Implementing Virtual Private Networks

Implementing Virtual Private Networks

1. VPNs

   • Types
     • remote-access
       • Components
         • access to the Internet
         • telecommuter’s PC
         • information required
     • site-to-site
       • complex VPN topologies
         • MPLS VPN
         • Cisco IOS software features
           • Next Hop Resolution Protocol (NHRP),
           • multipoint Generic Routing Encapsulation (GRE),
           • IPsec VPN

2. IPsec Technologies

   • is an
     • IETF standard (RFC 2401-2412)
   • protects and authenticates IP packets
   • security functions
     • Confidentiality using encryption
       • achieved by encrypting the data
       • DES
         • 3DES
           • AES
             • SEAL
     • Integrity
       • received is exactly the same data that was sent
       • MD5
         • SHA
     • Authentication
       • know who is at the other end of the VPN tunnel
       • PKS
         • RSA
     • Secure key exchange
       • encryption and decryption
       • Diffie-Hellman (DH)
         • should use AES 128 or 256-bit keys
         • Hashing should use SHA-2
         • Digital Signatures should use Elliptic Curve Digital
         • Key exchange should use Elliptic Curve Diffie-Hellman
       • RFC 4869
         • defines a set of cryptographic algorithms
   • Protocols
     • Authentication Header
       • applying a keyed one-way hash function to the packe
     • ESP
       • confidentiality by encrypting the payload
       • supports symmetric algorithms
       • integrity and authentication
     • Transport and Tunnel Modes
       • Transport Mode
         • security is provided for transport layer
       • Tunnel Mode
         • provides security for the complete original IP packet.
     • IKE
       • key management protocol standard
       • hybrid protocol
       • key exchange protocols inside (ISAKMP) and ISAKMP
       • Phases
         • Phase 1
           • negotiate ISAKMP policy
           • authenticate the peers
           • set up a secure tunnel between the peers
         • Phase 2
           • negotiate the IPsec security parameters

3. Configuring a Site-to-Site IPsec VPN

   • IPsec Negotiation
     • Step 1. An ISAKMP tunnel is initiated
     • Step 2. IKE Phase 1 begins.
     • Step 3. IKE Phase 2 begins.
     • Step 4. The IPsec tunnel is created,
     • Step 5. The IPsec tunnel terminates when the IPsec SAs are manually deleted

4. ISAKMP Policy

   • crypto isakmp policy
   • Hash Authentication Group Lifetime Encryption

5. Pre-Shared Key

   • crypto isakmp policy 1
   • hash sha
   • authentication pre-share
   • group 24
   • lifetime 3600
   • encryption aes 256

6. Interesting Traffic

   • show crypto isakmp sa

7. IPsec Transform Set

   • crypto ipsec transform-set