| 7.1 |  | Remote Access VPN |
| 7.1.3 |  | Tunneling protocols for remote access |

| A secure tunnel is required to transfer information using a VPN connection. A variety of technologies exist to enable tunneling of protocols through networks to create a remote access VPN. Tunneling is the transmission of data intended for use only within a private network through a public network. The network transmits data in such a way that the routing nodes in the public network are unaware that the transmission is part of a private network.

Before the Layer 2 Tunneling Protocol (L2TP) standard was established in August 1999, Cisco used Layer 2 Forwarding (L2F) as its proprietary tunneling protocol. L2TP is entirely backward compatible with L2F. L2F is not forward compatible with L2TP. L2TP, TCP port 1701, is a combination of Cisco L2F and Microsoft PPTP. Microsoft supports PPTP in its earlier versions of Windows and PPTP/L2TP in Windows NT/2000.

Currently, IPSec is the preferred protocol for secure corporate remote access VPNs. Using IPSec requires remote users to install VPN software on the PC, or to install a hardware client device which functions as a network gateway. IPSec based VPNs support all IP services such as HTTP, FTP, ICMP, SMTP, and VoIP.

Recently, clientless VPNs or HTTPS based VPNs have been developed. The technology uses secure sockets layer (SSL) or Transport Layer Security (TLS) operating on TCP port 443. The major advantage is that it does not require client software to be installed on the PCs of remote users. Instead, a web browser becomes the VPN endpoint. The disadvantage to using clientless VPN is that only HTTP services are provided. Currently, clientless VPNs can be terminated on several SSL/TLS based concentrator devices. IOS routers cannot terminate SSL based VPNs at this time.

Remember that the L2TP or PPTP tunneling protocols do not support data encryption or packet integrity. Use L2TP when there is a need to support tunneling packets other than IP unicast type. However, IPSec can also be used in combination with the protocol to provide encryption, such as IPSec over L2TP. Microsoft Point-To-Point Encryption Protocol (MPPE) is used to provide encryption when using PPTP.

| Media Activity Demonstration Activity: Cisco VPN Devices In this activity, students will learn about Cisco VPN devices.