Instant Broadband® Series
Appendix B: Maximizing VPN Security
Just as you maximized your network security with a firewall, you should also maximize security for your data with the Firewall Router.
IPSec is compatible with most VPN endpoints and ensures privacy and authen- tication for data, while authenticating user identification. With IPSec, authen- tication is based upon the PC's IP Address. This not only confirms the user's identity but also establishes the secure tunnel at the network layer, protecting all data that passes through.
By operating at the network layer, IPSec is independent of any applications running on the network. This way, it doesn't harm your PC's performance and still allows you to do more with greater security. Still, it is important to note that IPSec encryption does create a slight slowdown in network throughput, due to encrypting and decrypting data.
A method of securing data transmission is by using key exchange with a VPN tunnel. Securing the key exchange without compromising earlier sessions is by using PFS (Perfect Forward Secrecy). PFS protects by authenticating the key exchange between two VPN endpoints. This is done by sending one key to the other endpoint and then then creating a new key to be passed back to the the original sender of the data exchange.
All of this protection actually comes at a lower cost than most VPN endpoint software packages. The Firewall Router will allow the users on your network to secure their data over the Internet without having to purchase the extra client licenses that other VPN hardware manufacturers and software packages will require. With VPN functions handled by the router, rather than your PC (which software packages would require), this frees up your PCs to perform more functions, more efficiently. An additional benefit is that you aren't required to reconfigure any of your network PCs.
EtherFast® Cable/DSL Firewall Router with
As secure as the Firewall Router makes your data, there are still more ways to maximize security. The following are a few suggestions on how to increase data security beyond the Firewall Router.
1)Maximize security on your other networks. Install firewall routers for your Internet connections, and use the most
2)Narrow the scope of your VPN tunnel as much as possible. Rather than allowing a range of IP Addresses, use the addresses specific to the end- points required.
3)Do not set the Remote Security Group to Any, as this will open the VPN to any IP Address. Host a specific IP address.
4)Maximize encryption and authentication. Use 3DES encryption and SHA authentication whenever possible.
5)Manage your
Data transmission over the Internet is a hole in network security that is often overlooked. With VPN maximized, along with the use of a firewall router and wireless security, you can secure your data even when it leaves your network.
96 | 97 |
