Virtual Private Networks (VPNs)

Virtual private networks (VPNs): Securing your network edge

Businesses often need to connect people and offices over the Internet without exposing private data. Remote work made this even more common after the COVID-19 pandemic. The problem is that the Internet is a public network, so sending confidential corporate traffic “in the clear” (unencrypted) risks interception.

A Virtual Private Network (VPN) solves this by creating an encrypted connection, often called a tunnel, between devices or networks across the Internet. Data inside the tunnel is protected from eavesdropping and unauthorized access, helping organizations maintain confidentiality and integrity when connecting remote offices or supporting remote employees.

The core idea behind a VPN is encryption:

• When a device or network connects to a corporate network through a VPN, the traffic is encapsulated (wrapped) and encrypted.
• Encryption turns readable data into an unreadable format.
• Only the intended recipient can decrypt it using the correct decryption key.

Because of this, a remote device or remote network can function as if it were directly connected to the internal corporate network, while still traveling over the public Internet.

VPNs are broadly categorized into two primary types, each serving different needs:

• Site-to-Site VPNs
• Remote Access VPNs

Both types use strong security protocols, and IP Security (IPsec) is a common foundation for building and maintaining these encrypted connections.

Site-to-Site VPNs

A Site-to-Site VPN connects entire networks to each other - for example, linking a headquarters network to branch office networks over the Internet. This is useful when distance makes dedicated private connections impractical or too expensive. Instead of leasing private lines, organizations can use existing Internet connections and still keep inter-office traffic secure.

Image

Image Title - Site-to-Site VPNs

Site-to-Site VPNs typically use dedicated network devices - such as firewalls or routers - at each location. These devices are configured to establish and maintain the encrypted tunnel automatically. As a result, devices in one office can securely communicate with devices in another office without each endpoint needing its own VPN client.

This is often described as a network-to-network (or “LAN-to-LAN”) connection because it securely links separate local area networks (LANs) into a unified wide area network (WAN) over the public Internet.

Key protocols used in Site-to-Site VPNs include Internet Key Exchange (IKEv1 or IKEv2) and IPsec:

• IKE negotiates and manages the security associations (SAs) between VPN peers, including exchanging cryptographic keys.
• IPsec then provides the packet-level security services - encryption, authentication, and integrity - for traffic inside the tunnel.

IPsec operates at the Network layer (Layer 3) of the OSI model, which allows it to protect IP traffic broadly and consistently between sites.

Remote access VPNs

A Remote Access VPN connects an individual device (an endpoint) to a corporate network from outside the office. This is the common solution for mobile employees, teleworkers, and contractors who need access to internal resources.

Endpoints can include laptops, tablets, or smartphones, and they typically run VPN client software.

When a user starts a Remote Access VPN connection:

• The VPN client establishes an encrypted tunnel to a VPN concentrator or firewall at the corporate site.
• This creates a computer-to-network connection.
• The user’s device can then access internal servers, applications, and data as if it were on the corporate network.

This encryption is especially important on untrusted networks (like public Wi‑Fi), where traffic could otherwise be captured.

Modern Remote Access VPNs may also include additional controls such as endpoint posture assessment. Before granting full access, the VPN system can verify that the connecting device meets corporate security requirements - for example:

• Antivirus is installed and up to date
• Operating system patches are current
• Required firewall settings are enabled

This reduces the risk of allowing an insecure device to connect to internal systems.

Like Site-to-Site VPNs, Remote Access VPNs commonly use strong encryption and authentication protocols, with IPsec being widely adopted. The VPN client and the corporate VPN gateway work together to establish an IPsec tunnel so that traffic is encrypted, authenticated, and protected from interception while crossing the public Internet.

In summary, VPNs are a core technology in modern network security. Site-to-Site VPNs securely connect office networks to each other, while Remote Access VPNs securely connect individual users to the corporate network. In both cases, encryption and protocols such as IPsec are central to creating private, secure connectivity over a public network - an essential concept for networking work and CCNA-level understanding.