ccna book online

ccna book online.8.6.3.3 Full-featured Client Access ModeFull-featured client mode provides full access to the corporate network through an SSLVPN tunnel, which is used to transport data at the network (IP) layer. This mode supports most IP-based applications, such as Microsoft Outlook, MicrosoftExchange>LotusNotes Email, and Telneto be transparent to applications running on the client side as part of SSLVPN. A Java applet is downloaded to handle the tunneling between the client host and the SSLVPN gateway. The user can use any application as if the client host were on the internal network.Because this VPN client is dynamically downloaded and updated, it requires little or no desktop support from the IT organization, minimizing deployment and operational costs, as no software distribution or interaction from the end user is required. Similar to clientless access, full-featured network access provides full access control customization based on end-user-based access rights. When employees need remote access to the same applications and network resources they use in the office, full-featured web access is the natural choice. Full-featured web access is also appropriate for any client/server application that cannot be distributed via web-based clientless access.For example, a mobile user needs a seamless and easy-to-use way to access corporate network resources. Another example is a work-from-home worker who needs LAN-like full-featured network access to corporate resources and applications.8.6.3.4 Steps for Establishing SSLVPNThere are 5 steps to establish an SSL session as follows. Step 1 The user initiates an outbound connection to TCP port 443. Step 2 The router responds with a digital certificate that contains a . A public key digitally signed by a trusted CertificateAuthority,CA) digitally signed public key. Step 3 The user's computer generates a shared key for use by both parties. Step 4 The shared key is encrypted using the router's public key and transmitted to the router. The router software uses its own private key to be able to easilydecrypt the packet. Both parties to the session now know the shared key. The Step 5 key is used to encrypt the SSL session.248 Chapter 8 Implementing a Virtual Private Network SSL implements an encryption algorithm using keys ranging in length from 40.256 bits.8.6.3.5 SSLVPN Design