Let's say a few words about other services that can improve the security of your network.
First of these is that the network address translation service the service appeared in response to a
diminishing number of public IP addresses.
That's why in the IP version 4 networks some of the following addresses are often used from $10 0 0
0 to 10 to 5 5 5 5 2 5 5 single class a network from 1 7 to 16 0 0 to 1 7 2 3 1 2 5 5 2 5 5 16 adjacent
class-B networks
from 1 9 2 1 6 8 0 0 2 1 9 2 1 6 8 2 5 5 2 5 5 256 adjacent class C networks.
These are private addresses that are not ratable on the Internet their advantage is that you can assign
them all by yourself without consulting the local I.A. representative you do not have to pay for it.
However a computer with any of the addresses from the range specified on the slide will not be able
to get through to any host on the Internet.
This is not entirely true.
After all we have private addresses and yet we can connect to the Internet the service enables us to
do so.
It changes the addresses of the packets that passed through it.
That's why the service is usually provided by the routers.
We have three types of the address translation.
You can see the source address translation in the picture below.
As you can see the incoming address is changed into a public address 1 9 2 1 6 8 0 0 0 1 from the IP
address field is changed into for example 10 10 that 100 not 100 and that's how a packet makes its way
to the Internet.
The response will be directed to the net server which will then forward it to the corresponding computer
with a private address.
However this solution is rarely used destination address translation allows you to connect to a computer
with a private address.
You can act as for an example a web server from the outside from the internet most often used however
is IP version 4 address masking.
The mechanism is presented in the picture below the entire pool of addresses is changed into one public
address.
The net server has a session history the response which will come to one public address will be associated
with a session established by a particular private computer.
The response will be sent to this particular computer
network address translation improve security of networks all computers are treated as one computer with
a single address this of course has its advantages and drawbacks
all communications between computers passes through the net server.
It is not possible to get through to a computer with a private non readable address from the outside
and other improvements in network security comes from proxy servers they're working principle is very
simple they used to be used to improve the performance of certain services.
When you want to connect to a remote server you really connect to an intermediary server a proxy server
the proxy server will forward your request on your behalf because a proxy server executes requests of
multiple computers.
There's a good chance that different computers report the same request.
If the data is buffered or cached properly the proxy server does not need to connect to a remote computer.
This is the basis for optimal performance since all requests of that type pass through a proxy server
the server administrator is able to filter requests that can decide for example that certain Web sites
can be visited while others may not.
That can also decide the executable attachments may not be downloaded from the Internet
security wise.
It is interesting that if an attacker manages to run a proxy server and redirect your communication
to the server which is not so difficult that he will be able to modify the request dynamically.
The attacker does not control your host or the target server but the request for example to display
a web page can be modified in real time and instantly forward.
The most common way in which a request can be modified consists of attaching to a request to display
a web page the request to display an invisible point on the computer controlled by the attacker when
you download data from a specific page its entire contents are displayed.
Invisible pictures should also be displayed although you can't see it.
It was most likely downloaded from the attackers computer.
In order for the picture to be downloaded the client computer must connect to the attackers computer
in Windows systems.
Establishing a connection with a remote host entails sending credentials.
That is the user authentication data.
In this way the attacker obtains users log ins and passwords.
They are encrypted but usually quite easy to decipher later on.
Now let's say a few words about remote access protocols and the network quarantine service.
Today when we're talking about the remote access we usually mean VPN networks Dial-Up remote access
either through analog or dedicated connection is no longer used the VPN establishes a tunnel through
the public connection.
It's assumed that it's secure when you use a public connection.
The data you send must be encrypted and its authenticity confirmed.
The ATP point to point tunneling protocol is responsible for ensuring that there is also another VPN
protocol the two T.P. which we'll discuss later on.
Apart from the implementation details of the ETP two things are important from the perspective of administrators
the ATP which is Microsoft's original product is not universal.
It works only on Microsoft systems and within Microsoft environment.
It is also considered to be less secure than the L2 T.P. the ATP used to be easier to configure but
in newer versions of Windows both protocols are equally easy to set up
the L2 t.p.
They are two tunneling protocol is a protocol based on Peepy T.P. it's been modified by Cisco and Microsoft
this protocol uses encryption standards and digital signature standards instead of custom encryption
protocols.
It uses the IP Sirk the L2 TPA enables the IP SEC tunnel mode for the virtual that work interface that's
all the protocol is required to do.
It uses a TCAP session for control.
This created a problem for computers with private IP addresses.
However it was solved several years ago.
L2 T-P session establishment is presented in the slide below.
Please note that it requires building a tunnel between two hosts.
Therefore we have to identify the session and remote computers a look into the Windows network and sharing
center will show that we have the possibility to set up new network interfaces or new connections.
Let's try to choose connection to a workplace the VPN networks are designed for situations where the
user is away from the physical location of the server.
That provides a certain service and e-mail server file server or network printer.
Now we will try to connect to such a server.
We will do this by selecting the VPN connection
to establish a VPN connection.
You first need to be connected to the remote access server.
We will not use the dial up connection.
We will only build a tunnel through the existing connection.
This will serve us as an internet connection.
This means that in a moment we will have two connections both of which must be active both a connection
to a workplace and the connection which we use to communicate with the Internet must be active.
The connection to the corporate network will be encrypted and signed by the T.P. or the L2 T.P..
Let's name our connection for example test.
We still have to enter the username and password in the demonstration with a user name and the password
will be test.
Let's look at the properties of our connection for it to be established.
We must of course choose an already existing remote access server.
Let's have a look at the Security tab when it comes to the type of VPN tunnel we can choose between
L2 T.P. or ETP.
These are the standard options.
Next we can choose whether or not we will encrypt the data.
The ways way the keys will be exchanged on the type of remote users authentication.
We will further discuss the authentication protocols in the next module devoted to remote access setting
up a tunnel consists of creating a connection choosing the security protocol choosing the security level
and choosing the way to authenticate the remote user.
The advantage of L2 T.P. and IP SEC is that it authenticates not only the user but also the host.
If you select Peepy T.P. then the authentication concerns only the user.
Nor will it be possible to confirm the identity of the remote computer.
Now we have two network connections each of which has a different IP address what address will be private
and the other will be a corporate address.
You may ask which of them will be used to send data.
If we try to connect to a web page
this is specified by the routing rules or the routing paths set on your computer for security reasons
the Arrius servers set routing paths in such a way that the communication is forwarded by said servers.
This means that you are no longer connected to the Internet directly.
If you want to restore the previous functionality you have to configure Roding manually.