Cisco CCNA Preparation · lesson 28 of 36 · 25 min
VPNs — Virtual Private Networks
VPNs create encrypted tunnels over untrusted networks (the internet). Two main types on CCNA:
Site-to-Site VPN — connects two networks permanently. Routers at each site are the VPN endpoints (peers). Traffic between the sites is encrypted transparently — end devices are unaware of the VPN.
Remote Access VPN — individual users connect to the corporate network from anywhere. The client software (Cisco AnyConnect) creates the tunnel. Uses SSL/TLS or IPsec.
IPsec Framework — IPsec is not a single protocol but a suite:
IKE (Internet Key Exchange) — negotiates security associations (SAs) and exchanges keys. IKEv2 is preferred. Two phases: Phase 1 (authenticate peers, establish IKE SA) and Phase 2 (negotiate IPsec SA for data).
AH (Authentication Header) — provides integrity and authentication but NO encryption. Protocol 51.
ESP (Encapsulating Security Payload) — provides encryption, integrity, and authentication. Protocol 50. Used in almost all real deployments.
Tunnel mode — encrypts the entire original IP packet (adds new IP header). Used for site-to-site VPNs.
Transport mode — encrypts only the payload (original IP header preserved). Used for host-to-host.
AAA — Authentication, Authorization, Accounting
AAA is the framework for controlling access to network devices and resources.
Authentication — who are you? (username/password, certificate, MFA)
Authorization — what are you allowed to do? (privilege levels, command sets)
Accounting — what did you do? (logs commands executed, session duration, bytes transferred)
Two AAA protocols on CCNA:
RADIUS — UDP ports 1812 (auth) and 1813 (accounting). Encrypts only the password. Open standard. Used for network access (802.1X, VPN).
TACACS+ — TCP port 49. Encrypts the entire payload. Cisco proprietary. Separates authentication, authorization, and accounting into independent transactions. Preferred for device administration (CLI access).
Wireless Security — WPA, WPA2, WPA3
Wireless security has evolved through several standards:
WEP — broken, never use. RC4 cipher with static keys, easily cracked in minutes.
WPA — transitional fix using TKIP (Temporal Key Integrity Protocol). Still weak — avoid.
WPA2 — current standard. Uses AES-CCMP for encryption. Two modes:
— WPA2-Personal (PSK): pre-shared key, suitable for home/small office.
— WPA2-Enterprise (802.1X): each user authenticates with unique credentials via RADIUS. Required for corporate environments.
WPA3 — latest standard. Uses SAE (Simultaneous Authentication of Equals) instead of PSK — resistant to offline dictionary attacks. WPA3-Enterprise uses 192-bit security suite.
Common wireless attacks: Evil twin (rogue AP mimicking legitimate SSID), deauthentication attack (force clients to reconnect), KRACK (WPA2 key reinstallation), dictionary attack on PSK.
Exam Tip — WPA2 vs WPA3
WPA2-Personal is vulnerable to offline dictionary attacks against the 4-way handshake. WPA3-Personal uses SAE (Dragonfly handshake) which provides forward secrecy and is resistant to offline attacks even if the password is weak.
Key Terms
Key Terms
Knowledge Check — 12 Questions
Security — VPNs, AAA, Wireless
Which IPsec protocol provides encryption, integrity, and authentication?
- AH
- ESP
- IKE
- GRE
Answer: ESP
ESP (Encapsulating Security Payload) provides encryption + integrity + authentication. AH provides only integrity/authentication.
IPsec tunnel mode differs from transport mode because:
- Tunnel mode encrypts only the payload
- Tunnel mode encrypts the entire original IP packet and adds a new IP header
- Transport mode is used for site-to-site VPNs
- They use different encryption algorithms
- Answer: Tunnel mode encrypts the entire original IP packet and adds a new IP header
Tunnel mode wraps the entire original packet — used for site-to-site VPNs. Transport mode preserves the original IP header. TACACS+ is preferred over RADIUS for device administration because:
- It uses UDP for faster performance
- It encrypts the full payload and separates auth/authz/accounting
- It is an open standard
- It supports 802.1X natively
- Answer: It encrypts the full payload and separates auth/authz/accounting
TACACS+ encrypts the entire body (not just the password) and allows independent control of authentication, authorization, and accounting.
RADIUS uses which transport protocol and ports?
- TCP 49
- UDP 1812/1813
- TCP 1812/1813
- UDP 49
Answer: UDP 1812/1813
RADIUS uses UDP port 1812 for authentication/authorization and UDP 1813 for accounting.
WPA2-Enterprise uses which authentication method?
- Pre-shared key (PSK)
- 802.1X with RADIUS
- WEP with TKIP
- SAE (Dragonfly)
Answer: 802.1X with RADIUS
WPA2-Enterprise requires each user to authenticate individually via 802.1X and a RADIUS server.
Which wireless security standard uses SAE (Simultaneous Authentication of Equals)?
- WEP
- WPA
- WPA2
- WPA3
Answer: WPA3
WPA3 replaces PSK with SAE, which provides forward secrecy and resistance to offline dictionary attacks.
A site-to-site VPN requires VPN client software on each end-user device.
- True
- False
Answer: False
Site-to-site VPNs terminate at routers/firewalls — end devices are unaware of the VPN tunnel.
What does AAA Accounting provide?
- Verifies user identity
- Controls what commands a user can run
- Logs what users did (commands, session duration, bytes)
- Encrypts management traffic
Answer: Logs what users did (commands, session duration, bytes)
Accounting records user activity for audit trails — what was accessed, when, and for how long.
An evil twin attack involves:
- Flooding a switch with fake MACs
- A rogue AP mimicking a legitimate SSID to intercept traffic
- Cracking WPA2 handshakes offline
- Injecting fake ARP replies
- Answer: A rogue AP mimicking a legitimate SSID to intercept traffic
An evil twin AP broadcasts the same SSID as a legitimate AP — clients connect to it and traffic is intercepted.
IKE Phase _____ negotiates the IPsec SA used to protect actual data traffic.
Answer: 2
IKE Phase 1 establishes the management channel; Phase 2 negotiates the IPsec SA for encrypting data.
WEP should never be used because:
- It does not support AES
- Its RC4 implementation is broken and can be cracked in minutes
- It requires a RADIUS server
- It only supports 2.4 GHz
- Answer: Its RC4 implementation is broken and can be cracked in minutes
WEP uses a flawed RC4 implementation with static keys — tools can crack it in under a minute.
Which AAA component answers “what is this user allowed to do?”
- Authentication
- Authorization
- Accounting
- Auditing
Answer: Authorization
Authorization determines what an authenticated user is permitted to do — which commands, resources, or services they can access.
Previous lesson: Security concepts: threats, vulnerabilities, exploits, mitigation; password policies, MFA, certificates, biometrics
Back to Cisco CCNA Preparation
Next lesson: Named ACLs, ACL placement (inbound vs outbound), wildcard masks, verification