windows network, when using PPP for a dial-up connection, only one protocol is available for data encryption, the Microsoft Point-to-Point Encryption Protocol (MPPE), as shown in Table C. Table C

DIAL-UP DATA ENCRYPTION
PROTOCOL	WHEN USED	NOTES
Microsoft Point-to-Point Encryption (MPPE)	For data encryption in a dial-up session in a Windows network.	In order to use MPPE, the authentication protocol for the dial-up session must be either EAP-TLS or MS-CHAP version 1 or 2.

VPN protocols
Virtual private networking protocols encapsulate PPP frames (the data units at the data link layer of the OSI model) into IP datagrams at the network layer. These datagrams are then sent across an internetwork, which can be either a private network or, more commonly, the Internet. This encapsulation creates a "tunnel" that acts like a dedicated WAN link, even though it usually uses the Internet -- thus, a "virtual" private network. Because VPN is still using the PPP protocol, all of the authentication protocols associated with PPP, such as CHAP and EAP, still apply to VPN. However, we need to take a closer look at the protocols for connectivity and data encryption, shown in Tables D and E, respectively. Table D

VIRTUAL PRIVATE NETWORKING CONNECTIVITY
PROTOCOL	WHEN USED	NOTES
Point-to-Point Tunneling Protocol (PPTP)	Will work only over an IP internetwork.
Layer 2 Tunneling Protocol (L2TP)	In addition to an IP internetwork, can also be used over Frame Relay PVCs and X.25 or ATM virtual circuits.	This is a hybrid protocol designed to use the best features of both PPTP and a Cisco technology known as Layer 2 Forwarding.

Table E

VIRTUAL PRIVATE NETWORKING DATA ENCRYPTION
PROTOCOL	WHEN USED	NOTES
Microsoft Point-to-Point Encryption (MPPE)	May be used only with PPTP, not with L2TP.	As with PPP, if MPPE is used, the authentication protocol must be either MS-CHAP or EAP-TLS. Provides only link encryption.
Internet Protocol Security (IPSec)	May be used only with L2TP. Its use with L2TP will also require computer certificates provided by the Public Key Infrastructure.	Provides end-to-end encryption.

Bottom lineWhen planning and configuring a remote access environment, you need to know what protocols the clients and servers will be using. That will determine which protocols can be used for connectivity, authentication, and encryption. Given a choice of protocols, you almost always want to pick the combination that provides the greatest security. For dial-up, that may be a combination of PPP, MS-CHAP V2, and MPPE. For VPN, that may be a combination of L2TP, EAP-TLS, and IPSec. If you have client systems that do not support these protocols, you may have to either choose a different protocol that provides less security or not allow that client to connect to your remote access server.

Have your say instantly in the
Tech Update forum. Find out what's where in the new Tech Update with our
Guided Tour. Let the editors know what you think in the
Mailroom.

« Previous
1
2
Next »

Talkback

Can I use my home printer when using remote access?

via Facebook 16 March, 2005 10:27

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

ike fuelband is great for every healthminded person ! to work out! theres this website called textme4free.com that you can use to text anywhere in...

7 hours ago by bordero on Nike's FuelBand wristband gamifies exercise

> I'm told it's somewhat annoying when people have their Macs stolen > and Apple stores treat the thief as the owner, but there you go. Ouch,...

9 hours ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

@kevinmchapman. OK, I acknowledge that 'most' was a gratuitous throwaway comment as an afterthought and too presumptuous. As to proof, as you...

14 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint

@BrownieBoy > Works really well for thieves.... >> Nice attempt to deflect the argument by tossing in a point that's totally >> irrelevant, even...

15 hours ago by Jack Schofield on AMD Ultrathins to challenge Intel Ultrabooks

fantastic that the so called piracy bills have been withdrawn. however, these anti-democracy supporters are still in the shadows so lets be alert...

16 hours ago by raskolnikof on SOPA, Protect IP support wavers in face of online protest

Please God no; teach them anything you like - thinking rationally, the uses and misuses of data, what data is and what it's not - but leave the...

18 hours ago by Tony Douglas via Facebook on Kids are the future. Teach ’em to code.

@Jack, > Works really well for thieves.... Nice attempt to deflect the argument by tossing in a point that's totally irrelevant, even it were...

1 day ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

Make that 13 people now - I got refused today at Manchester airport. I thought I was up to date on this legislation - I knew of the EU ruling from...

1 day ago by bootlegger on UK airport body scans will not be opt out

Don't forget to check out apps like GoodReader or SlideShark either, they're indispensible for people on the go in presentation situations. Best...

2 days ago by tinycg on Four top iPad apps for people on the move

Well it seems there is something a number of us agree on. Why is the Ubuntu Unity launcher so ugly? I thought perhaps it was something to do with...

2 days ago by TerryRK on A tale of two distros: Ubuntu and Linux Mint

Duplicate comments are not made intentionally. Its very good to know that now you are keeping check on this problem because sometimes a commenter...

2 days ago by Freebies202 on Microsoft fixes blog comments, speeds up blogs with open source

"the very significant number of users" and "many (most) of us" - you have no evidence for these statements. It is a fact that most users are saying...

2 days ago by kevinmchapman on A tale of two distros: Ubuntu and Linux Mint