CompTIA Network+ Preparation · lesson 19 of 30 · 25 min
VPN Fundamentals
A VPN (Virtual Private Network) creates an encrypted tunnel over a public network (the internet), allowing secure communication as if the devices were on the same private network.
VPN use cases: Remote workers accessing corporate resources, site-to-site connectivity between branch offices, securing traffic on public Wi-Fi.
Tunneling — encapsulating one protocol inside another. The original packet is encrypted and wrapped in a new packet for transport across the public network.
Split tunneling — only corporate-destined traffic goes through the VPN; internet traffic goes directly. Reduces VPN load but less secure. Full tunnel sends all traffic through VPN.
VPN Types and Protocols
Site-to-site VPN — permanent tunnel between two networks (e.g., headquarters and branch office). Routers or firewalls at each end handle the VPN — end users are unaware.
Remote access VPN — individual users connect to the corporate network from anywhere. Requires VPN client software on the user’s device.
IPsec — suite of protocols for securing IP communications. Two modes: Transport mode (encrypts payload only) and Tunnel mode (encrypts entire packet — used for VPNs). Uses AH (Authentication Header) and ESP (Encapsulating Security Payload). IKE (Internet Key Exchange) negotiates keys.
SSL/TLS VPN — uses SSL/TLS (port 443) for the tunnel. Works through firewalls and proxies that allow HTTPS. Clientless (browser-based) or thin-client. Common for remote access.
L2TP/IPsec — L2TP provides the tunnel, IPsec provides encryption. Uses UDP 1701 (L2TP) and UDP 500/4500 (IKE). Common on older systems.
OpenVPN — open-source VPN using SSL/TLS. Highly configurable. Uses UDP 1194 by default.
WireGuard — modern, fast VPN protocol. Simpler codebase than IPsec. Uses UDP port 51820.
Exam Tip
IPsec Tunnel mode encrypts the entire original packet. SSL VPN uses port 443 — passes through most firewalls. Split tunneling reduces VPN load but bypasses security controls for internet traffic.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Network+ — VPNs and Remote Access
IPsec Tunnel mode encrypts:
- Only the payload
- The entire original IP packet including headers
- Only the TCP header
- Only the application data
- Answer: The entire original IP packet including headers
Tunnel mode wraps the entire original packet (headers + payload) in a new encrypted packet — used for VPNs. Transport mode encrypts payload only.
SSL/TLS VPNs use which port?
- 1194
- 1701
- 443
- 500
Answer: 443
SSL VPNs use TCP 443 (HTTPS) — this port is almost always allowed through firewalls, making SSL VPNs very firewall-friendly.
Split tunneling means:
- Two VPN tunnels run simultaneously
- Only corporate traffic uses the VPN; internet traffic goes direct
- The VPN splits encryption keys
- Half the data is encrypted
- Answer: Only corporate traffic uses the VPN; internet traffic goes direct
Split tunneling reduces VPN bandwidth but means internet traffic bypasses corporate security controls. IKE is used in IPsec to:
- Encrypt the data payload
- Negotiate security associations and exchange keys
- Authenticate web certificates
- Route VPN traffic
- Answer: Negotiate security associations and exchange keys
IKE (Internet Key Exchange) handles the negotiation phase — establishes the Security Association (SA) and exchanges cryptographic keys. A site-to-site VPN connects:
- Individual users to a corporate network
- Two entire networks (e.g., HQ and branch office)
- A user to a public Wi-Fi hotspot
- Two individual computers
- Answer: Two entire networks (e.g., HQ and branch office)
Site-to-site VPN: permanent tunnel between network gateways. End users are unaware — traffic is automatically encrypted at the gateway.
WireGuard uses which port by default?
- 1194
- 500
- 51820
- 443
Answer: 51820
WireGuard uses UDP 51820 by default. It is a modern VPN protocol known for its simplicity and performance.
Which IPsec component provides encryption?
- AH (Authentication Header)
- ESP (Encapsulating Security Payload)
- IKE
- ISAKMP
Answer: ESP (Encapsulating Security Payload)
ESP provides both encryption and authentication. AH provides authentication only (no encryption). ESP is used in most VPN deployments.
A clientless SSL VPN allows access through:
- A dedicated VPN client app
- A web browser only
- IPsec only
- A physical token only
- Answer: A web browser only
Clientless SSL VPN uses the browser — no software installation needed. Users access web-based resources through an HTTPS portal.
L2TP provides which VPN function?
- Encryption
- Tunneling (relies on IPsec for encryption)
- Authentication only
- Key exchange
Answer: Tunneling (relies on IPsec for encryption)
L2TP creates the tunnel but provides no encryption itself. It is paired with IPsec (L2TP/IPsec) to add encryption.
IPsec uses _____ mode for VPN tunnels that encrypts the entire original packet.
Answer: Tunnel
IPsec Tunnel mode encrypts the entire original IP packet and adds a new IP header — standard for VPN gateways.
Previous lesson: High availability: redundancy, HSRP/VRRP, link aggregation, load balancing
Back to CompTIA Network+ Preparation
Next lesson: Network performance optimization: QoS, traffic shaping, bandwidth management