Comparing Remote Access Methods

Question 1

Fiber to the curb vs fiber to the premises

Answer 1

Fiber to the curb goes to the cabinet near the customer’s house and fiber to the premises goes to the building.

Question 2

What are the good remote access policies

Answer 2

1. Restrict to specific users and groups
2. Limit times and days
3. Limit network privileges
4. Logging and auditing
5. Keep systems updated
6. Secure admin access

Question 3

Types of VPN

Answer 3

1. Host-to-Host VPN: allows an individual host on the Internet to establish a VPN connection with another host.
2. Site-to-Site VPN: Allows two local network of hosts at different locations and each host can communicate with any other host at any location. Rather than requiring a VPN configuration for each one, you install a single device that handles VPN connections and packet encryption.
3. Remote Access VPNs: individual hosts establish a VPN connection to a remote site. The client computer has to be able to establish the connection with a device called VPN concentrator that sits on the edge of the private network. VPN concentrators are hardware devices that are dedicated to establishing connections to hosts. Each host is configured with software often called a VPN client, that allows establishing connection between host and VPN concentrator.
4. Clientless VPN: This type of VPN does not need a host to install VPN client software. instead, a host connects to the remote resource using a web browser. Access to the site is usually controlled with a simple username and password. This type of VPN is also known as an SSL VPN because it uses the secure sockets layer to encrypt data.

Question 4

Tunneling Protocols

Answer 4

1. Point-to-point Protocol: method to send data from one point to another over a direct connection, it encapsulates data so it can travel over this connection, but it doesn’t have security.
2. Generic Routing Encapsulation (GRE): A method to put one packet inside another packet so it can travel across a network. It allows different kinds of network data to travel inside regular IP packets. No security by itself but can be combined with IPsec.
3. IPsec: Secure way to send data over the Internet and encrypts an authenticates the data at the network layer so no one can read or modify it. Has strong security by locking the package with a special key.
4. Transport Layer Security: A secure tunnel built on top of regular Internet connections like TCP (or UDP with DTLS). It encrypts the data traveling between two devices (like your web browser talking to a website).

Question 5

IPsec

Answer 5

It’s a framework of protocols designed to secure IP network communications. It provides services like encryption, authentication, and data integrity, ensuring secure data transmission, especially over potentially insecure networks like the internet.

Question 6

Two core protocols of IPsec

Answer 6

1. Authentication Header (AH): makes sure data hasn’t been changed. It uses a secret key + hash to create a signature. It does not encrypt data so if someone breaks the seal, they can read the data.
2. Encapsulating Security Payload (ESP): Encrypts the data, keeping it secret and also checks if it has been modified.

Question 7

Two modes of IPsec

Answer 7

1. Transport mode: to secure communications between hosts on a private network. Payload data is encrypted but IP header is not.
2. Tunnel mode: used for communications between VPN gateways across an insecure network.

Question 8

What is an IPsec policy

Answer 8

A set of rules that tell each device how to secure the connection. It sets the authentication mechanism and also the use of AH/ESP and transport or tunnel mode for a connection between two peers.

Question 9

What is Internet Key Exchange (IKE)

Answer 9

Framework for creating a security association (SA) used with IPSec. An SA establishes that two hosts trust one another (authenticate) and agree on secure protocols and cipher suites to use to exchange data.

Question 10

Two Phases of IKE:

Answer 10

Phase 1: Creates a secure channel using Diffie-Hellman key exchange. Authenticates each device using Digital certificates or Pre-Shared Key.
Phase 2: Chooses which encryption and hashing methods to use for VPN.

Question 11

Versions of IKE

Answer 11

1. IKEv1: Site to site and host to host. It needs supporting protocols to implement remote access VPNs.
2. IKEv2: Stand-alone remote access VPN. Allows network address translation (NAT) traversal and MOBIKE multihoming. NAT traversal makes it easier to configure a tunnel allowed by a home router/firewall. Multihoming means that a smartphone client with Wi-Fi and cellular interfaces can keep the IPSec connection alive when switching between them.

Question 12

What is Multihoming

Answer 12

It means a smartphone with Wi-Fi and cellular interfaces can keep the IPSec connection alive when switching between them.

Question 13

Client-to-Site VPN

Answer 13

VPN setup where a remote device (client) connects to a VPN gateway (at the company’s network).

Question 14

VPN gateway

Answer 14

A VPN-enabled router/firewall at the company that manages VPN connection.

Question 15

Split Tunnel

Answer 15

The client accesses the Internet directly using its ISP-managed IP configuration, routers, and DNS servers.

Question 16

Full Tunnel

Answer 16

Internet access is mediated by the corporate network, which will alter the client’s IP address and DNS servers and may use a proxy.

Question 17

HTML5 VPN or Clientless VPN

Answer 17

Using features of HTML5 to implement remote desktop/VPN connections via browser software (clientless). Also called clientless VPN.

Question 18

SSH

Answer 18

Cryptographic network protocol for secure communication of remote configuration and RDP

Question 19

SSH Authentication Methods

Answer 19

1. Username/Password: Just logging in like logging into website or email.
2. Public/Private keys: A private key stays safe on your computer; the public key is stored on the remote computer. Together, they unlock the door.
3. Kerberos Authentication: Mostly used at companies. It uses a ticket you get when you log into your computer at work.

Question 20

What is a SSH Host key and what is it for?

Answer 20

Each SSH server has its own special fingerprint (host key) to prove it’s authentic.
Your computer remembers these keys so it knows it’s talking to the right remote computer.

Question 21

Important SSH Commands

Answer 21

sshd | ssh-keygen | ssh-copy-id | ssh-agent | ssh-add | ssh user@host | ssh host “command” | scp | sftp

Question 22

RDP

Answer 22

RDP creates a secure and encrypted remote connection and has a GUI.

Question 23

RDP vs. Telnet & SSH

Answer 23

Telnet and SSH are text base command line interface, but RDP sends screen/audio to client and accepts mouse/keyboard input.

Question 24

Telnet port

Answer 24

23

Question 25

SSH port

Answer 25

22

Question 26

RDP port

Answer 26

3389

Question 27

Managed and unmanaged appliances

Answer 27

Managed ones are the ones we configure like firewalls routers and advanced switches. Unmanaged ones are the ones that we plug in and they are ready.

Question 28

Ways to control management interfaces

Answer 28

1. Console Port: use a console cable to connect to a device and then use a command line to type commands directly. This method is local only. 2. AUX port: connect a modem to a device and then you can call the device over the phone line using that modem. Then you can use a terminal emulator to type commands. (redundant) 3. Management port: Allows remote configuration over the network. A virtual interface or a dedicated management port can be used to control devices.

Question 29

Out-of-Band vs. In-Band

Answer 29

- OOB means using a separate, private connection just for management. Example: Using the console port or setting up a separate network for management. - In-Band: Management traffic shares the same network as regular internet traffic.

Question 30

Jump Box/host/server

Answer 30

When we have devices that are exposed to the Internet directly like devices in DMZ, administrative access and configuration becomes risky and challenging. Jump Box. Jump box is placed in the secure zone of the network and administrator first connect to it using one protocol like SSH and then they connect to admin interfaces of other servers inside the secure zone. All application servers are set to only accept connections from the jump box.