Concept Focus
When people say “secure the channel,” they mean three distinct but stackable things: how we connect (link protocols like PPP/PPPoE), how we prove who's who (authentication: PAP, CHAP, MS-CHAPv2, EAP and its flavours), and how we protect traffic in flight (TLS, IPsec with AH/ESP, IKE, plus AAA via RADIUS, TACACS+, Diameter).
Think of it like airport security: the corridor to the gate is the link or tunnel (PPTP/L2TP/IPsec, SSL VPN), the identity checks are the authentication protocols, and the guards and cameras are the encryption, integrity, key exchange, and AAA governance. Mix these right and you get confidentiality, integrity, availability, and traceability without breaking usability.
Authentication and EAP
Best: EAP-TLS, if you can manage client certs. Real-world scalable: PEAP or EAP-TTLS with strict server-certificate validation and MFA where possible. Never: PAP, LEAP, or EAP-MD5 in the clear.
Dial-up and access-link protocols. SLIP was IP over serial with no auth or error detection (history only). PPP adds framing, LCP, NCP, and optional auth (PAP/CHAP) and still appears inside tunnels. PPPoE carries PPP over Ethernet for DSL last-mile, session and billing friendly.
IPsec details that save outages
- ESP provides confidentiality, integrity, and authentication; AH is integrity and authentication only and breaks with NAT.
- Modes: transport (host to host) vs tunnel (gateway to gateway).
- Keying: IKEv2 with strong suites, Perfect Forward Secrecy, reasonable lifetimes, and NAT-T (UDP/4500) when traversing NAT.
AAA backends
Practical default: RADIUS for Wi-Fi and VPN authentication, TACACS+ for network-device administration, and wrap either in TLS or IPsec where possible. Diameter is used in telco and large roaming.
Password attacks: brute-force, dictionary, spraying
- Length over complexity, passphrases win.
- Block common and breached passwords.
- Lockouts and throttling, ideally exponential back-off that stays detection-friendly.
- Salt and slow hash (bcrypt, scrypt, Argon2) for storage.
- MFA everywhere, especially where you can't deploy EAP-TLS yet.
Brain Ticklers
Q1. A vendor asks for a quick VPN using PPTP to reach a shared file server. What's Anya's best response?
- Approve PPTP if strong passwords are used
- Approve PPTP only over GRE with ACLs
- Reject PPTP; propose L2TP/IPsec or SSL VPN with MFA
- Allow PPTP but force quarterly password changes
Q2. Guest Wi-Fi uses PEAP, but devices skip validating the RADIUS server certificate. What's the actual risk?
- None; the tunnel is still encrypted
- An evil-twin AP can harvest credentials (MITM)
- Only a DoS risk
- The captive portal breaks
Q3. Site-to-site IPsec breaks after a new NATing firewall is installed. What's the first fix to try?
- Switch to AH transport mode
- Force AES-GCM
- Enable NAT-Traversal (UDP/4500) on both peers
- Lower the MTU
Q4. Neuromesh wants Wi-Fi with the strongest feasible auth at scale for employee laptops. Which wins?
- PEAP with MS-CHAPv2 and no server-cert pinning
- EAP-TLS with managed client certificates (MDM)
- EAP-MD5 for speed
- LEAP for Cisco APs
Q5. Network engineers want centralized admin login on routers and switches with command-level authorization. Choose:
- RADIUS over UDP; shared secret
- TACACS+ over TCP; full payload encryption; per-command authorization
- Diameter with IPsec
- Local accounts with SSH keys
- Wi-Fi (802.1X): prefer EAP-TLS; otherwise PEAP or EAP-TTLS with strict server-cert validation and MFA.
- Remote-access VPN: SSL/TLS VPN for users; L2TP/IPsec or IPsec IKEv2 for device and branch.
- Site-to-site: IPsec ESP in tunnel mode with IKEv2, PFS, and NAT-T; strong ciphersuites.
- AAA: RADIUS for 802.1X and VPN; TACACS+ for device admin; wrap in TLS or IPsec where possible.
- De-list: PPTP, LEAP, EAP-MD5, and bare PAP/CHAP on the wire.