Site-to-Site VPN Technologies

A site-to-site Virtual Private Network (VPN) is a secure connection between two or more entire networks over a public network, usually the internet. The key idea is that the VPN creates a 'tunnel' through the public internet. All data passing through this tunnel is encrypted so that no one else can read or modify it. This allows two offices to behave as if they are on the same private network, even though they might be in different countries.

The most common technology for implementing site-to-site VPNs is IPsec (Internet Protocol Security). IPsec provides two main services: encryption to keep data secret, and authentication to ensure that the data comes from a trusted source and has not been tampered with. IPsec operates in two modes: tunnel mode and transport mode. In tunnel mode, the entire original IP packet (including its header) is encrypted and placed inside a new IP packet. This is the mode used for site-to-site VPNs. In transport mode, only the payload of the packet is encrypted, which is more commonly used for end-to-end connections between individual devices.

When using IPsec for a site-to-site VPN, the process begins with two VPN gateways (the devices at each site, often routers or firewalls) establishing a secure connection. This is done through a series of steps called the Internet Key Exchange (IKE). IKE has two phases. Phase 1 creates a secure, but not yet tunnel-ready, channel between the two gateways. They authenticate each other using a pre-shared key (a secret password shared in advance) or digital certificates. Phase 2 establishes the actual IPsec tunnel and negotiates the encryption keys and algorithms that will be used for the data traffic.

Once the tunnel is set up, all traffic between the two networks is encapsulated and encrypted at one end and decapsulated and decrypted at the other. Imagine sending a sealed envelope inside a locked box. The box goes through the public mail system, but only the intended recipient has the key to open the box and read the envelope. The network devices at each site handle this without the users needing to think about it.

There are different types of site-to-site VPN technologies. The most traditional is the policy-based VPN, where the administrator defines rules about which traffic should be encrypted (e.g., traffic between the 192.168.1.0 network and the 10.0.0.0 network). The second is the route-based VPN, which uses a virtual tunnel interface (VTI). In this model, you create a virtual interface on the router, and you use routing protocols to decide which traffic goes into the tunnel. This is more flexible and easier to manage at scale.

Another important concept is the difference between a full mesh and a hub-and-spoke VPN. In a full mesh, every site can connect directly to every other site. This is good for performance but becomes complicated when you have many sites. In a hub-and-spoke, all sites connect to a central hub site. Remote offices connect through the hub to reach each other, which simplifies management but can create a bottleneck.

Why does this matter? Before site-to-site VPNs, companies had to lease dedicated private lines (leased lines) from telecom providers to securely connect offices. This was extremely expensive. Site-to-site VPNs replaced those expensive leased lines by using the cheaper internet, while still providing the same level of security through encryption. For the 350-701 exam, you should also understand that site-to-site VPNs are not the same as remote-access VPNs, which allow individual employees to connect from their home computers to the office. In a site-to-site VPN, the two networks are always connected, so resources are always available to both offices, just like a single large network.

An IT professional securing a company with two branch offices needs to connect the main office in London to a branch office in Manchester so that employees in Manchester can access the company's central file server and database. Instead of paying for an expensive private leased line, the IT professional will configure a site-to-site IPsec VPN between the two office firewalls.

Here is what happens step by step:

This scenario shows the practical steps involved. The IT professional does not need to worry about each packet's route through the internet; the VPN handles that. Their job is to configure the gateways correctly, choose strong security parameters, and monitor the connection for issues.