Question

Difficulty: MediumVirtual Private Networks and Remote Access Security

A remote employee launches a client-based SSL/TLS VPN software application to connect to the corporate network over an untrusted internet connection. In what chronological order do the steps occur to establish the VPN session and enable secure data transfer?

  1. 1The client software establishes an initial TLS session with the VPN gateway over TCP port 443.
  2. 2The user transmits authentication credentials through the encrypted channel to be validated against an enterprise AAA/RADIUS server.
  3. 3The VPN gateway assigns a virtual IP address and DNS parameters to the client's virtual network interface.
  4. 4The client software modifies the host operating system's routing table to direct corporate-bound traffic into the virtual network interface.
  5. 5Payload data is encapsulated within TLS headers and routed through the secure tunnel across the public network.

Answer

The correct order of establishing a client-based SSL/TLS VPN session is: 1) Initial TLS handshake over TCP port 443, 2) User credential transmission and AAA authentication, 3) Virtual IP address assignment to the virtual adapter, 4) Host routing table modification, and 5) Encapsulation and transmission of user payload data.
Establishing a remote access SSL/TLS VPN session requires a secure transport channel before credential verification. Once authenticated, the gateway issues virtual network settings, enabling the local host to update its routing table and subsequently begin encapsulating data payloads.

Step-by-Step Solution

1
Establish control channel encryption
TLS session formed over port 443
Prevents credential sniffing on untrusted networks prior to authentication.
2
Authenticate user identity
RADIUS/AAA verifies user authorization
Ensures only authorized users are granted entry into internal resources.
3
Provision virtual adapter
Virtual NIC receives IP address and DNS servers
Allows the remote host to act as a local node on the corporate subnet.
4
Update host routing rules
Traffic destined for target subnets is directed to the virtual adapter
Determines whether split-tunneling or full-tunneling directs data into the VPN tunnel.
5
Encapsulate user data
Encrypted payload transmitted across internet
Protects confidentiality and integrity of network applications during active session.

Key Concept

Client-Based SSL/TLS Remote Access VPN Session Lifecycle
Estimated Time:1m 30s
Rate this question