Home

VPN (Virtual Private Network)

December 13, 2012

Miftah Rahman Network Theory , , , , , , , , , , , , , , , , , , , , , 8 Comments

What is VPN…VPN adalah suatu cara agar perusahaan dapat terhubung ke tempat lain (dalam hal ini bisa aja Branch Office) melalui public infrastructure tanpa bisa diketahui oleh orang lain yang memakai public infrastructure yang sama

Berdasarkan Geography:

  • Site-to-Site VPN
  • Remote Site VPN

Berdasarkan Service:

  • L2 VPN (Overlay VPN)
  • L3 VPN (Peer-to-Peer VPN)

 

Analogy:

Di samudra yang luas (internet/ISP) terdapat banyak pulau (LAN, Office LAN, etc.), untuk menghubungkan pulau yang satu dengan yang lain dapat menggunakan Ferry (Public Infrastructure such as Cable Modem and ADSL) dimana semua orang bisa liat apa yang akan kita lakukan, kemana arah yang kita tuju, mau ngapain kesana (belum lagi penumpang Ferry nya biang gosip…wkwkwk)

Ok..Ferry out of option…berhubung pulaunya deket, kita kasih jembatan aja (Leased Line) selesai (banyak Company memakai opsi ini)

Tapi kalau jauh gimana ?? Cost nya bengkak…bikin kabel, gali tanah, pasang2 lagi aja uda berapa biayanya, belum lagi maintenance nya

Solusinya adalah kita buat Kapal Selam (VPN), nyelem dibawah laut…ga ada yang tau kita mo ngapain (ter-enkripsi dengan IPsec)…lebih murah dari bikin jembatan kan

nah…untuk bikin jalur bawah laut (tunneling) agar kapal selam kita bisa jalan, kita bisa pake GRE (generic Routing Encapsulation)

supaya jalur bawah laut itu aman (GRE ga ada fitur enkripsi) dipasangin dengan IPSec

so thats whay…GRE dan IPSec itu biasanya selalu digandeng…

kapan kita belajar GRE ?? salah satunya klo mo belajar versi lain dari OSPF Virtual-Link atau IPv6 Tunneling

kapan kita belajar IPSec ?? klo kita mo belajar konfig VPN (nanti link nya gw buat)

====================================

Yah…kira2 begitu analogi nya

Site-to-Site VPN

Site-to-Site VPN ini ya kek WAN biasa (Branch ke MainOffice), dimana alat yang jaga MainOffice dari “Serangan dunia luar” adalah Router/Firewall/ASA (Adaptive Security Appliance) – Cisco Firewall

Yang bertugas ngalirin traffic VPN nya VPN Gateway (yaitu Router/ASA/Firewall)…jadi di Gateway diencapsulasi…pas sampe target (branch misalnya) packet tersebut di decapsulasi…dengan metode IPsec

Yang membedakan Remote Access dengan Site-to-Site adalah Third Party Client nya, klo di Site-to-Site…masing2 end point (alias Router) dikasi settingan VPN (cek lagi gambar site-to-site)

Nah klo Remote End-point nya di kasi Software buat VPN (contoh Cisco EasyVPN), soalnya konek lewat broadband access kek ADSL dan Cable, ato pake Web Browser (Clientless VPN)

A VPN creates a private network over a public network infrastructure while maintaining confidentiality and security (jadi seakan2 ada tunnel gitu dan seakan2 itu Branch & Office “satu LAN”)

====================================================

Characteristic VPN

Data Confidentiality: achieved through Encapsulation (via IPsec) & Encryption (via 3DES, AES, or RSA), jadi ga bisa di baca packet nya oleh yang tidak berhak

Data Integrity: use Hashing Technique (such as MD5), Hash atau Hashing itu adalah metode untuk ensure ketika data diterima…data itu Masih ASLI, belum diMODIFIKASI, dan belum DIBACA

Salah satu dari Hashing Algoritma adalah Message Digest 5 (MD5) – Uses a 128-bit shared secret key. The message and 128-bit shared secret key are combined and run through the HMAC-MD5 (Hashed Message Authentication Code) hash algorithm. The output is a 128-bit hash. hasil hash yang 128-bit tadi ditambah ke original message and forwarded to the remote end (wokeh..silakan mencerna sendiri…hahaha)

Sebenernya adalagi sih, namanya SHA-1 (Secure Hash Algorithm 1) 160 bit, tapi gw males jelasinnya….hahaha (ga ngerti dan ga pernah make)

Authentication: ensure data come from the right person and arrive at the right person too

==========================================================

Encryption

Cara kerja enkripsi itu kira2 seperti ini

In the example, Gail wants to send a financial document to Jeremy across the Internet. Gail and Jeremy have previously agreed on a secret shared key (kita bisa bilang password lah). At Gail’s end, the VPN client software combines the document with the secret shared key and passes it through an encryption algorithm. The output is undecipherable cipher text. The cipher text is then sent through a VPN tunnel over the Internet. At the other end, the message is recombined with the same shared secret key and processed by the same encryption algorithm. The output is the original financial document, which is now readable to Jeremy.

Algoritma Enkripsi Simetris: 1 key untuk Enkripsi dan Dekripsi

Algoritma Enkripsi Asimetris: 1 Key untuk Enkripsi dan 1 Key untuk Dekripsi

Type2 Algorithm:

  • DES (Data Encryption Standard) – di develop oleh IBM (use 56 bit length key)…Symmetric Algorithm
  • 3DES – newer version than DES, Asymmetric Algorithm (digambar atas malah dia Symmetric…!!!!, ckckck)
  • AES (Advanced Encryption Standard) – di develop oleh NIST (National institute of Standards and Technology)..often use 128 bit
  • RSA (Rivest, Shamir, and Adleman) – didevelop oleh ketiga orang itu, use 256, 512, 1024, or larger key

Catatan dalam memilih Tipe Enkripsi:

Semakin Bagus Enkripsi, semakin lama dipecahkan kode nya, tetapi semakin lambat proses transfer nya

Semakin Minimal Enkripsi, semakin cepat dipecahkan kode nya, tetapi semakin cepat proses transfer nya

Ingat…dalam dunia komputer TIDAK ADA YANG 100% Secure, yang ada hanya MEMPERLAMA Penjahat dalam menjalankan aksinya

Berarti Enkripsi bisa dipecahkan donk?? Bisa…tergantung CPU komputer hacker nya…semakin bagus..semakin cepat dipecahkan

Untuk memecahkan password 9 karakter yang terdiri dari huruf kecil, besar, angka, dan spesial karakter saja yang di enkripsi 128 bit aja untuk komputer cpu i7 aja bisa butuh waktu berjam2…

Tujuan enkripsi itu simpel nya adalah untuk membuat hacker MALES nge-hack, karena kelamaan

Tapi kan bisa aja niat ?!?!

Nah itu dia…biasanya tiap 1 bulan sekali, 1 minggu sekali, bahkan 1 hari sekali…untuk data center dengan confidentialitas yang tinggi biasanya password selalu diganti (mecahin 1 kode aja uda susah , berhari2 pula…eh pas dapet passwordnya…uda diganti..hahahaha)

Gw ga jelasin gimana sih cara masing2 tipe enkripsi itu proses nya…mabok coy !!!, lo aja yang liat…gw mah males

=======================================================================

IPSec

*ESP = Encapsulation Security Payload

*AH = Authentication Header

*DH = Diffie-Hellman algorithm, memungkinkan 2 orang user yang mo exchange data untuk establish a shared secret key yang digunakan oleh encryption dan hash algorithms, for example, DES and MD5, over an insecure communications channel (insecure ini mungkin menurut gw kek kabel telepon??VSAT??i don’t know…Wi-Fi ada TKIP-AES juga untuk enkripsi kok…pokoknya untuk urusan enkrip-mengenkrip mah puyeng gw @_@

========================================

VPN implementation ada 2 tipe:

  • Overlay VPN: ISP hanya provide koneksi saja (jadi ISP menyediakan koneksi point-to-point dari HQ ke Branch)
  • Peer-to-Peer VPN: ISP juga ikut berpartisipasi dalam proses routing

Overlay VPN

Overlay VPN

benefit:

  • gampang di-implement, karena ISP ga ikut2an routing…nyediain “transport” aja

drawback:

  • klo ada additional VPN, nambah lagi link didalem ISP nya, susah di manage

Peer-to-Peer VPN

Peer-to-Peer VPN

benefit:

  • gampang di manage
  • gampang di-utak-atik optimum routing path nya

drawback:

  • harus tahu detail IP routing

ada lagi yang dinamakan Central Service VPN

Central Service VPN adalah fitur untuk multiple VPN menggunakan server yang sama (biasanya untuk data center), jadi company A,B, dan C bisa ke Server A, tapi A ga bisa ke B dan C (begitu juga sebaliknya)…mirip ke point-to-multipoint topologi, cuma ini VPN

Mudah2an Next Article gw bisa buat secara detail about how to configure VPN on Cisco Router

Planning and Cabling Network

January 24, 2012

Miftah Rahman Uncategorized , , , , , , , , , , , , , , , , , Leave a comment

Device Selection Factor

Deciding What Switch to use (read: to Buy :p )

Selecting a Router

We need to match the characteristics of the router to its purpose. Similar to the switch, cost and interface types and speeds must be considered as well. Additional factors for choosing a router include:

  • Expandability: bisa di tambah2in ga ?? sama kek motor…bisa di kasi aksesoris lagi ga…nambah port ?? nambah modul ???
  • Media: mo pake Ethernet ?? serial?? Coaxial ??? ato kedua2nya…??
  • Operating System Features: Depending on the version of the operating system, the router can support certain features and services such as:
    • Security
    • Quality of Service (QoS)
    • Voice over IP (VoIP)
    • Routing multiple Layer 3 protocols
    • Special services such as Network Address Translation (NAT) and Dynamic Host Configuration Protocol (DHCP)

Juniper Router J2350

For the selection of devices, the budget is an important consideration. Routers can be expensive based on interfaces and features needed. Additional modules, such as fiber-optics, can increase the costs. The media used to connect to the router should be supported without needing to purchase additional modules

LAN Cabling

When planning the installation of LAN cabling, there are four physical areas to consider:

  • Work area
  • Telecommunications room, also known as the distribution facility
  • Backbone cabling, also known as vertical cabling
  • Distribution cabling, also known as horizontal cabling
    • Total length : contoh > FastEthernet hanya bisa 100m SEBELUM sinyal elektromagnetiknya mulai melemah

Each media type has its advantages and disadvantages. Some of the factors to consider are:

  • Cable length – Does the cable need to span across a room or from building to building?
  • Cost – Does the budget allow for using a more expensive media type? (use Fiber Optic maybe ?? wkwkwk)
  • Bandwidth – Does the technology used with the media provide adequate bandwidth?
  • Ease of installation – Does the implementation team have the ability to install the cable or is a vendor required? (use Wireless ???)
  • Susceptible to EMI/RFI – Is the local environment going to interfere with the signal?

Typically, when connecting different types of devices, use a straight-through cable. And when connecting the same type of device, use a crossover cable.

Straight-Through = buat Komputer “vs” Switch, Switch “vs” Router (dipakai buat yg berbeda jenis)

Cross-Over = Switch “vs” Switch, Router “vs” Router, Komputer “vs” Router (koq Komputer dengan Router ?? Router itu punya CPU sama kek Komputer…JADIIII anggep Router itu computer juga…dan memang computer kan bisa dijadiin Router juga kan ??)

Many devices allow the UTP Ethernet port to be set to MDI or MDIX. This can be done in one of three ways, depending on the features of the device:

  1. On some devices, ports may have a mechanism that electrically swaps the transmit and receive pairs. The port can be changed from MDI to MDIX by engaging the mechanism.
  2. As part of the configuration, some devices allow for selecting whether a port functions as MDI or as MDIX.
  3. Many newer devices have an automatic crossover feature.

This feature allows the device to detect the required cable type and configures the interfaces accordingly. On some devices, this auto-detection is performed by default. Other devices require an interface configuration command for enabling MDIX auto-detection. (jadi fitur MDI/MDIX itu kek lo masukin kabel straight dari switch ke switch….otomatis switch jadiin cross over,klo ga sala Router ga ada Fitur MDI/MDIX secara default de, switch ada, jadi mesti di konfig sendiri)

*RJ-11 = kabel telepon

Winchester konektor yang diatas biasanya terdapat di ISP untuk CSU/DSU

CSU/DSU (Channel Service Unit/Data Service Unit) = Hardware device yang meng konversi frame data digital dari LAN ke WAN atau sebaliknya

DSL Router..biasanya si buat ADSL (Asymmetric Digital Subscriber Line), tapi gambar yg diatas adalah versi Cisco….MAHAL PASTINYA…mending yang diabang2 elektronik…beli modem bang !! hahaha

The following terms describe the types of devices that maintain the link between a sending and a receiving device:

  • Data Communications Equipment (DCE) – A device that supplies the clocking services to another device. Typically, this device is at the WAN access provider end of the link.
  • Data Terminal Equipment (DTE) – A device that receives clocking services from another device and adjusts accordingly. Typically, this device is at the WAN customer or user end of the link.

If a serial connection is made directly to a service provider or to a device that provides signal clocking such as a channel service unit/data service unit (CSU/DSU), the router is considered to be data terminal equipment (DTE) and will use a DTE serial cable. (pokoknya yang buat clock rate adalah DCE)

DCEs and DTEs are used in WAN connections. The communication via a WAN connection is maintained by providing a clock rate that is acceptable to both the sending and the receiving device. In most cases, the telco or ISP provides the clocking service that synchronizes the transmitted signal.

For example, if a device connected via a WAN link is sending its signal at 1.544 Mbps, each receiving device must use a clock, sending out a sample signal every 1/1,544,000th of a second. The timing in this case is extremely short. The devices must be able to synchronize to the signal that is sent and received very quickly.

By assigning a clock rate to the router, the timing is set. This allows a router to adjust the speed of its communication operations, thereby synchronizing with the devices connected to it.

*nanti ada kasus tentang interface serial…”shut”..”no shut”…”protocol down”…”administratively down”…bla bla bla…nih link buat liat kasus serial kabel

Switch (yang manageable…bisa dipasangin IP…ya itu gunanya..untuk bisa di telnet trus di manage/konfig)

There are many reasons to divide a network into subnets:

  • Manage Broadcast Traffic – Broadcasts can be controlled because one large broadcast domain is divided into a number of smaller domains. Not every host in the system receives every broadcast.
  • Different Network Requirements – If different groups of users require specific network or computing facilities, it is easier to manage these requirements if those users who share requirements are all together on one subnet.
  • Security – Different levels of network security can be implemented based on network addresses. This enables the management of access to different network and data services.

Yang terhubung ke 1 switch…BIASANYA dijadikan satu subnet

Yang point-to-point kek interface port router ke interface port router yang lain…jadiin 1 subnet (contoh 192.168.1.0 /30…/30 berarti ada 2 host aja….192.168.1.1 dan 192.168.1.2)

Calculating Address


Without VLSM

With VLSM

How to configure Router/Switch (Under Windows XP)

we will usually use HyperTerminal because most varieties of Windows have it. This program can be found under All Programs > Accessories > Communications. Select HyperTerminal.

Open HyperTerminal, confirm the chosen serial port number, and then configure the port with these settings:

  • Bits per second: 9600 bps
  • Data bits: 8
  • Parity: None
  • Stop bits: 1
  • Flow control: None

How to configure Router/Switch (Under Windows Vista, 7, Linux)

use Putty / SecureCRT…

  • bisa telnet
  • atau Serial (liat dulu di serial / COM port berapa kepasang di komputer….cara liatnya klik kanan my computer –> properties –> device manager

Older Entries