3.4 Virtual Private Networks & Encryption Protocols

Cisco CCST Cybersecurity Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Introduction & Exam Strategy

1.1 About the Cisco CCST Cybersecurity Exam 1.2 Study Roadmap & Preparation Strategy

2 Chapter 2: Essential Security Principles

2.1 Information Security Principles & The CIA Triad 2.2 Confidentiality, Integrity & Availability Controls 2.3 Authentication, Authorization & Accounting (AAA) 2.4 Social Engineering & Human Vulnerabilities 2.5 Security Principles & Access Management 2.6 Encryption, Hashing, Certificates & PKI

3 Chapter 3: Basic Network Security Concepts

3.1 Network Architecture & The OSI/TCP-IP Models 3.2 Network Defense Infrastructure & Firewalls 3.3 Intrusion Detection & Prevention Systems (IDS/IPS) 3.4 Virtual Private Networks & Encryption Protocols 3.5 Network Segmentation, DMZ & Access Control Lists 3.6 Secure Network Protocols & Services

4 Chapter 4: Endpoint Security Concepts

4.1 Endpoint Protection & Host-Based Defense 4.2 Operating System Hardening & Security Baselines 4.3 Patch Management & Vulnerability Remediation 4.4 Mobile Device Management (MDM) & BYOD Security 4.5 Endpoint Detection & Response (EDR) & Compliance 4.6 Endpoint Assessment Tools & Malware Removal

5 Chapter 5: Vulnerability Assessment & Risk Management

5.1 Risk Assessment & Risk Management 5.2 Vulnerability Scanning & Penetration Testing 5.3 CVSS Scoring & Threat Intelligence 5.4 Business Continuity & Disaster Recovery

6 Chapter 6: Incident Handling & Response

6.1 NIST Incident Response Lifecycle & Frameworks 6.2 Incident Containment, Eradication, & System Recovery 6.3 Digital Forensics Fundamentals & Evidence Preservation 6.4 Post-Incident Activity & Compliance Reporting 6.5 SOC Operations, Log Triage, & Event Monitoring 6.6 Attack Attribution: Cyber Kill Chain, MITRE ATT&CK & Diamond Model

3.4 Virtual Private Networks & Encryption Protocols

Key Takeaways Explain This Topic AI

Virtual Private Networks (VPNs) build secure, encrypted logical tunnels across untrusted public transit networks such as the Internet.

Site-to-Site VPNs connect fixed corporate gateways transparently without endpoint client software, whereas Remote Access VPNs connect mobile endpoints using SSL/TLS or IPsec software clients.

Full Tunneling routes all client internet and internal traffic through the central corporate VPN gateway, while Split Tunneling routes only corporate-destined traffic through the encrypted tunnel.

IPsec Authentication Header (AH - IP Protocol 51) provides integrity and origin authentication but NO payload encryption, and fails when crossing NAT gateways.

IPsec Encapsulating Security Payload (ESP - IP Protocol 50) provides confidentiality through AES encryption, data integrity, and origin authentication, utilizing NAT-Traversal (UDP 4500) to cross NAT routers.

Last updated: August 2026

3.4 Virtual Private Networks & Encryption Protocols

Quick Answer: Virtual Private Networks (VPNs) construct secure, encrypted tunnels across untrusted networks like the Internet. Site-to-Site VPNs connect static branch gateways, while Remote Access VPNs connect mobile endpoints. The IPsec framework relies on AH (IP 51) for unencrypted integrity and ESP (IP 50) for full payload encryption, operating in Transport Mode (payload encrypted) or Tunnel Mode (entire packet encapsulated).

Transmitting sensitive business communications across public transit networks exposes data packets to eavesdropping, unauthorized modification, and packet injection. Security technicians deploy Virtual Private Networks (VPNs) and cryptographically enforced protocols to guarantee end-to-end confidentiality, integrity, and origin authentication across untrusted boundaries.

1. Virtual Private Network (VPN) Topologies & Architecture

A Virtual Private Network (VPN) extends a private corporate network across a public infrastructure by constructing an encrypted logical tunnel. Data entering the tunnel is encrypted at one gateway or endpoint and decrypted at the receiving gateway or endpoint.

Site-to-Site VPNs vs. Remote Access VPNs

VPN Parameter Site-to-Site VPN Remote Access VPN

Primary Use Case Connects fixed organizational locations (e.g., HQ to Branch Office). Connects individual teleworkers/mobile users to corporate networks.

Endpoints Configured between two static security gateways (Routers / Firewalls). Configured between client software (laptop/phone) and a central VPN gateway.

User Transparency 100% Transparent. End users do not run client software or log in. Requires user authentication via software client (e.g., Cisco Secure Client ) or web portal.

Primary Protocols IPsec (IKEv1 / IKEv2 with ESP). SSL/TLS (TCP 443) or IPsec IKEv2 .

Full Tunneling vs. Split Tunneling

When configuring Remote Access VPN client profiles, security administrators must select a tunneling policy:

Full Tunneling: All network traffic originating from the remote endpoint is encapsulated and routed through the encrypted VPN tunnel to the corporate gateway. Internet traffic is inspected by corporate firewalls before being forwarded out to the public Internet.

Pros: Enforces corporate security controls consistently; prevents endpoint internet exposure.

Cons: Consumes significant corporate gateway internet bandwidth.

Split Tunneling: Only traffic destined for corporate internal IP addresses ( 10.0.0.0/8 ) is routed through the encrypted VPN tunnel. Personal web browsing traffic bypasses the VPN tunnel and routes directly out the endpoint's local internet connection.

Pros: Conserves corporate gateway bandwidth and minimizes latency.

Cons: Exposes the endpoint to local network threats; permits split-tunnel malware bridging.

2. The IPsec Protocol Suite Architecture

IP Security (IPsec) is a framework of open standards developed by the IETF that operates at OSI Layer 3 (Network Layer) . Because IPsec operates at Layer 3, it provides transparent cryptographic protection for all higher-layer protocols (TCP, UDP, HTTP, FTP) without requiring application modifications.

Core IPsec Protocols: AH vs. ESP

IPsec relies on two primary headers to secure IP packets:

Authentication Header (AH - IP Protocol 51):

Services Provided: Data origin authentication, data integrity (via ICV hash), and anti-replay protection.

Confidentiality: NONE. AH does NOT encrypt data. Packets can be read in cleartext by anyone eavesdropping on the network link.

NAT Incompatibility: AH calculates an Integrity Check Value (ICV) over immutable fields in the outer IP header (including Source/Destination IP). When a packet crosses a NAT router, NAT alters the IP address, invalidating the AH hash. Consequently, AH is completely incompatible with NAT/PAT .

Encapsulating Security Payload (ESP - IP Protocol 50):

Services Provided: Complete data confidentiality (encryption via AES-CBC or AES-GCM), data origin authentication, data integrity, and anti-replay protection.

NAT Traversal (NAT-T): ESP encrypts payloads and does not include mutable outer IP header fields in its authentication hash. To cross NAT gateways, NAT-Traversal (NAT-T) encapsulates ESP packets inside UDP Port 4500 headers.

Internet Key Exchange (IKEv1 / IKEv2)

IPsec peers establish secure tunnels using IKE (UDP Port 500 / 4500):

IKE Phase 1: Authenticates IPsec peers (using Pre-Shared Keys or RSA Digital Certificates) and negotiates a secure management channel ( ISAKMP / IKE SA ) using a Diffie-Hellman (DH) key exchange (e.g., DH Group 14 or Group 19/21 Elliptic Curve).

IKE Phase 2: Negotiates specific IPsec Security Associations (IPsec SAs) governing data protection parameters (ESP encryption ciphers like AES-256-GCM, HMAC-SHA256 authentication, and SA lifetimes).

Loading diagram... IPsec Transport Mode vs Tunnel Mode Packet Encapsulation Structure

3. IPsec Modes: Transport Mode vs. Tunnel Mode

IPsec operates in two distinct encapsulation modes depending on whether data is being secured host-to-host or gateway-to-gateway.

Transport Mode

Encrypts only the Layer 4 payload (TCP/UDP segment and application data) of the IP packet. The original Layer 3 IP header is left unencrypted and intact.

Primary Use Case: Host-to-Host communications on an internal network where intermediate routers must inspect original destination IP addresses.

Overhead: Minimal overhead because no additional IP header is appended.

Tunnel Mode

Encrypts the entire original IP packet (Original IP Header + Layer 4 Header + Application Data). IPsec then appends a new outer IP header in front of the encrypted payload.

Primary Use Case: Gateway-to-Gateway (Site-to-Site) and Client-to-Gateway (Remote Access) VPNs across public transit networks.

Security Benefit: Completely hides internal network addressing schemes (e.g., internal source 10.1.5.20 sending to internal destination 10.2.8.50 ). Public routers see only outer gateway IP addresses (e.g., 203.0.113.1 sending to 198.51.100.1 ).