Remote Access Technologies

written by: Leon Tufallo; article published: year 2007, month 09;


In: Categories » Electronics and communication » Network security » Remote Access Technologies

A wide range of technologies can be used to provide remote access. Some of the traditional technologies include Frame Relay, leased lines, ISDN, and dialup links. Newer technologies include DSL, cable modems, and wireless technologies such as 802.11x.

VPNs have also become a significant technology in the past few years. They can provide an alternative to expensive leased lines in a central office/branch office scenario. Also, they can provide security to users who use them over DSL and cable modem networks to connect to the central office. IPSec VPNs are a good example of the latter scenario.

Frame Relay

Over the past few years Frame Relay has been one of the most popular remote-access technologies. It offers a high-speed connection between a central office and a branch office.

One of Frame Relay's benefits is built-in congestion control to combat bursty traffic. As bandwidth needs have increased over the years, this technology has proven very popular. Also, Frame Relay circuits can be ordered from providers in a variety of bandwidths. Starting at 56 kbps, these are usually fractions of a T1. This allows for flexibility when planning.

Some of the services that can be used over Frame Relay networks are data, voice over IP, voice over Frame Relay, and IP Multicast.

Frame Relay operates at Layer 2 by encapsulating Layer 3 traffic such as IP within a Frame Relay frame. To improve performance, Frame Relay relies on higher-layer protocols such as TCP to overcome corrupt or dropped frames that occur during transmission. This is different from protocols such as X.25 that have built-in error checking/correction. Often Frame Relay is described as a successor to X.25.

Frame Relay employs its own addressing scheme at Layer 2 to specify a frame's destination. This feature is called a Data Link Connection Identifier (DLCI). This field in the Frame Relay header tells the Frame Relay switch where to route the frame. The DLCI can be thought of as the Media Access Control (MAC) address in the Frame Relay network.

Another advantage of Frame Relay is its capability to establish one-to-many connections. This is often called point-to-multipoint. This capability can potentially allow the redirection of traffic around an outage, provided that a partially-meshed network exists.

One of Frame Relay's drawbacks is the high cost of provisioning links. The high cost can possibly be justified in a branch office scenario, but it might be unsuitable for single remote users.

Serial Links

This type of network has also been historically popular in connecting branch offices. These lines can be ordered from a fractional T1 such as 56 kbps up to DS3s. Possible fractional T1 line speeds include 56 kbps, 128 kbps, 256 kbps, and so on. A full DS3 has a speed of 45 Mbps.

These networks do not provide any of the congestion control and error-detection capabilities that Frame Relay provides. The onus is completely on the higher-layer protocols to provide such services.

As with Frame Relay, cost is also an issue with these links.

ISDN

Integrated Services Digital Network (ISDN) remains one of the most flexible and widely offered services today. Providers all over the world offer ISDN services to users.

ISDN basically comes in two varieties:

  • Basic Rate Interface (BRI), which consists of two 64-kbps Bearer (B) channels and one 16-kbps Data (D) channel. This is often represented as 2B+D, for the two B channels and one D channel. This has traditionally been the choice of many remote users who connect to the office from their residences. It remains popular, especially with users who do not have DSL or cable services available at their residences.

  • Primary Rate Interface (PRI), which in the U.S. consists of 23 64-kbps B channels and one 64-kbps D channel. This is often represented as 23B+D. In Europe, PRI consists of 30 64-kbps B channels and one 64-kbps D channel. PRI services are often used when greater bandwidth is needed, such as when a connection is needed between a central office and a branch office.

Even though ISDN is offered all around the world, there are differences in the switches that providers use to provide ISDN service. When configuring ISDN, make sure that the design and configuration match the switch type and service being offered.

ISDN makes use of the same wiring used by analog phone lines. However, because ISDN is digital, the signal transmitted across the line is digital instead of analog. This allows for much higher transmission speeds. In addition, call setup for ISDN is very quick compared to that of an analog line. This is because of the use of the separate D channel. The setup is done out-of-band on the D channel, it does not disturb existing user traffic, and it takes a short amount of time. The combination of these factors makes ISDN ubiquitous, fast, and convenient.

ISDN is useful when a variety of applications need to be supported. The higher bandwidth can support applications such as videoconferencing, web browsing, e-mail, and voice services. Also, ISDN can support multiple data sources, as opposed to analog, which typically can support only one data source at a time.

ISDN lends itself to a variety of applications in the remote-access arena. Users who want to connect from home or users in a small office/home office (SOHO) typically can use BRI connections to do so.

However, in a scenario where a branch office needs a connection to a central office, PRI services can be used either as a primary link or as a backup connection that can be activated when the primary line goes down or when additional bandwidth is needed. This is often called a remote office/branch office (ROBO) scenario.

ISDN does have some drawbacks. A variety of standards are supported in different parts of the world. This results in a variety of equipment needed to support these standards and interfaces. You have to be careful when ordering, configuring, and maintaining equipment that connects to ISDN providers in different parts of the world.

Another drawback of ISDN is its cost. Because ISDN is charged on a per-usage basis, it can be expensive to operate. This is one of the reasons why ISDN is used in many scenarios as a backup to a serial link that has a flat per-month cost.

Lately ISDN has been replaced in many homes and SOHO environments by technologies such as DSL and cable modems, which offer much higher transfer rates. These services are also cheaper because they offer flat-rate pricing. The combination of these factors has made these technologies more attractive than ISDN.

Analog

Analog dialup service is the most ubiquitous remote access available. All you need is a phone line and a modem. Speeds, which started out around 300 bps, have steadily increased over the years to 56 kbps.

Users using analog dialup usually connect to an access server using a modem. The provider that operates the access server gives the user a phone number. The user connects to the access server using that phone number.

If in the same calling area, the user can connect to the provider using a local phone number. If the user is not in the same calling area, many providers have toll-free numbers. This allows users to connect without incurring long distance charges or using calling cards.

Some providers also offer software that has a list of phone numbers organized by country. Users can use this software to select the appropriate number for their location. They can then connect from all over the world.

Users can also connect to the Internet via dialup and then use VPNs to connect to their corporate networks. Many operating systems now offer native VPN solutions such as Microsoft's Point-to-Point Tunneling Protocol (PPTP).

The most obvious drawback of dialup services is the speedor lack thereof. With applications becoming more and more bandwidth-intensive and other broadband options becoming more cost-effective, users are turning away from dialup.

DSL

In the past few years, DSL has emerged as one of the technologies that can provide broadband services to homes. This technology can support both high-speed data and voice at the same time. It also can support data transfer rates of up to several megabits. Certain flavors of DSL can deliver speeds of up to 52 Mbps.

These transfer rates are made possible by using unused frequencies on copper telephone lines. The available bandwidth is divided into frequency ranges. One frequency range is used for voice, another is used for upstream data transmission, and another is used for downstream data transmission. For example, voice uses the frequency range of 0 to 3.4 kHz, and Asymmetric DSL uses the frequency ranges of 25 to 138 kHz in the upstream direction and 170 to 1104 kHz in the downstream direction. Splitters are sometimes used to separate these frequencies.

Another feature of DSL is that it is "always on." Unlike ISDN and analog, no dial-in is required. This is an attractive feature, especially for users who are accustomed to the cumbersome call setups and busy signals associated with analog dialup services.

DSL offerings can be broadly divided into two categories:

  • Asymmetric DSL

  • Symmetric DSL

Asymmetric DSL

In this category, the upload and download speeds differ. Here are some of the different Asymmetric DSL technologies:

  • Asymmetric DSL (ADSL) As noted in the name, this technology offers differing upload and download speeds. This is the most common technology for residential and commercial use. It can be configured to reach rates of 6 Mbps.

  • Rate-Adaptive DSL (RADSL) This technology uses ADSL modems that can adjust to differing line lengths and line qualities. The speed varies in this technology, depending on conditions, up to 7 Mbps.

  • Very High Bit Rate DSL (VDSL) The fastest DSL technology, it has a maximum range of 4500 feet and can deliver rates of up to 52 Mbps.

  • Consumer DSL (CDSL) This technology does not need a splitter like ADSL and RADSL. In those technologies, splitters are used to split the frequency ranges and protect the different ranges from interference. CDSL is slower than ADSL and offers downstream speeds of around 1 Mbps.

Symmetric DSL

In this category, the upload and download speeds are the same. Here are some of the different Symmetric DSL technologies:

  • Symmetric DSL (SDSL) This technology is suited to environments that need higher upload speeds than those offered by ADSL. It is provided over a single telephone line and typically offers rates of around 768 kbps.

  • Integrated Services Digital Network DSL (IDSL) As the name implies, this technology is similar to ISDN in that it can use the same terminal adapter. However, it is different in that it is always on. Also, IDSL is not metered like ISDN. It is a symmetric service offering rates of around 144 kbps.

  • High Bit Rate DSL (HDSL) This technology delivers symmetric data rates of around 1.5 Mbps in both directions. It runs over two-wire pairs.

DSL has a wide range of offerings that users can choose from. Also, DSL's always-on characteristics and its support of a wide range of applications make it an attractive technology for many remote users.

DSL does have its drawbacks. Its distance limitation is a significant issue. DSL services cannot be offered beyond certain distances from the central office. Also, DSL is not as ubiquitous as other services, like dialup and ISDN.

Cable Modem Services

The demand for high-speed Internet access in the past few years has seen the rise of cable modem services as a broadband alternative. The technology takes advantage of the wide reach of cable infrastructure used to deliver television service.

Data is transmitted over the network as radio frequency (RF) signals. The cable modem converts these into digital signals. In addition to television and data signals, analog voice signals can be transmitted over the network. These systems can also perform full-duplex communications. The fiber coming from the homes of subscribers is usually aggregated in remote units, and fiber is used to connect these units to headend routers. This kind of hybrid network is also called a Hybrid Fiber-Coaxial (HFC) network.

Different frequency ranges are used to transmit in upstream and downstream directions. The cable modem uses channels in the 5-to-42 MHz range to transmit data in the upstream direction. Similarly, a TV channel in the 50-to-750 MHz range is used for downstream traffic.

Cable can support a significant amount of bandwidthenough bandwidth to allow subscribers to watch television and be on the Internet at the same time. The cable modem uses 10/100 Ethernet or USB to connect to the user's PC.

In addition to bandwidth, cable is also attractive because of the wide range of applications it can support. Data, voice, and video can all be supported by this medium.

Conversely, because cable is a shared medium, performance can be degraded if too many users are on the same segment. This is the most significant drawback of cable. The shared nature of the medium also raises security concerns, because traffic can potentially be captured using a packet sniffer.

Also, the frequency range used for upstream communications is vulnerable to interference caused by household appliances

legal disclaimer

1) Our website is not responsible for the information contained by this article as well for any and all copyright infringements by authors and writers. E-articles is a free information resource. If you suspect this article for any copyright infringements, please read the Terms of service and contact us to investigate the problem.
2) The E-articles directory team is not responsible for inaccuracies, falsehoods, or any other types of misinformation this tutorial may contain and will not be liable for any loss or damage suffered by a user through the user's reliance on the information gained here. Please read the Terms of service

Useful tools and features

Translate this article to...    Send this article to you or to a friend

Link to this article from your page   
If you like this article (tutorial), please link to it from your web page using the information above. Linking to this page, this is the only way to help us improve our service, the same time providing your visitors with a way to improve their online experience.

related articles

1. Secure Wireless Network Positioning and VLANs
The next point in our security policy checklist is network positioning and separation. If there is a single access point or wireless bridge on the network, its deployment is straightforward: Plug the IP address into the WAN interface of an appropriately configured firewalling device. Such a device can be a sophisticated commercial wireless gateway, a configured common OS-based firewall, or even a SOHO firewall such as Cisco PIX 501 or Nokia SonicWall. However, if multiple access points are deployed and users are allowed to roam ...

2. RADIUS
This section takes a few steps to describe the basic principles of the AAA methodology, which is considered to be the fundamental structure behind the Remote Authentication Dial-In User Service (RADIUS). Additionally we briefly identify the functionality and principles of the RADIUS protocol. In the middle of the section we go through the steps required to install, configure, maintain, and monitor your RADIUS services. We conclude with practical implementations of the RADIUS protocol in relation to user authentication on wirele...

3. PDAs Versus Laptops
The first question that beginners ask before assembling their kit is whether a laptop or a PDA should be used for wireless penetration testing of any kind. Our answer is to use both if you can. The main advantage of PDAs (apart from size) is decreased power consumption, letting you cover a significant territory while surveying the site. The main disadvantage is the limited resources, primarily nonvolatile memory. The CPU horsepower is not that important here as we are not cracking AES. Other disadvantages are the limited amount...

4. Cryptographic Hash Functions
Can symmetric cryptography meet the requirements of the Biba model, based on the data integrity checks and proper authentication? The answer is "yes," but in a very inefficient way. Recall the practical authentication example with the UNIX (well, Linux in our case) password encryption flaw when DES in ECB is used. Of course, any of the feedback modes or 128-bit block ciphers can be used instead of DES, with the obvious performance penalties. However, in our example, MD5 scales very well. A cryptographic hash function i...

5. 802.11i Wireless Security Standard and WPA
Thus, the main hope of the international 802.11 community and network administrators lies with the 802.11i standard development. Sometimes 802.11i is referred to as the Robust Security Network (RSN) as compared to traditional security network (TSN). The "i" IEEE task group was supposed to produce a new wireless security standard that should have completely replaced legacy WEP by the end of 2003. In the meantime, some bits and pieces of the incoming 802.11i standard have been implemented by wireless equipment and software vendor...

6. Proprietary Improvements to WEP and WEP Usage
The article devoted to the proprietary and standards-based improvements for currently vulnerable 802.11 safeguards. The most publicized 802.11 vulnerability is the insecurity of WEP. We have already reviewed the cryptographic weaknesses of WEP linked to the key IV space reuse and insecure key-from-string generation algorithm. There are also well-known WEP key management issues: All symmetric cipher implementations suffer secure key distribution problems. WEP is no exception. In the original design,...

7. Penetration Testing as Your First Line of Defense
It is hard to overemphasize the importance of penetration testing in the overall information security structure and the value of viewing your network through the cracker's eyes prior to further hardening procedures. There are a variety of issues specific to penetration testing on wireless networks. First of all, the penetration tester should be very familiar with RF theory and specific RF security problems (i.e., signal leak and detectability, legal regulations pertaining to the transmitter power output, and characteris...

8. Asymmetric Cryptography
Message authentication using HMACs works just fine, but how do we distribute symmetric cipher keys among the users? We can pass them around on floppies or fancy USB pen-drives with encrypted partitions on them, but what if many users live all over the world? What if the physical key distribution method takes time and the keys must be frequently changed? This is the case with the traditional WEP, which should be rotated every few minutes. Key-encrypting keys (KEKs) were offered as symmetric cipher keys used only to encrypt...