Cisco Router As A Vpn Server


Published on

1 Comment
  • Good job on this post, also if you want to become anonymous online then you need to check this out.
    Are you sure you want to  Yes  No
    Your message goes here
No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide
  • The IPSec Encapsulating Security Payload (ESP) provides data privacy. The ESP protocol also defines an authenticated format that provides data authentication and integrity, with data privacy. AH with the SHA (Secure Hash Algorithm) (an HMAC variant) authentication algorithm
  • Cisco Router As A Vpn Server

    1. 1. Cisco Router as a VPN Server
    2. 2. Agenda <ul><li>VPN </li></ul><ul><li>Categories of VPN </li></ul><ul><ul><li>Secure VPNs </li></ul></ul><ul><ul><li>Trusted VPN </li></ul></ul><ul><li>Hardware / Software Requirement </li></ul><ul><li>Network Diagram </li></ul><ul><li>Basic Router Configuration </li></ul><ul><li>Configuring AAA Server </li></ul><ul><li>Virtual Template </li></ul><ul><li>VPDN </li></ul><ul><li>IPSec </li></ul>
    3. 3. What is VPN ? <ul><li>A virtual private network (VPN) is a computer network that is implemented in an additional logical layer (overlay) on top of an existing network. It has the purpose of creating a private scope of computer communications or providing a secure extension of a private network into an insecure network such as the Internet. </li></ul>
    4. 4. Categories of VPN <ul><li>VPN technologies may be classified by many standards. </li></ul><ul><li>Two broad categories of VPN are: </li></ul><ul><ul><li>Secure VPNs </li></ul></ul><ul><ul><li>Trusted VPNs </li></ul></ul>
    5. 5. Secure VPNs <ul><li>Provide mechanisms for authentication of the tunnel endpoints and encryption of the traffic. </li></ul><ul><li>Provide remote access facilities to employees. </li></ul><ul><li>Connects multiple networks together securely using the Internet to carry the traffic. </li></ul><ul><li>Secure VPN protocols include IPSec, SSL or PPTP (with MPPE). </li></ul><ul><li>Doesn't provide Qos or routing. </li></ul>
    6. 6. Trusted VPNs <ul><li>Created by carriers and large organizations on large core networks. </li></ul><ul><li>Provides Quality of Service. </li></ul><ul><li>Trusted VPN protocols include MPLS, ATM or Frame Relay. </li></ul><ul><li>Do not provide security features such as data confidentiality through encryption. </li></ul>
    7. 7. Hardware / Software Req <ul><li>Cisco integrated services router with 12.4 advance enterprise IOS. </li></ul><ul><li>Ethernet Cables (Cross Over). </li></ul><ul><li>PCs / Laptops. </li></ul><ul><li>Cisco VPN Client (v5.0.06.0110). </li></ul><ul><li>Cisco Security Device Manager (SDM for GUI based configuration). </li></ul><ul><li>Java Runtime Environment (for SDM). </li></ul>
    8. 8. Network Diagram
    9. 9. Basic Router Configuration <ul><li>Creating Local Login Users for VPN. </li></ul><ul><li>Router(config)# username [loginID] privilege [1-15] password 0 [password] </li></ul><ul><li>Configure Fast Ethernet Interfaces </li></ul><ul><li>Router#config t </li></ul><ul><li>Router(config)#int f0/0 </li></ul><ul><li>Router(config-if)# description Internal LAN ( </li></ul><ul><li>Router(config-if)#ip address </li></ul><ul><li>Router(config-if)#no shut </li></ul><ul><li>Router(config)#int f0/1 </li></ul><ul><li>Router(config-if)# description VPN INT ( </li></ul><ul><li>Router(config-if)#ip address </li></ul><ul><li>Router(config-if)#no shut </li></ul>
    10. 10. Basic Router Configuration (contd) <ul><li>Configure Routing Protocol </li></ul><ul><li>Router#config t </li></ul><ul><li>Router(config)#router eigrp 1 </li></ul><ul><li>Router(config-router)#network </li></ul><ul><li>Router(config-router)#network </li></ul><ul><li>Router(config-router)#network </li></ul><ul><li>IP Pool </li></ul><ul><li>Router(config)# ip local pool ip_pool </li></ul>
    11. 11. Configuring AAA <ul><li>aaa-model </li></ul><ul><li>Enables the authentication, authorization, and accounting (AAA) access control model. </li></ul><ul><li>Router(config)#aaa new-model </li></ul><ul><li>aaa session-id [ common | unique ] </li></ul><ul><li>Ensures that all session identification (ID) information that is sent out for a given call will be made identical. The default behavior is common . </li></ul><ul><li>Router(config)#aaa session-id common </li></ul>
    12. 12. Configuring AAA (contd) <ul><li>aaa authentication login [ list-name ] local </li></ul><ul><li>Sets (AAA) authentication at login. ‘Local’ keyword tells the AAA to use local username database for authentication. </li></ul><ul><li>Router(config)# aaa authentication login vpn_xauth local </li></ul><ul><li>aaa authorization network [list-name] local </li></ul><ul><li>Creates a list for authorization of all network-related service requests . ‘Local’ keyword tells the AAA to use local username database for authentication </li></ul><ul><li>Router(config)# aaa authorization network vpn_group local </li></ul>
    13. 13. Virtual Template <ul><li>A virtual template interface is a logical entity that are created, configured dynamically, used, and then freed when no longer needed. </li></ul><ul><li>Requires the same amount of memory as a serial interface. </li></ul><ul><li>Cisco routers support a maximum of 300 virtual interfaces. </li></ul>
    14. 14. Benifts of Virtual Template <ul><li>For easier maintenance, allows customized configurations to be predefined. </li></ul><ul><li>For scalability, allows interface configuration to be separated from physical interfaces. </li></ul><ul><li>For consistency and configuration ease, allows the same predefined template to be used for all users. </li></ul><ul><li>For efficient router operation, frees the virtual access interface memory for another dial-in use when the user's call ends. </li></ul>
    15. 15. Configuring Virtual Template <ul><li>Router#config t </li></ul><ul><li>Router(config)# interface Virtual-Template1 </li></ul><ul><li>Router(config-if)# ip unnumbered FastEthernet0/1 </li></ul><ul><li>Router(config-if)# no peer default ip address </li></ul><ul><li>Router(config-if)# ppp encrypt mppe auto required </li></ul><ul><li>Router(config-if)# ppp authentication ms-chap ms-chap-v2 </li></ul>
    16. 16. VPDN <ul><li>A virtual private dial−up network (VPDN) allows a private network dial in service to span across to remote access servers (defined as the L2TP Access Concentrator [LAC]). </li></ul><ul><li>LAC forwards the PPP session on to an L2TP Network Server (LNS). The LNS then authenticates the user and starts the PPP negotiation. </li></ul><ul><li>VPDN uses the Layer 2 Forwarding protocol (L2F) which permits the tunneling of link level frames </li></ul>
    17. 17. Configuring VPDN <ul><li>enable vpdn </li></ul><ul><li>Enables virtual private networking. </li></ul><ul><li>Router(config)#enable vpdn </li></ul><ul><li>vpdn-group [group name] </li></ul><ul><li>Ceates a vpdn group which specifies the protocol, dialup mode and interface </li></ul><ul><li>Router(config)# vpdn-group VPN_Server </li></ul><ul><li>Router(config)# accept-dialin </li></ul><ul><li>Router(config)# protocol pptp </li></ul><ul><li>Router(config)# virtual-template 1 </li></ul>
    18. 18. IPSec <ul><li>Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications. </li></ul><ul><li>IPsec uses the following protocols to perform various functions </li></ul><ul><ul><li>Internet key exchange (IKE and IKEv2) to set up a security association (SA) </li></ul></ul><ul><ul><li>Authentication Header (AH) to provide connectionless integrity. </li></ul></ul><ul><ul><li>Encapsulating Security Payload (ESP) to provide confidentiality. </li></ul></ul>
    19. 19. Configuring IPSec based VPN <ul><li>Defines an Internet Key Exchange (IKE) policy. IKE policies define a set of parameters to be used during the IKE negotiation </li></ul><ul><li>Router(config)#crypto isakmp policy 1 </li></ul><ul><li>Router(config-crypto-isakmp)# encr 3des </li></ul><ul><li>Router(config-crypto-isakmp)# authentication pre-share </li></ul><ul><li>Router(config-crypto-isakmp)# group 2 </li></ul><ul><li>crypto isakmp policy [priority] </li></ul>
    20. 20. Configuring IPSec based VPN (contd) <ul><li>sh crypto isakmp policy </li></ul><ul><li>Below command list the policy created as a result of last command (previous slide). </li></ul><ul><li>Router#sh crypto isakmp policy </li></ul><ul><li>Global IKE policy </li></ul><ul><li>Protection suite of priority 1 </li></ul><ul><li>encryption algorithm: Three key triple DES </li></ul><ul><li>hash algorithm: Secure Hash Standard </li></ul><ul><li>authentication method: Pre-Shared Key </li></ul><ul><li>Diffie-Hellman group: #2 (1024 bit) </li></ul><ul><li>lifetime: 86400 seconds, no volume limit </li></ul>
    21. 21. Configuring IPSec based VPN (contd) <ul><li>crypto isakmp client configuration group [name] </li></ul><ul><li>Specify which group’s policy profile will be defined by defining key and ip address pool. </li></ul><ul><li>Router(config)#crypto isakmp client configuration group ipsec_group </li></ul><ul><li>Router(config-crypto-isakmp )# key ipsec </li></ul><ul><li>Router(config-crypto-isakmp )# pool ip_pool </li></ul><ul><li>Router(config-crypto-isakmp )# netmask </li></ul>
    22. 22. Configuring IPSec based VPN (contd) <ul><li>crypto ipsec transform-set </li></ul><ul><li>A transform set specifies the encryption and authentication algorithms used to protect the data in the VPN Tunnel. </li></ul><ul><li>Router(config)# crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac </li></ul><ul><li>Router(config-crypto-ipsec )# crypto dynamic-map DYNMAP 1 </li></ul><ul><li>Router(config-crypto-ipsec )# set transform-set ESP-3DES-SHA </li></ul><ul><li>Transform Set: </li></ul><ul><li>Name:ESP-3DES-SHA1 </li></ul><ul><li>ESP Encryption: ESP_3DES </li></ul><ul><li>ESP Integrity: ESP_SHA_HMAC </li></ul>
    23. 23. Configuring IPSec based VPN (contd) <ul><li>crypto map </li></ul><ul><li>Creates a crypto profile that provides a template for configuration. </li></ul><ul><li>Router(config)#crypto map CMAP client authentication list vpn_auth </li></ul><ul><li>Router(config)#crypto map CMAP isakmp authorization list vpn_group </li></ul><ul><li>Router(config)#int f0/1 </li></ul><ul><li>Router(config-if)#crypto map CMAP </li></ul>
    24. 24. <ul><li>Live Demonstration </li></ul>