What Is A Virtual Private Network?

Networks When You Need Them The concept behind on-demand networking is that the node can join the network for any desired function at any time, for any length of time. The common approach is to tunnel IP within IP with some layer in between to provide the on-demand management. Two technologies are emerging for this: L2TP (Layer 2 Tunneling Protocol) and IPSec (IP Security Protocol). L2TP combines a number of existing technologies to create manageable on-demand networks. For the most part, L2TP does not claim to offer security. There are two proposals for gaining security: using IPSec in its transport mode or using a much weaker--though in some cases adequate--PPP security. L2TP, as its name implies, tunnels a link-layer protocol over IP. This allows for support of multiple protocols over an IP network, such as IPX or AppleTalk. The connection management protocol within L2 TP lets the network administrator control the valid L2TP links. L2TP is targeted for remote clients, but some servers, routers and gateways will support it for network-to-network links. L2TP may not be common in firewall products as its security is not recognized as fully secure. Feel More Secure! Don't leave security to chance. With our Security Threat Watch newsletter you can quickly identify and act upon the most dangerous and pervasive security vulnerabilities without having to wade through thousands of e-mail alerts and mailing lists. Sign up today! IPSec provides network-level security for IP. Its management protocol, ISAKMP/Oakley, is also a security protocol and protects against man-in-the-middle attacks during the connection setup. IPSec in hosts as OS components or BITS ("bump in the stacks") implementations can work with gateway or router implementations, such as BITW ("bump in the wire") to create secured, on-demand network connections. The distinction between L2TP and IPSec is an important one. L2TP supports on-demand connections that can be secured. IPSec provides security that supports on-demand connections. Choices to Make Instead of shopping for a virtual private network, now you can shop for a DPN, DSN, ON or OSN, according to whatever suits your netwo rking needs. You can mix and match to provide the most cost-effective networking for your organization, instead of buying what's marketed most effectively to your management. If someone out there can propose more pronounceable terms than OSNs, let me know. I'm always looking for better ways to express what's really happening in networking. Robert Moskowitz is a senior technical director at the International Computer Security Association and a member of the Internet Architecture Board (IAB). He can be reached at rgm@htt-consult.com.