Implementing Virtual Private Networks

Implementing Virtual Private Networks

1. VPN Terminology

   • CRYPTOSYSTEM
     • A system to accomplish the encryption/decryption, user authentication, hashing, and key-exchange processes. • A cryptosystem may use one of several different methods, depending on the policy intended for various user traffic situations.
   • IPsec Protocol Framework

2. VPNs

3. VPN Topologies

   • Site-to-Site VPNs: – Intranet VPNs connect corporate headquarters, remote offices, and branch offices over a public infrastructure. – Extranet VPNs link customers, suppliers, partners, or communities of interest to a corporate Intranet over a public infrastructure. • Remote Access VPNs: – Which securely connect remote users, such as mobile users and telecommuters, to the enterprise

4. GRE Tunnel

   • There are 2 popular site-to-site tunneling protocols: – Cisco Generic Routing Encapsulation (GRE) – IP Security Protocol (IPsec) • When should you use GRE and / or IPsec?
   • Five steps to configuring a GRE Tunnel
     • 1. Create a tunnel interface: interface tunnel 0 2. Assign the tunnel an IP address. 3. Identify the source tunnel interface: tunnel source 4. Identify the tunnel destination: tunnel destination 5. (Optional) Identify the protocol to encapsulate in the GRE tunnel: tunnel mode gre ip – By default, GRE is tunneled in an IP packet.

5. IPsec

   • A “framework” of open standards developed by the IETF to create a secure tunnel at the network (IP) layer. – It spells out the rules for secure communications. – RFC 2401 - RFC 2412 • IPsec is not bound to any specific encryption or authentication algorithms, keying technology, or security algorithms. • IPsec allows newer and better algorithms to be implemented without patching the existing IPsec standards.

6. Key Exchange

   • The IPsec VPN solution: – Negotiates key exchange parameters (IKE). – Establishes a shared key (DH). – Authenticates the peer. – Negotiates the encryption parameters. • The negotiated parameters between two devices are known as a security association (SA).

7. IPsec Tasks

   • Ensure that ACLs configured on the interface are compatible with IPsec configuration. 2. Create an IKE policy to determine the parameters that will be used to establish the tunnel. 3. Configure the IPsec transform set which defines the parameters that the IPsec tunnel uses. – The set can include the encryption and integrity algorithms. 4. Create a crypto ACL. – The crypto ACL defines which traffic is sent through the IPsec tunnel and protected by the IPsec process. 5. Create and apply a crypto map. – The crypto map groups the previously configured parameters together and defines the IPsec peer devices. – The crypto map is applied to the outgoing interface of the VPN device.

8. VPN Lab

9. Configuring IPsec VPN using CCP

   • CCP Wizards
     • Other intelligent Cisco wizards are available in CCP for these three tasks: – Auto detecting misconfiguration and proposing fixes. – Providing strong security and verifying configuration entries. – Using device and interface-specific defaults

Bilder und Dateien der Mindmap