Implementing Virtual Private Networks

Implementing Virtual Private Networks

1. 8.1: VPN

   • VPN General
     • Benefits: •Cost Savings •Security •Scalability •Compatibility
   • Two Types of VPNs:
     • remote-access VPN site-to-site VPN
   • what is VPN?
     • A VPN is a private network that is created over a public network, usually the Internet.
   • Components of Site-to-Site VPNs
     • MPLS VPN (Multiprotocol Label Switching)
       • An MPLS VPN consists of a set of sites that are interconnected by means of an MPLS provider core network.
     • Dymanic Multipoint VPN (DMVPN)
       • A DMVPN enables the auto-provisioning of site-to-site IPsec VPNs, combining three Cisco IOS software features: Next Hop Resolution Protocol (NHRP), multipoint Generic Routing Encapsulation (GRE), and IPsec VPN
     • Group Encrypted Transport VPN (GETVPN))
       • GETVPN uses a trusted group to eliminate point-to-point tunnels and their associated overlay routing.
   • Hairpinning
     • Hairpinning is a term used to describe a situation in which VPN traffic that enters an interface may also be routed out of that same interface.
   • Split tunneling
     • Split tunneling can be used if the corporate policy dictates that VPN traffic must be split between traffic destined for the corporate subnets (trusted) and traffic destined to the Internet (untrusted)

2. 8.2: IPsec Technologies

   • 8.2.1: Introducing IPsec
     • what is?
       • IPsec defines how a VPN can be secured across IP networks. IPsec protects and authenticates IP packets between source and destination.
     • IPsec provides
       • •Confidentiality using encryption •Integrity using hashing algorithms •Authentication using Internet Key Exchange (IKE) •Secure key exchange using the Diffie-Hellman (DH) algorithm
     • Confidentiality is achieved:
       • •DES •3DES •AES •SEAL
     • Integrity in achieved:
       • HMAC algorithms: MD5 SHA
     • Authentication is achieved:
       • •PSK •RSA
   • DH is a public key exchange method that provides a way for two peers to establish a shared secret key that only they know, even though they are communicating over an insecure channel.
     • DH1 DH2 DH5 DH24
   • 8.2.2: IPSec Protocols
     • ESP uses IP protocol 50 and provides both confidentiality and authentication. It provides confidentiality by performing encryption on the IP packet
     • AH uses IP protocol 51 and is appropriate only when confidentiality is not required or permitted. It provides data authentication and integrity, but it does not provide data confidentiality (encryption).
       • ESP and AH can be applied to IP packets in two different modes
         • Transport Mode In transport mode, security is provided only for the transport layer of the OSI model and above.
         • Tunnel Mode Tunnel mode provides security for the complete original IP packet. The original IP packet is encrypted and then it is encapsulated in another IP packet.
   • 8.2.3: IKE Protocol
     • what is?
       • IKE is a hybrid protocol that implements key exchange protocols inside the Internet Security Association Key Management Protocol (ISAKMP) framework.
       • IKE calculates shared keys based on the exchange of a series of data packets.

3. 8.3: Implementing Site-to-Site IPsec VPNs with CLI

   • 8.3.2: ISAKMP Policy
     • When in ISAKMP policy configuration mode, the SAs for the IKE Phase 1 tunnel can be configured. Use the mnemonic HAGLE to remember the five SAs to configure: Hash Authentication Group Lifetime Encryption
   • 8.3.3: IPsec Policy
     • Define Interesting Traffic
       • To define interesting traffic, configure each router with an ACL to permit traffic from the local LAN to the remote LAN. The ACL will be used in the crypto map configuration to specify what traffic will trigger the start of IKE Phase 1.
     • During IKE Phase 2 negotiations, the peers agree on the IPsec transform set to be used for protecting interesting traffic.
   • 8.3.4: Crypto Map
     • the interesting traffic is defined, and an IPsec transform set is configured, it is time to bind those configurations with the rest of the IPsec policy in a crypto map.