Syngress - Eleventh Hour Network+ Exam N10-004 Study Guide (11 ...

Security Zones 127
■ A segment dedicated to information storage.
■ A segment specifically for the processing of business information.
Each of these two new segments has special security and operability concerns
above and beyond those of the rest of the organizational network. Considerations
when defining segments are as follows:
■
■
■
■
Creation of multiple segments changes a network structure.
As a site grows and offers new features, new zones may have to be created.
It is best to start with deny-all strategies and permit only the services and
the network transactions required to make the network function.
Access controls regulate the way network communications are initiated.
EXAM WARNING
A deny-all strategy means that there is a firewall rule which blocks all traffic. Additional
rules are created to allow only the minimum level of service required for the network to
function. Any traffic that does not match these rules permitting traffic is then handled by
the default block rule and the traffic is dropped.
Virtual Private Networks
Virtual private networks (VPNs) allow a remote user to behave as if attached to
a local network. The traffic shared among devices on the VPN must be protected
so as to provide confidentiality, integrity, and authentication (see Figure 8.2).
Crunch Time
Point-to-Point Tunneling Protocol (PPTP) is a VPN protocol
that is a relatively simple encapsulation of the Pointto-Point
Protocol (PPP) over an existing Transmission
Control Protocol/Internet Protocol (TCP/IP) connection.
Characteristics of PPTP include the following:
■ Consists of two connections:
■ The control connection is a TCP connection to
port 1723.
■ The IP tunnel connection and user data is implemented
via PPP in conjunction with the Generic
Routing Encapsulation (GRE) protocol.
■ PPTP connections can be established in either
direction.
■ Security requirements of PPTP, such as authentication
and encryption, are left to the PPP portion of
the traffic.
■ PPTP connections can be authenticated through
the PPP layer using Microsoft’s Challenge Handshake
Authentication Protocol (MS-CHAP) or the
Extensible Authentication Protocol–Transport Layer
Security (EAP–TLS) protocol.
■ Encryption can be provided by the Microsoft Pointto-Point
Encryption (MPPE) protocol, which is based
on RC4 with session keys of 40-bit, 56-bit, or
128-bit length.
■ Because of the need for two connections to maintain
a single PPTP tunnel, making sure PPTP traffic
can traverse firewalls can be problematic. Also,
owing to the use of GRE, traffic originating from or
sent to a host that sits behind a device performing
Network Address Translation (NAT).