What is a VPN, and what is the difference between site-to-site and remote access?
Show the answer
Say this first
A VPN carries private traffic across a network you do not trust, usually the internet, inside a tunnel. The tunnel adds a new outer header so the private addresses can cross the public network, and a security protocol such as IPsec, TLS or WireGuard adds encryption, integrity and peer authentication. Site-to-site joins whole networks: two gateways keep a tunnel up and the hosts behind them do not know it exists. Remote access joins one user device to the company network: a client on the laptop builds the tunnel to a headend, with per-user authentication.
Go deeper
Site-to-site
- The tunnel ends on routers or firewalls at each site. Hosts need no software.
- Usually IPsec, often as a routed tunnel interface (VTI or GRE over IPsec) so a routing protocol can run across it.
- The gateways authenticate each other with pre-shared keys or certificates.
- At scale it becomes hub-and-spoke, DMVPN or an SD-WAN overlay.
Remote access
- A client on the endpoint: Cisco Secure Client (AnyConnect), GlobalProtect, FortiClient, WireGuard, or the IKEv2 client built into Windows, macOS, iOS and Android.
- User authentication through AAA (RADIUS, LDAP, SAML) with MFA, often plus a device posture check.
- The headend assigns an inner IP address from a pool and pushes DNS servers and routes.
- A split tunnel or full tunnel decision.
Other things called a VPN
An MPLS L3VPN is private by separation (VRFs and labels in the provider core), not by encryption. A consumer "VPN service" is remote access to a provider's internet exit point.
They will ask next
Is an MPLS L3VPN encrypted?
No. Privacy comes from separate routing tables (VRFs) and labels inside the provider network. If the data must be confidential from the provider too, run IPsec over it between the CE routers.
What would you deploy to connect 300 branches?
Something that does not need 300 tunnels typed by hand on the hub: DMVPN, or an SD-WAN overlay with a controller. Both give hub-and-spoke by default with on-demand spoke-to-spoke paths, and a routing protocol or the controller handles reachability.
Traps
- Saying a VPN is "just encryption". The tunnel and the inner vs outer addressing are the core idea. Plain GRE is a VPN tunnel with no security at all.