Defining VPN

Let's expand on the VPN definition we provided back in Chapter 1. VPN combines two concepts: virtual networking and private networking. In a virtual network, geographically distributed and remote nodes can interact with each other the way they do in a network where the nodes are collocated. The topology of the virtual network is independent of the physical topology of the facilities used to support it. A casual user of the virtual network, not aware of the physical network setup, would only be able to detect the topology of the virtual network. A virtual network is also managed as a single administrative entity.

Private networks are usually defined as nonshared networking facilities combining hosts and clients that belong to the same administrative entity. A good example of a private network is a corporate intranet, which can only be used by a certain number of authorized individuals belonging to that particular corporation. Virtual private networking, thus, is the emulation of private secure data networks over public shared insecure telecommunications facilities (recall the MVPN definition in Chapter 1).

VPN properties include mechanisms for data protection and establishing trust among hosts in virtual networks and incorporation of various methods to enforce and maintain service level agreements (SLAs) and quality of service (QoS) for all entities that make up a Virtual Private Network. VPN can be defined from many perspectives. The preceding definition looks at VPN from a networking standpoint, which should serve us well for the purposes of this book.

In the past few years there have been various attempts to come up with a broader VPN definition that would include applications-level technologies such as TLS (see Chapter 2 for analysis of TLS versus VPN). Other sources deservedly argue that vendors and information technology communities took an overly simplified approach to the matter and turned the whole VPN concept into a generic networking term that is now widely exploited for marketing purposes. While acknowledging the validity of both points of view, especially in light of relative VPN newness, we still see a need for a common working definition for data VPN to transition to practical aspects of its implementation.