5.5VPN and wireless security

A VPN lets you use an untrusted public network like the internet as safely as a leased line, and for wireless LANs—where anyone within radio range can receive the signal—encryption is the lifeline. This section builds the ability to judge "which scheme for which requirement" by understanding the two forms of VPN (connecting a teleworker into the office versus joining whole sites together), the role of IPsec, and the generational differences among wireless encryption standards (WPA to WPA2 to WPA3).

5.5.1VPN forms and IPsec

• A remote-access VPN securely connects individual devices—teleworkers, travelers—into the corporate network over a public network. The device uses a VPN client (or browser SSL/TLS), authenticates per user, and establishes a tunnel. The use case is "a person entering the office from outside."
• A site-to-site VPN permanently connects entire networks at different sites—such as headquarters and a branch—via a tunnel between the routers/firewalls (VPN gateways) at each end. No per-device configuration is needed; the gateways handle encryption on behalf of the hosts. The use case is "joining network to network."
• IPsec is a suite of protocols providing confidentiality (encryption), integrity (tamper detection), authentication (source legitimacy), and anti-replay at the IP layer. It comprises ESP (which encrypts data), IKE (which performs key exchange), and more, and in tunnel mode encapsulates the entire original IP packet to join sites. It is the core technology of site-to-site VPNs and is also used for remote access.