Network Security
by
Gary McCauley
|
August 13, 2020
VPNs (or Virtual Private Networks) are largely understood as a concept by many who are using networked connections that may involve sending and receiving sensitive data. Dynamic Multiple VPN, such as Cisco DMVPN, works to encrypt transmitted data much like a regular VPN. However, they do it in a way that can secure communications between branch offices in particular. It does this using a centralized architecture to provide easier implementation and management for deployments across the entire IT scope of the organization.
DMVPN Cisco is, effectively, a solution that allows different branch locations using the same resources to communicate directly and safely with one another via public WAN or internet connections, rather than having to use an internal network. The way that it does this doesn’t utilize a permanent VPN connection between the various sites, but rather through a centralized architecture that can apply VPN protection and granular access controls on an as-you-need-it basis. As such, when communications are open or access has to be granted to specific digital resources, it applies the security features of a VPN on a more selective basis. DVPN also integrates modes of communication, such as the VoIP system, into the protections of a VPN.
There is a range of benefits of using DMVPN over a permanent VPN, or in the case of DMVPN vs MPLS networks. The following are some of the most commonly cited benefits:
DMVPN allows data exchanges on a secure network without the use of a headquarter’s VPN server or router. While a VPN acts as a connector between remote sites and HQ, or between different branches, the DMVPN creates a mesh VPN protocol that can be applied selectively to connections being utilized in the business already. Each different site (or spoke) can connect to one another securely. This is done using VPN firewall concentrators and routers, with DMVPN configuration on the routers in place at remote sites to allow the DMVPN mesh to be applied to the connection that it’s making at the time.
There are three distinct types, or phrases, of DMVPN design, all of which can be found on the Cisco DMVPN design guide. To summarize them briefly, however, they are as follows:
As mentioned, the Hub and Spoke Network Architecture is a way to efficiently manage the endpoints that are being secured. There are three different phases, each of them suitable for different configurations. However, in general, the hub is used to configure the protocols by which the connections are secured, and these protocols are then applied to the spokes (or endpoints) of the network. This system can be centralized to ensure that allow spoke-to-spoke tunnels first go through the hub, or can be decentralized to cut the hub out entirely.
Dynamic Multiple VPN (or DMVPN) is a complex topic, but it’s a security configuration that could allow businesses that use a wide range of remote endpoints (or flexible endpoints that move location often) to make sure they can keep the security of their network in place, which making sure it’s flexible and not prohibitive in costs.