Wireless Internet & Broadband Technologies

Wireless Internet-Based Broadband

• Wireless technology can send and receive data via the unlicensed radio spectrum.
• Anyone with a wireless router and technology can use this unlicensed spectrum.
• Wireless access was limited to the transmission range of a wireless router or modem, typically under 100 feet, until recently.

Municipal Wi-Fi

• Many cities are establishing municipal wireless networks.
• Municipal Wi-Fi networks offer high-speed internet access at no cost or at a significantly reduced price point.
• Some networks are for city use only, enabling remote work for police, fire departments, and city employees.
• Connecting to municipal Wi-Fi typically requires a wireless modem with a stronger radio and directional antenna than standard wireless adapters.
• Service providers offer the necessary equipment for free or for a fee, similar to DSL or cable modems.

Cellular Technology

• Cellular service is a wireless WAN technology used where other WAN access technologies are unavailable.
• Smartphones and tablets can use cellular data for typical internet activities.
• Radio waves communicate to a nearby mobile phone tower from devices using cellular technology.
• Small radio antenna is in a device, with the provider having a larger antenna on a tower within miles.

3G/4G/5G Wireless

• These are abbreviations for 3rd generation, 4th generation, and the emerging 5th generation mobile wireless technologies
• These technologies support wireless internet access.
• 4G standards support bandwidths up to 450 Mbps download and 100 Mbps upload.
• The emerging 5G standard supports 100 Mbps to 10 Gbps and beyond

Long-Term Evolution (LTE)

• Refers to a newer, faster technology
• Part of 4G technology.

Satellite Internet

• Typically used by rural users or in remote locations where cable and DSL are not available.
• Accessing satellite requires a satellite dish, two modems (uplink and downlink), and coaxial cables between the dish and modem.
• A router connects to a satellite dish pointed at a service provider satellite.
• Signals travel to and from a satellite in geosynchronous orbit, approximately 35,786 kilometers (22,236 miles).

Installation of satellite internet

• Requires a clear view toward the equator, where most orbiting satellites are located.
• Trees and heavy rains may negatively affect signal reception.
• Satellite internet offers two-way data communications for uploads and downloads.
• Upload speeds are about one-tenth of download speeds.
• Download speeds range from 5 Mbps to 25 Mbps.

WiMAX

• Worldwide Interoperability for Microwave Access (WiMAX), a new technology and is just beginning to come into use.
• It is described in IEEE standard 802.16.
• WiMAX provides high-speed broadband service with wireless access and broad coverage.
• It offers coverage similar to a cell phone network, differing from Wi-Fi hotspots.
• WiMAX operates like Wi-Fi but with higher speeds, greater range, and more users.
• It uses a network of WiMAX towers, similar to cell phone towers.
• To access WiMAX, users must subscribe to an ISP with a WiMAX tower within 30 miles of their location.
• WiMAX access requires a WiMAX receiver and a special encryption code to access the base station.
• WiMAX has largely been replaced by LTE for mobile access and cable, or DSL for fixed access.

VPN Technology

• Security risks arise when remote workers use broadband to access the corporate WAN over the internet.
• To address security, broadband services provide Virtual Private Network (VPN) connections to a network device at the corporate site.

VPN Basics

• A VPN is an encrypted connection between private networks over a public network like the internet.
• Instead of a dedicated Layer 2 connection (e.g., a leased line), a VPN uses virtual connections called VPN tunnels.
• VPN tunnels route data through the internet from the company's private network to the remote site or employee host.
• Security is a key benefit of using VPN.

Cost savings of VPN

• VPN enables organizations to use the global internet to connect remote offices and remote users to the main corporate site.
• Reduces the need for expensive, dedicated WAN links and modem banks.

Security in VPN

• VPN provides high security using advanced encryption and authentication to protect data from unauthorized access.

Scalability in VPN

• It is easy to add new users because VPNs use the internet infrastructure within ISPs and devices.
• Corporations can add large amounts of capacity without adding significant infrastructure.

Compatibility with broadband technology

• VPN technology is supported by broadband service providers like DSL and cable.
• VPNs allow telecommuters to utilize home high-speed internet services to access corporate networks.

Further Points on VPNs

• Business-grade, high-speed broadband connections offer a cost-effective solution for connecting remote offices.
• VPNs are implemented as Site-to-site VPN, and Remote Access.

Site-to-site VPN

• VPN settings are configured on routers, data is encrypted without the client's awareness.

Remote Access

• Remote Access connection requires the user to initiate the connection.
• This can be done by using HTTPS in a browser or by using VPN client software.

Single-homed ISP Connectivity

• Involves using one link for internet access
• Deployed when internet access is not critical.
• It is the least expensive of the connectivity solutions
• Provides no redundancy.

Dual-homed ISP Connectivity

• Uses two links to connect to the same ISP for internet access.
• Offers redundancy and load balancing.
• Both links can balance traffic when working properly.
• It connects to the same ISP using two links
• The organization loses connectivity if the ISP has an outage.

Multihomed ISP Connectivity

• Client connects to internet via two different ISPs.
• Offers redundancy and load balancing.
• Potentially more expensive.

Dual-multihomed ISP Connectivity

• Client connects to multiple ISPs using redundant links.
• It's the most resilient topology, providing maximum redundancy.
• Most costly option.

Broadband Solution Comparison

• Every broadband solution comes with advantages and disadvantages.
• A direct fiber-optic cable connection to the client network is an ideal solution
• Due to the limited option, some locations only offer cable or DSL, and some have broadband wireless only.

Cable

• Bandwidth is shared by users, causing upstream data rates to be slower during peak usage due to over-subscription.

DSL

• Bandwidth is limited by distance from the ISP central office.
• Upload rates are proportionally lower than download rates.

Fiber-to-the-Home

• Requires direct fiber installation to the home.

Cellular/Mobile

• Coverage issues may occur, even in small offices or home offices, where bandwidth is limited

Municipal Wi-Fi

• Few municipalities have a mesh Wi-Fi network deployed.
• A viable option for those in range if available.

Satellite

• Expensive and provides limited capacity per subscriber.
• Typically, in areas where no other option is available.

Virtual Private Network

• VPNs secure network traffic between sites and users by creating end-to-end private connections.
• A VPN carries information within a private network over a public network.
• Traffic is encrypted to keep data confidential.

VPN Use Cases

• Enterprises often use VPNs, managed from their main site, to connect remote sites and users to network resources.
• Cisco Adaptive Security Appliance (ASA) firewalls offer secure, high-performance connectivity, including VPNs.
• Cisco ASA firewalls are useful for remote branches and mobile users.
• SOHO (small office/home office) can use a VPN-enabled router to provide VPN connectivity back to the corporate main site.

Cisco AnyConnect

• It's software for remote workers to establish client-based VPN connections with the main site.

Modern VPNs

• They now support encryption features like Internet Protocol Security (IPsec) and Secure Sockets Layer (SSL) VPNs to secure network traffic between sites.
  • Benefits include cost savings and security.

Costs Savings with VPN

• Organizations can reduce costs and increase remote connection bandwidth by using cost-effective, high-bandwidth technologies

Security with VPN

• VPNs employ advanced encryption and authentication to protect data, offering the highest level of available security.

Scalability

• It's easy to add new users because organizations can use the internet without significant infrastructure additions

Compatibility

• VPNs can be implemented across various WAN link options, including broadband technologies.
• Remote workers can use high-speed connections to securely access corporate networks.

Site-to-Site VPN

• Created when VPN terminating devices i.e VPN gateways, are preconfigured with information to establish a secure tunnel.
• VPN traffic is only encrypted between these devices.
• Internal hosts are unaware of VPN usage

Remote-Access VPN

• Dynamically created to secure a connection between a client and a VPN terminating device.
• A remote access SSL VPN when checking banking information online, for example.

Enterprise VPNs

• A common solution for securing enterprise traffic across the internet.
• Site-to-site and remote access VPNs are created and managed by the enterprise using both IPsec and SSL VPNs.

Service Provider VPNs

• Created and managed over the provider network.
• The provider uses Multiprotocol Label Switching (MPLS) at Layer 2 or Layer 3 to create secure channels between a customer's sites.
• MPLS is a routing technology to create virtual paths between sites which segregates traffic and prevent mingling.
• Legacy solutions include Frame Relay and Asynchronous Transfer Mode (ATM) VPNs.

Remote Access VPNs Enable Encrypted Tunnels

• They enable connections for remote, mobile workers to securely connect and replicate enterprise security access to include email and network applications.
• Remote-access VPNs also allow contractors and partners to gain limited access.

Flexibility of Access

• Access can be granted to specific servers, pages, or files as needed
• Productivity without compromising security.

Clientless VPN connection

• Web browser SSL connection secures the connection.
• SSL protects HTTP traffic, HTTPS, and email protocols, IMAP and POP3.
• HTTPS is HTTP using an SSL tunnel.
• The SSL connection is established first, followed by the exchange of HTTP data.

Client-based VPN connection

• VPN client software, such as Cisco AnyConnect Secure Mobility Client, must be installed on the user’s end device.
• Users initiate the VPN connection using the VPN client, and then authenticate to the VPN gateway.
• Authenticated remote users gain access to corporate files and applications.

SSL VPNs & TLS

• When a client negotiates an SSL VPN connection with the VPN gateway, it connects using Transport Layer Security (TLS).
• TLS is a newer version of SSL, and expressed as SSL/TLS.
• Public key infrastructure and digital certificates are used by SSL to authenticate peers.

IPsec Versus SSL VPN

• Both technologies grant access to virtually any network application or resource.
• IPsec is preferable when security is the primary concern.
• Use SSL if support and deployment ease.
• The type of VPN method implemented is based on user access requirements and IT processes.

IPsec & SSL Remote Access Deployments

• A comparison IPsec and SSL remote access configurations can be seen in a table

IPsec Applications Supported

• Supports all IP-based applications.

SSL Applications Supported

• SSL supports only web-based applications and file sharing.

IPsec Authentication Strength

• Uses two-way authentication with shared keys or digital certificates.

SSL Authentication Strength

• One-way or two-way authentication is used.

IPsec Encryption Strength

• Key lengths are used from 56 bits to 256 bits.

SSL Encryption Strength

• Key lengths are used from 40 bits to 256 bits.

IPsec Connection Complexity

• Requires a VPN client pre-installed on a host.

SSL Connection Complexity

• SSL only requires only a web browser on a host.

Connection Option IPsec

• Limited to specific-configuration devices only can connect.

Connection Option SSL

• Device that had web browser, and only device that web browser can connect.

Site-to-Site IPsec VPNs:

• Connect networks across another untrusted network such as the internet.
• End hosts send and receive normal unencrypted TCP/IP traffic through a VPN terminating device.
• The VPN terminating is typically a VPN gateway, which can be a router or a firewall.
• A Cisco Adaptive Security Appliance (ASA) combines firewall, VPN concentrator, and intrusion prevention functionality into one software image.

VPN Gateway Actions

• Encapsulates and encrypts outbound traffic.
• Sends traffic through a VPN tunnel over the internet to a VPN gateway at the target site.
• Upon receipt, receiving VPN gateway strips the headers, decrypts the content, and relays the packet toward the target host inside its private network

Site-to-site VPNs Typically

• Site-to-site VPNs are created and secured using IP security (IPsec). Can be created using GRE over IPsec as well.

Generic Routing Encapsulation (GRE)

• A non-secure site-to-site VPN tunneling protocol.
• It can encapsulate various network layer protocols.
• Can support multicast and broadcast traffic which may be necessary if the organization requires routing protocols to operate over a VPN.
• It does not by default support encryption, so it doesn't provide a secure VPN tunnel.

IPsec VPN non GRE

• Can only create secure tunnels for unicast traffic and not multicast traffic. Therefore, routing protocols will not exchange routing information over an IPsec VPN.

GRE/IPsec Encapsulation

• Terms to describe the encapsulation are passenger protocol, carrier protocol, and transport protocol.

Passenger Protocol

• The original packet that is to be encapsulated by GRE.
• It can be an IPv4 or IPv6 packet, a router update, and more.

Carrier Protocol

• GRE is the carrier protocol that encapsulates the original passenger packet.

Transport Protocol

• Protocol that will be used forward the packet.
• Can be IPv4 or IPv6.
• Branch and HQ would like to exchange OSPF routing information over an IPsec VPN and uses GRE over IPsec, OSPF packets will encapsulated.