2 cissp ® Official Study Guide Eighth Edition

How VPNs Work
A VPN link can be established over any other network communication connection. This 
could be a typical LAN cable connection, a wireless LAN connection, a remote access 
dial-up connection, a WAN link, or even a client using an internet connection for access to 
an office LAN. A VPN link acts just like a typical direct LAN cable connection; the only 
possible difference would be speed based on the intermediary network and on the connec-
tion types between the client system and the server system. Over a VPN link, a client can 
perform the same activities and access the same resources as if they were directly connected 
via a LAN cable.
VPNs can connect two individual systems or two entire networks. The only difference is 
that the transmitted data is protected only while it is within the VPN tunnel. Remote access 
servers or firewalls on the network’s border act as the start points and endpoints for VPNs. 
Thus, traffic is unprotected within the source LAN, protected between the border VPN 
servers, and then unprotected again once it reaches the destination LAN.

---

Virtual Private Network 
543
VPN links through the internet for connecting to distant networks are often inexpen-
sive alternatives to direct links or leased lines. The cost of two high-speed internet links to 
local ISPs to support a VPN is often signifi cantly less than the cost of any other connection 
means available.
Common VPN Protocols 
VPNs can be implemented using software or hardware solutions. In either case, there are 
four common VPN protocols: PPTP, L2F, L2TP, and IPsec. PPTP, L2F, and L2TP operate 
at the Data Link layer (layer 2) of the OSI model. PPTP and IPsec are limited for use on IP 
networks, whereas L2F and L2TP can be used to encapsulate any LAN protocol. 
SSL/TLS can also be used as a VPN protocol, not just as a session 
encryption tool operating on top of TCP. The CISSP exam does not 
seem to include SSL/TLS VPN content at this time.