CND (312-38) Network Defense Simulation
Network Scenario
Your organization, GlobalNet Corp, maintains a central headquarters (HQ) and several branch offices. Recently, the CISO mandated a secure connection to a third-party logistics partner to allow them access to specific inventory databases without exposing the entire internal network.
The network topology includes:
- Internal LAN (10.0.0.0/16): Internal staff and servers.
- DMZ (172.16.0.0/24): Public-facing web servers.
- VPN Gateway: A single Cisco ASA device sitting at the edge of the HQ network, terminating external tunnels.
Traffic & Logs
Review the following connection log from the edge firewall during the establishment of a partner tunnel:
[2023-10-24 09:15:25] %ASA-7-713236: IPsec Phase 1 SA established with 203.0.113.45
[2023-10-24 09:15:26] %ASA-5-713120: Group <Partner_Logistics> User <logistics_gw> IP <203.0.113.45> IPv4 Address <10.0.99.5> assigned to session
[2023-10-24 09:20:01] %ASA-4-106023: Deny tcp src outside:203.0.113.45/51234 dst inside:10.0.1.5/80 by access-group "EXTRANET_ACL"
Note: The "EXTRANET_ACL" is specifically designed to restrict the partner's access to only the inventory server (10.0.50.12).
Question
Which of the following is a type of VPN that involves a single VPN gateway?
Expert Analysis
1. Network Activity: The logs show a partner network (203.0.113.45) establishing an IPsec tunnel to our HQ ASA. This is a Site-to-Site style connection, but restricted by a specific Access Control List (ACL) named "EXTRANET_ACL".
2. Identifying the Behavior: The connection from the partner's gateway to our single gateway, intended for limited resource sharing, defines an Extranet VPN.
3. Why B is Correct: In an Extranet-based VPN, your organization controls the VPN gateway at your edge. The external partner (or their gateway) connects to your gateway. While it can be Site-to-Site, it is architecturally categorized by the involvement of a single gateway on the organization's side that manages the external partner's access.
4. Why others are wrong:
- A. Remote-access: Usually involves individual clients (endpoints) connecting to a gateway via software, rather than a permanent site-to-site gateway structure for partners.
- D. Intranet-based: These connect two or more internal locations (e.g., HQ to Branch) and typically require a VPN gateway at every site involved to maintain the private network extension.
- C. PPTP: This is a protocol, not an architectural deployment type like Intranet or Extranet.
Mini Lesson Traffic Pattern Recognition
Intranet VPN: Gateway-to-Gateway. Used for internal branch office connectivity. Both ends are typically managed by the same IT department.
Extranet VPN: Single Gateway. Used for connecting business partners, suppliers, or customers to a specific portion of the corporate network.
Remote-Access VPN: Host-to-Gateway. Used for mobile workers connecting over public WiFi or home internet.