Virtual private network (VPN)
Also known as: vpn, virtual private network
A virtual private network creates a secure, encrypted connection across an untrusted network such as the internet, allowing remote sites or users to exchange data as if they were on the same private network. The encrypted path is commonly described as a tunnel.
A VPN solves a basic problem: private networks are expensive to extend over distance, while the internet is cheap but public. A VPN uses the public network as the transport and layers cryptography on top, so traffic between two endpoints is unreadable and unmodifiable by anyone in between. The endpoints encapsulate the original packet inside a new packet, send it across the internet, and decapsulate it at the far end — the tunnel that gives the technique its name.
Two deployment models cover most uses. A site-to-site VPN connects entire networks, typically a branch office to headquarters, with routers or firewalls at each end handling the encryption; users on either side need no client software. A remote-access VPN connects an individual device to the corporate network, usually through client software or a browser-based SSL/TLS session, which is what makes working from home equivalent to sitting in the office. IPsec is the traditional protocol suite for site-to-site tunnels, providing confidentiality through encryption, integrity through hashing, peer authentication, and anti-replay protection; SSL/TLS is more common for remote access.
Design details follow from those mechanics. Because IPsec by itself does not carry multicast or routing protocol traffic, tunneling protocols such as GRE are often run inside an IPsec tunnel so dynamic routing works across the VPN, and designs such as DMVPN scale that pattern to many branches. Encryption and encapsulation add processing overhead and reduce effective payload size, which is why attention to MTU matters on high-traffic links. And a VPN protects data in transit only — it does not replace endpoint security, firewalls, or access control lists.
The CCNA covers VPNs in its network security fundamentals domain, where you are expected to describe site-to-site and remote-access models, identify IPsec's security services, and place VPNs among other security controls. The CMA Part 1 exam approaches them from the governance side, listing VPNs among the technical controls organizations use to protect data against security breaches.
Key takeaways
- A VPN carries private traffic securely over a public network by encapsulating and encrypting it in a tunnel.
- Site-to-site VPNs connect whole networks; remote-access VPNs connect individual users or devices.
- IPsec provides confidentiality, integrity, peer authentication, and anti-replay protection and is standard for site-to-site tunnels.
- SSL/TLS-based VPNs are typical for remote access because they need little or no specialized client setup.
- A VPN secures data in transit only and does not substitute for firewalls, access control, or endpoint security.