CCNA 3 - Capitulo 8.5

CCNA 3 - Capitulo 8.5

1. VPN - VIRTUAL PRIVATE NETWORK

   • IPSEC FRAMEWORK PROVIDES ESSENTIAL FUNCTIONS
     • CONFIDETIALITY
       • ENCRYPTION ALGORITHMS
         • ADVANCED ENCRYPTION STANDARD (AES)
           • AES IS THE MOST RECOMMENDED SYMMETRIC ENCRYPTION ALGORITHM.
           • IT PROVIDES STRONGER SECURITY THAN DES AND IS COMPUTATIONALLY MORE EFFICIENT THAN 3DES.
           • OFFERS THREE DIFFERENT KEY LENGTHS: 128 BITS, 192 BITS, AND 256 BITS.
         • TRIPLE 3DES
           • IS A VARIANT OF THE 56-BIT DES. IT USES THREE INDEPENDENT 56-BIT ENCRYPTION KEYS PER 64-BIT BLOCK,
           • PROVIDES SIGNIFICANTLY STRONGER ENCRYPTION STRENGTH OVER DES.
         • SOFTWARE OPTIMIZED ENCRYPTION ALGORITHM(SEAL)
           • SEAL IS A STREAM CIPHER, WHICH MEANS IT ENCRYPTS DATA CONTINUOUSLY RATHER THAN ENCRYPTING BLOCKS OF DATA.
           • SEAL USES A 160-BIT KEY AND IS CONSIDERED TO BE VERY SECURE.
         • DATA ENCRYPTION STANDARD (DES)
           • 56 bits
       • ENSURE CONFIDENCIALITY OF THE LAYER 3 PACKET
       • THE DEGREE OF CONFIDENTIALITY DEPENDS
         • ENCRYPTION ALGORITHM
         • LENGHT OF THE KEY USED
           • THE SHORTER THE KEY , THE EASIER IS TO BREAK
           • BRUTE FORCE ATTACK NUMBER OF POSSIBILITIES TO TRY IS A FUNCTION OF LENGHT OF THE KEY
     • INTEGRITY
       • HASING ALGORITHMS
         • HASHED MESSAGE AUTHENTICATION CODE
           • GUARANTEEES DATA INTEGRITY MESSAGE HASH USING A HASH VALUE
         • MESSAGE DIGEST5 (MD5)
           • USES A 128-BIT SHARED-SECRET KEY
           • THE VARIABLE-LENGTH MESSAGE AND 128-BIT SHARED SECRET KEY ARE COMBINED AND RUN THROUGH THE
         • SECURE HASH ALGORITHM (SHA)
           • SHA-1
             • SHOULD BE AVOID
             • 160 bits
               • SHARED KEY ARE COMBINED RUN THE HMAC-SHA1. THE OUTPUT IS A 160 bit HASH
           • SHA256
             • MINIMUM RECOMMENDED
       • ENSURE PACKET HAVE NOT BEEN ALTERED BETWEEN SOURCE AND DESTINATION
     • ORIGIN AUTHENTICATION
       • IPSEC USES THE INTERNET KEY EXCHANGE (IKE)
         • AUTHENTICATE SOURCE AND DESTINATION
         • USES TEHE SEVERAL TYPES OF AUTHENTICATION
           • PSK - PRE SHARED KEYS
             • VALUE IS ENTERED INTO EACH PEER MANUALLY
             • BUT NOT SCALE
             • DO NOT SCALE WELL , BECAUSE MOST BE CONFIGURED OF EVERY PEER
             • LOCAL DEVICE
               • 1.CREATES A HASH (HASH_L) USING THE PRE-SHARED KEY AND ITS IDENTITY, THEN SENDS IT TO THE REMOTE DEVICE.
             • REMOTE DEVICE
               • 2. CALCULATES THE SAME HASH INDEPENDENTLY AND COMPARES IT. IF IT MATCHES, THE LOCAL DEVICE IS AUTHENTICATED.
           • RIVEST SHAMIR AND ADLEMAN (RSA)
             • USES DIGITAL CERTIFICATE TO AUTHENTICATE THE PEERS
             • LOCAL DEVICE
               • CREATES A HASH (HASH_L) AND ENCRYPTS IT WITH ITS PRIVATE KEY, GENERATING A DIGITAL SIGNATURE.
               • IT SENDS THE SIGNATURE AND ITS DIGITAL CERTIFICATE TO THE REMOTE DEVICE.
             • REMOTE DEVICE
               • THE REMOTE DEVICE USES THE PUBLIC KEY FROM THE CERTIFICATE TO DECRYPT THE SIGNATURE AND COMPARES IT WITH THE HASH IT GENERATES INDEPENDENTLY. IF THEY MATCH, THE LOCAL DEVICE IS AUTHENTICATED.
           • ONE TIME PASSOWORD
           • BIOMETRICS
         • ISAKMP-SA PHASE 1 (MGM)
           • NEGOTIATE THE POLICY SETS SUCH
             • ENCRYPT
               • 3DEC , AES
             • HASHING
               • MD5 , SHA AND HMAC
             • AUTH METHOD
               • X.509 , PRE SHARED KEY OR PUBLIC KEY
             • DH GROUP
               • 14,5
         • ISAKMP-SA PHASE 2 (DATA)
           • NEGOTIATE TRANSFORM SET (PROTECT THE DATA)
             • ENCRYPT USED
               • ESSP-AES
             • HASHING
               • ESP-SHA-HMAC
       • SHOUD BE AUTHENTICATE BEFORE CONSIDER SECURE
     • DIFFIE HELMAN
       • SECURE KEY EXCHANGE USING VARIOUS GROUPS OF DH ALGORITHM
       • IPSEC USES DH ALGORITHM TO PROVIDE PUBLIC KEY EXCHANGE METHOD FOR TWO PEERS TO ESABLISH A SHARED SECRET KEY
       • DH GROUPS
         • GROUPS 1 , 2 AND 5
           • SHOULD BE NO LONGER BE USED
           • SUPPORT A KEY OF 768 bits , 1024 bits and 1536 bits
         • GROUPS 14 ,15 AND 16
           • SUPPORT A KEY OF 2048 bits , 3072 bits and 4096 bits , AND ARE RECOMMENDED FOR USE UNTIL 2030
         • GROUPS 19,20 AND 24
           • SUPPORT A KEY OF 256 bits , 384 bits , 521 bits and 2048 bits SUPPORT ELLIPTICAL CURVE CRYPTOGRAPHY
           • DH GROUP 24 IS THE PREFERRED NEXT GENERATION ENCRYPTION
         • CHOOSE MUST BE STRONG TO PROTECT THE IPSEC KEYS DURING NEGOTIATION . EXAMPLE
           • DH GROUP 1
             • STRONGER SUPPORT DES AND 3DES , BUT NOT AES
           • DH GROUP 14,19,20 OR 24
             • MUST BE USED WHEN ALGORITHMS ENCRYPT USE A 128 bits KEY
           • GROUP 21 OR 24
             • MUST BE USED WHEN ALGORITHMS OR AUTHENTICATION USE A 256 bit key or HIHER
       • DH 2 E 5 NOT LONGER RECOMMENDED
       • THE KEY THE SYMMETRIC IS SHARED EACH PEER
     • IPSEC IS NOT BOUND TO SPECIF RULES ; THEY OPTIONS IN FRAMEWORK ALLOWS IPSEC INTEGRATE NEWS TECHNOLOGIES