Virtual Private Network (VPN) Simulation

What is a Virtual Private Network (VPN)?

A Virtual Private Network (VPN) establishes a secure, encrypted "tunnel" across an untrusted, public network infrastructure like the Internet. It ensures three fundamental security pillars: Confidentiality (Encryption), Integrity (Hashing), and Authentication (Digital Certificates / Pre-Shared Keys).

Site-to-Site IPsec VPN vs. Remote Access SSL/TLS VPN

• Site-to-Site IPsec VPN: Connects two entire office networks (e.g., Headquarter to Branch Office) transparently via VPN Gateway Routers or Firewalls. End-user devices do not require client software.
• Remote Access SSL/TLS VPN: Connects individual mobile workers or remote employees directly to corporate networks using client software (e.g., Cisco AnyConnect) over standard web ports (TCP 443).

The IPsec Framework Architecture

• IKE Phase 1 (ISAKMP SA): Authenticates the peer gateways and negotiates a secure control channel (Diffie-Hellman Key Exchange, AES/3DES Encryption, SHA/MD5 Hashing).
• IKE Phase 2 (IPsec SA): Negotiates the parameters used to protect actual user data traffic crossing the tunnel (IPsec Transform Set).
• ESP (Encapsulating Security Payload - Protocol 50): Encapsulates and encrypts the original IP packet payload and header in **Tunnel Mode**.
• AH (Authentication Header - Protocol 51): Provides data authentication and integrity without encryption (rarely used alone).

Tunnel Mode vs. Transport Mode

• Tunnel Mode (Site-to-Site): Encapsulates the entire original IP packet (Header + Data) inside a brand-new Outer IP Header. Hides private LAN addresses.
• Transport Mode (Host-to-Host): Encrypts only the IP payload while leaving the original IP header intact.