ali raza, profile picture
Uploaded byali raza
PPT, PDF1,496 views

Chapter 8 overview

Here are the key steps to configure an IPsec VPN using CLI: 1. Configure ISAKMP policy for IKE phase 1 negotiation. 2. Define IPsec transform sets for encryption and authentication algorithms. 3. Create crypto access control lists (ACLs) to define which traffic should be protected. 4. Apply a crypto map to the interface to associate the ACLs and transform sets to establish security associations for IPsec. This summarizes the major configuration tasks for setting up an IPsec VPN using CLI on Cisco devices. The steps establish the IKE and IPsec policies, define what traffic to protect, and apply it to interfaces.

Embed presentation

Downloaded 100 times
1 / 106
2 / 106
3 / 106
4 / 106
5 / 106
6 / 106
7 / 106
8 / 106
9 / 106
10 / 106
11 / 106
12 / 106
13 / 106
14 / 106
15 / 106
16 / 106
17 / 106
18 / 106
19 / 106
20 / 106
21 / 106
22 / 106
23 / 106
24 / 106
25 / 106
26 / 106
27 / 106
28 / 106
29 / 106
30 / 106
31 / 106
32 / 106
33 / 106
34 / 106
35 / 106
36 / 106
37 / 106
38 / 106
39 / 106
40 / 106
41 / 106
42 / 106
43 / 106
44 / 106
45 / 106
46 / 106
47 / 106
48 / 106
49 / 106
50 / 106
51 / 106
52 / 106
53 / 106
54 / 106
55 / 106
56 / 106
57 / 106
58 / 106
59 / 106
60 / 106
61 / 106
62 / 106
63 / 106
64 / 106
65 / 106
66 / 106
67 / 106
68 / 106
69 / 106
70 / 106
71 / 106
72 / 106
73 / 106
74 / 106
75 / 106
76 / 106
77 / 106
78 / 106
79 / 106
80 / 106
81 / 106
82 / 106
83 / 106
84 / 106
85 / 106
86 / 106
87 / 106
88 / 106
89 / 106
90 / 106
91 / 106
92 / 106
93 / 106
94 / 106
95 / 106
96 / 106
97 / 106
98 / 106
99 / 106
100 / 106
101 / 106
102 / 106
103 / 106
104 / 106
105 / 106
106 / 106
1© 2009 Cisco Learning Institute. CCNA Security Chapter Eight Implementing Virtual Private Networks
222© 2009 Cisco Learning Institute. Lesson Planning • This lesson should take 3-4 hours to present • The lesson should include lecture, demonstrations, discussions and assessments • The lesson can be taught in person or using remote instruction
333© 2009 Cisco Learning Institute. Major Concepts • Describe the purpose and operation of VPN types • Describe the purpose and operation of GRE VPNs • Describe the components and operations of IPsec VPNs • Configure and verify a site-to-site IPsec VPN with pre- shared key authentication using CLI • Configure and verify a site-to-site IPsec VPN with pre- shared key authentication using SDM • Configure and verify a Remote Access VPN
444© 2009 Cisco Learning Institute. Lesson Objectives Upon completion of this lesson, the successful participant will be able to: 1. Describe the purpose and operation of VPNs 2. Differentiate between the various types of VPNs 3. Identify the Cisco VPN product line and the security features of these products 4. Configure a site-to-site VPN GRE tunnel 5. Describe the IPSec protocol and its basic functions 6. Differentiate between AH and ESP 7. Describe the IKE protocol and modes 8. Describe the five steps of IPSec operation
555© 2009 Cisco Learning Institute. Lesson Objectives 9. Describe how to prepare IPSec by ensuring that ACLs are compatible with IPSec 10. Configure IKE policies using the CLI 11. Configure the IPSec transform sets using the CLI 12. Configure the crypto ACLs using the CLI 13. Configure and apply a crypto map using the CLI 14. Describe how to verify and troubleshoot the IPSec configuration 15. Describe how to configure IPSec using SDM 16. Configure a site-to-site VPN using the Quick Setup VPN Wizard in SDM 17. Configure a site-to-site VPN using the step-by-step VPN Wizard in SDM
666© 2009 Cisco Learning Institute. Lesson Objectives 18. Verify, monitor and troubleshoot VPNs using SDM 19. Describe how an increasing number of organizations are offering telecommuting options to their employees 20. Differentiate between Remote Access IPSec VPN solutions and SSL VPNs 21. Describe how SSL is used to establish a secure VPN connection 22. Describe the Cisco Easy VPN feature 23. Configure a VPN Server using SDM 24. Connect a VPN client using the Cisco VPN Client software
777© 2009 Cisco Learning Institute. What is a VPN? - Virtual: Information within a private network is transported over a public network. - Private: The traffic is encrypted to keep the data confidential. VPN VPN Firewall CSA Regional branch with a VPN enabled Cisco ISR router SOHO with a Cisco DSL Router VPN Mobile Worker with a Cisco VPN Client Business Partner with a Cisco Router Corporate NetworkWAN Internet
888© 2009 Cisco Learning Institute. Layer 3 VPN • Generic routing encapsulation (GRE) • Multiprotocol Label Switching (MPLS) • IPSec SOHO with a Cisco DSL Router VPN Internet IPSec IPSec
999© 2009 Cisco Learning Institute. Types of VPN Networks MARS VPN VPN Iron Port Firewall IP S Web Server Email Server DNS CSA CSACSACSA CSA CSA CSA Regional branch with a VPN enabled Cisco ISR router SOHO with a Cisco DSL Router VPN Mobile Worker with a Cisco VPN Client Business Partner with a Cisco Router Site-to-Site VPNs Remote-access VPNs Internet WAN
101010© 2009 Cisco Learning Institute. Site-to-Site VPN MARS VPN VPN Iron Port Firewall IP S Web Server Email Server DNS CS A CS A CS A CSA CSA CSA CSA Regional branch with a VPN enabled Cisco ISR router SOHO with a Cisco DSL Router VP N Business Partner with a Cisco Router Site-to-Site VPNs Internet WAN Hosts send and receive normal TCP/IP traffic through a VPN gateway
111111© 2009 Cisco Learning Institute. Remote-Access VPNs MARS VPN Iron Port Firewall IPS Web Server Email Server DNS CSA CSA CSACSA CSA CSA CSA Mobile Worker with a Cisco VPN Client Remote-access VPNs Internet
121212© 2009 Cisco Learning Institute. VPN Client Software R1 R1-vpn-cluster.span.com “R1” In a remote-access VPN, each host typically has Cisco VPN Client software
131313© 2009 Cisco Learning Institute. Cisco IOS SSL VPN • Provides remote-access connectivity from any Internet-enabled host • Uses a web browser and SSL encryption • Delivers two modes of access: - Clientless - Thin client
141414© 2009 Cisco Learning Institute. Cisco VPN Product Family Product Choice Remote-Access VPN Site-to-Site VPN Cisco VPN-Enabled Router Secondary role Primary role Cisco PIX 500 Series Security Appliances Secondary role Primary role Cisco ASA 5500 Series Adaptive Security Appliances Primary role Secondary role Cisco VPN 3000 Series Concentrators Primary role Secondary role Home Routers Primary role
151515© 2009 Cisco Learning Institute. Cisco VPN-Optimized Routers Remote Office Cisco Router Regional Office Cisco Router SOHO Cisco Router Main Office Cisco Router Internet VPN Features: •Voice and video enabled VPN (V3PN) •IPSec stateful failover •DMVPN •IPSec and Multiprotocol Label Switching (MPLS) integration •Cisco Easy VPN
161616© 2009 Cisco Learning Institute. Cisco ASA 5500 Series Adaptive Security Appliances • Flexible platform • Resilient clustering • Cisco Easy VPN • Automatic Cisco VPN • Cisco IOS SSL VPN • VPN infrastructure for contemporary applications • Integrated web-based management Extranet Business-to-Business Intranet Remote User Remote Site Central Site Internet
171717© 2009 Cisco Learning Institute. IPSec Clients Small Office Internet Cisco AnyConnect VPN Client Certicom PDA IPsec VPN Client Internet Cisco VPN Software Client Router with Firewall and VPN Client A wireless client that is loaded on a pda Software loaded on a PC A network appliance that connects SOHO LANs to the VPN Provides remote users with secure VPN connections
181818© 2009 Cisco Learning Institute. Hardware Acceleration Modules • AIM • Cisco IPSec VPN Shared Port Adapter (SPA) • Cisco PIX VPN Accelerator Card+ (VAC+) • Enhanced Scalable Encryption Processing (SEP-E) Cisco IPsec VPN SPA
191919© 2009 Cisco Learning Institute. GRE VPN Overview
202020© 2009 Cisco Learning Institute. Encapsulation Original IP Packet Encapsulated with GRE
212121© 2009 Cisco Learning Institute. Configuring a GRE Tunnel R1(config)# interface tunnel 0 R1(config–if)# ip address 10.1.1.1 255.255.255.252 R1(config–if)# tunnel source serial 0/0 R1(config–if)# tunnel destination 192.168.5.5 R1(config–if)# tunnel mode gre ip R1(config–if)# R2(config)# interface tunnel 0 R2(config–if)# ip address 10.1.1.2 255.255.255.252 R2(config–if)# tunnel source serial 0/0 R2(config–if)# tunnel destination 192.168.3.3 R2(config–if)# tunnel mode gre ip R2(config–if)# Create a tunnel interface Assign the tunnel an IP address Identify the source tunnel interface Identify the destination of the tunnel Configure what protocol GRE will encapsulate
222222© 2009 Cisco Learning Institute. Using GRE User Traffic IP Only ? Use GRE Tunnel NoNo YesYes NoNo YesYes Unicast Only? Use IPsec VPN GRE does not provide encryption
232323© 2009 Cisco Learning Institute. IPSec Topology • Works at the network layer, protecting and authenticating IP packets. - It is a framework of open standards which is algorithm-independent. - It provides data confidentiality, data integrity, and origin authentication. Business Partner with a Cisco Router Regional Office with a Cisco PIX Firewall SOHO with a Cisco SDN/DSL Router Mobile Worker with a Cisco VPN Client on a Laptop Computer ASA Legacy Concentrator Main Site Perimeter Router Legacy Cisco PIX Firewall IPsec POP Corporate
242424© 2009 Cisco Learning Institute. IPSec Framework Diffie-Hellman DH7
252525© 2009 Cisco Learning Institute. DH7Diffie-Hellman Confidentiality Key length: - 56-bits Key length: - 56-bits (3 times) Key length: - 160-bits Key lengths: -128-bits -192 bits -256-bits Least secure Most secure
262626© 2009 Cisco Learning Institute. DH7Diffie-Hellman Integrity Key length: - 128-bits Key length: - 160-bits) Least secure Most secure
272727© 2009 Cisco Learning Institute. DH7Diffie-Hellman Authentication
282828© 2009 Cisco Learning Institute. DH7Diffie-Hellman Pre-shared Key (PSK) •At the local device, the authentication key and the identity information (device-specific information) are sent through a hash algorithm to form hash_I. One-way authentication is established by sending hash_I to the remote device. If the remote device can independently create the same hash, the local device is authenticated. • The authentication process continues in the opposite direction. The remote device combines its identity information with the preshared-based authentication key and sends it through the hash algorithm to form hash_R. hash_R is sent to the local device. If the local device can independently create the same hash, the remote device is authenticated.
292929© 2009 Cisco Learning Institute. RSA Signatures • At the local device, the authentication key and identity information (device-specific information) are sent through the hash algorithm forming hash_I. hash_I is encrypted using the local device's private encryption key creating a digital signature. The digital signature and a digital certificate are forwarded to the remote device. The public encryption key for decrypting the signature is included in the digital certificate. The remote device verifies the digital signature by decrypting it using the public encryption key. The result is hash_I. • Next, the remote device independently creates hash_I from stored information. If the calculated hash_I equals the decrypted hash_I, the local device is authenticated. After the remote device authenticates the local device, the authentication process begins in the opposite direction and all steps are repeated from the remote device to the local device.
303030© 2009 Cisco Learning Institute. Diffie-Hellman Secure Key Exchange DH7
313131© 2009 Cisco Learning Institute. IPSec Framework Protocols All data is in plaintext. R1 R2 Data payload is encrypted. R1 R2 Authentication Header Encapsulating Security Payload AH provides the following:  Authentication  Integrity ESP provides the following:  Encryption  Authentication  Integrity
323232© 2009 Cisco Learning Institute. Authentication Header Authentication Data (00ABCDEF) IP Header + Data + Key R1 R2 Hash Recomputed Hash (00ABCDEF) IP Header + Data + Key Hash Received Hash (00ABCDEF)= DataAHIP HDR DataAHIP HDR Internet 1. The IP Header and data payload are hashed 2. The hash builds a new AH header which is prepended to the original packet 3. The new packet is transmitted to the IPSec peer router 4. The peer router hashes the IP header and data payload, extracts the transmitted hash and compares
333333© 2009 Cisco Learning Institute. ESP Diffie-Hellman DH7
343434© 2009 Cisco Learning Institute. Function of ESP ESP Trailer ESP Auth • Provides confidentiality with encryption • Provides integrity with authentication Router Router IP HDR Data ESP HDRNew IP HDR IP HDR Data Authenticated IP HDR Data Internet Encrypted
353535© 2009 Cisco Learning Institute. IP HDR ESP HDR Data ESP HDR IP HDRNew IP HDR Data Tunnel Mode Transport Mode ESP Trailer ESP Auth ESP Trailer ESP Auth Authenticated Authenticated IP HDR Data Encrypted Encrypted Original data prior to selection of IPSec protocol mode Mode Types
363636© 2009 Cisco Learning Institute. Security Associations IPSec parameters are configured using IKE
373737© 2009 Cisco Learning Institute. Host A Host B R1 R2 10.0.1.3 10.0.2.3 IKE Phase 1 Exchange 1. Negotiate IKE policy sets 2. DH key exchange 3. Verify the peer identity IKE Phases IKE Phase 2 Exchange Negotiate IPsec policy Negotiate IPsec policy Policy 15 DES MD5 pre-share DH1 lifetime Policy 10 DES MD5 pre-share DH1 lifetime 1. Negotiate IKE policy sets 2. DH key exchange 3. Verify the peer identity
383838© 2009 Cisco Learning Institute. Negotiates matching IKE policies to protect IKE exchange Policy 15 DES MD5 pre-share DH1 lifetime Policy 10 DES MD5 pre-share DH1 lifetime IKE Policy Sets Policy 20 3DES SHA pre-share DH1 lifetime Negotiate IKE Proposals Host A Host B R1 R2 10.0.1.3 10.0.2.3 IKE Phase 1 – First Exchange
393939© 2009 Cisco Learning Institute. IKE Phase 1 – Second Exchange ((YB ) mod p = K (YA ) mod p = K XB XA Private value, XA Public value, YA Private value, XB Public value, YBAlice Bob YYAA YYBB YB = g mod pXBYYAA = g mod pXA A DH exchange is performed to establish keying material. Establish DH Key
404040© 2009 Cisco Learning Institute. IKE Phase 1 – Third Exchange Peer authentication methods • PSKs • RSA signatures • RSA encrypted nonces HR Servers Remote Office Corporate Office Internet Peer Authentication A bidirectional IKE SA is now established. Authenticate Peer
414141© 2009 Cisco Learning Institute. Host A Host B R1 R2 10.0.1.3 10.0.2.3 IKE Phase 1 Aggressive Mode Exchange 1.Send IKE policy set and R1’s DH key 3.Calculate shared secret, verify peer identify, and confirm with peer IKE Phase 2 Exchange Negotiate IPsec policy Negotiate IPsec policy Policy 15 DES MD5 pre-share DH1 lifetime Policy 10 DES MD5 pre-share DH1 lifetime 2. Confirm IKE policy set, calculate shared secret and send R2’s DH key 4. Authenticate peer and begin Phase 2. IKE Phase 1 – Aggressive Mode
424242© 2009 Cisco Learning Institute. Negotiate IPsec Security Parameters Host A Host B R1 R2 10.0.1.3 10.0.2.3 IKE Phase 2 • IKE negotiates matching IPsec policies. • Upon completion, unidirectional IPsec Security Associations(SA) are established for each protocol and algorithm combination.
434343© 2009 Cisco Learning Institute. IKE Phase 1 IKE Phase 2 IKE SA IKE SA IPsec SAIPsec SA 1. Host A sends interesting traffic to Host B. 2. R1 and R2 negotiate an IKE Phase 1 session. 3. R1 and R2 negotiate an IKE Phase 2 session. 4. Information is exchanged via IPsec tunnel. 5. The IPsec tunnel is terminated. R1 R2 10.0.2.3 IPsec Tunnel 10.0.1.3 IPSec VPN Negotiation
444444© 2009 Cisco Learning Institute. Configuring IPsec Task 1: Ensure that ACLs are compatible with IPsec. Task 2: Create ISAKMP (IKE) policy. Task 3: Configure IPsec transform set. Task 4: Create a crypto ACL. Task 5: Create and apply the crypto map. Tasks to Configure IPsec:
454545© 2009 Cisco Learning Institute. Task 1 Configure Compatible ACLs • Ensure that protocols 50 (ESP), 51 (AH) and UDP port 500 (ISAKMP) traffic are not blocked by incoming ACLs on interfaces used by IPsec. AH ESP IKE Site 1 Site 2 10.0.1.3 10.0.2.3 R1 R2 Internet S0/0/0 172.30.1.2 S0/0/0 172.30.2.2 10.0.1.0/24 10.0.2.0/24
464646© 2009 Cisco Learning Institute. R1(config)# access-list 102 permit ahp host 172.30.2.2 host 172.30.1.2 R1(config)# access-list 102 permit esp host 172.30.2.2 host 172.30.1.2 R1(config)# access-list 102 permit udp host 172.30.2.2 host 172.30.1.2 eq isakmp R1(config)# R1(config)# interface Serial0/0/0 R1(config-if)# ip address 172.30.1.2 255.255.255.0 R1(config-if)# ip access-group 102 in ! R1(config)# exit R1# R1# show access-lists access-list 102 permit ahp host 172.30.2.2 host 172.30.1.2 access-list 102 permit esp host 172.30.2.2 host 172.30.1.2 access-list 102 permit udp host 172.30.2.2 host 172.30.1.2 eq isakmp R1# AH ESP IKESite 1 Site 2 10.0.1.3 10.0.2.3R1 R2 Internet S0/0/0 172.30.1.2 S0/0/0 172.30.2.2 10.0.1.0/2 4 10.0.2.0/24 Permitting Traffic
474747© 2009 Cisco Learning Institute. Defines the parameters within the IKE policy crypto isakmp policy priority router(config)# R1(config)# crypto isakmp policy 110 R1(config–isakmp)# authentication pre-share R1(config–isakmp)# encryption des R1(config–isakmp)# group 1 R1(config–isakmp)# hash md5 R1(config–isakmp)# lifetime 86400 Tunnel Policy 110 DES MD5 Preshare 86400 DH1 Site 1 Site 2 10.0.1.3 10.0.2.3R1 R2 Internet 10.0.1.0/24 10.0.2.0/24 Task 2 Configure IKE
484848© 2009 Cisco Learning Institute. ISAKMP Parameters Parameter Keyword Accepted Values Default Value Description encryption des 3des aes aes 192 aes 256 56-bit Data Encryption Standard Triple DES 128-bit AES 192-bit AES 256-bit AES des Message encryption algorithm hash sha md5 SHA-1 (HMAC variant) MD5 (HMAC variant) sha Message integrity (Hash) algorithm authenticati on pre-share rsa-encr rsa-sig preshared keys RSA encrypted nonces RSA signatures rsa-sig Peer authentication method group 1 2 5 768-bit Diffie-Hellman (DH) 1024-bit DH 1536-bit DH 1 Key exchange parameters (DH group identifier) lifetime seconds Can specify any number of seconds 86,400 sec (one day) ISAKMP-established SA lifetime
494949© 2009 Cisco Learning Institute. Multiple Policies crypto isakmp policy 100 hash md5 authentication pre-share ! crypto isakmp policy 200 hash sha authentication rsa-sig ! crypto isakmp policy 300 hash md5 authentication rsa-sig crypto isakmp policy 100 hash md5 authentication pre-share ! crypto isakmp policy 200 hash sha authentication rsa-sig ! crypto isakmp policy 300 hash md5 authentication pre-share R1(config)# R2(config)# Site 1 Site 2 10.0.1.3 10.0.2.3R1 R2 Internet 10.0.1.0/24 10.0.2.0/24
505050© 2009 Cisco Learning Institute. R1(config)# crypto isakmp policy 110 R1(config–isakmp)# authentication pre-share R1(config–isakmp)# encryption 3des R1(config–isakmp)# group 2 R1(config–isakmp)# hash sha R1(config–isakmp)# lifetime 43200 Policy 110 Preshare 3DES SHA DH2 43200 R2(config)# crypto isakmp policy 100 R2(config–isakmp)# authentication pre-share R2(config–isakmp)# encryption 3des R2(config–isakmp)# group 2 R2(config–isakmp)# hash sha R2(config–isakmp)# lifetime 43200 R2 must have an ISAKMP policy configured with the same parameters. Tunnel Site 1 Site 2 10.0.1.3 10.0.2.3R1 R2 Internet 10.0.1.0/24 10.0.2.0/24 R1 attempts to establish a VPN tunnel with R2 and sends its IKE policy parameters Policy Negotiations
515151© 2009 Cisco Learning Institute. Crypto ISAKMP Key • The peer-address or peer-hostname can be used, but must be used consistently between peers. • If the peer-hostname is used, then the crypto isakmp identity hostname command must also be configured. crypto isakmp key keystring address peer-address router(config)# crypto isakmp key keystring hostname hostname router(config)# Parameter Description keystring This parameter specifies the PSK. Use any combination of alphanumeric characters up to 128 bytes. This PSK must be identical on both peers. peer- address This parameter specifies the IP address of the remote peer. hostname This parameter specifies the hostname of the remote peer. This is the peer hostname concatenated with its domain name (for example, myhost.domain.com).
525252© 2009 Cisco Learning Institute. R1(config)# crypto isakmp policy 110 R1(config–isakmp)# authentication pre-share R1(config–isakmp)# encryption 3des R1(config–isakmp)# group 2 R1(config–isakmp)# hash sha R1(config–isakmp)# lifetime 43200 R1(config-isakmp)# exit R1(config)# crypto isakmp key cisco123 address 172.30.2.2 R1(config)# R2(config)# crypto isakmp policy 110 R2(config–isakmp)# authentication pre-share R2(config–isakmp)# encryption 3des R2(config–isakmp)# group 2 R2(config–isakmp)# hash sha R2(config–isakmp)# lifetime 43200 R2(config-isakmp)# exit R2(config)# crypto isakmp key cisco123 address 172.30.1.2 R2(config)# Note: • The keystring cisco1234 matches. • The address identity method is specified. • The ISAKMP policies are compatible. • Default values do not have to be configured. Site 1 Site 2 10.0.1.3 10.0.2.3R1 R2 Internet 10.0.1.0/24 10.0.2.0/24 Sample Configuration
535353© 2009 Cisco Learning Institute. router(config)# crypto ipsec transform–set transform-set-name transform1 [transform2] [transform3]] crypto ipsec transform-set Parameters Command Description transform-set-name This parameter specifies the name of the transform set to create (or modify). transform1, transform2, transform3 Type of transform set. You may specify up to four "transforms": one Authentication Header (AH), one Encapsulating Security Payload (ESP) encryption, one ESP authentication. These transforms define the IP Security (IPSec) security protocols and algorithms. A transform set is a combination of IPsec transforms that enact a security policy for traffic. Task 3 Configure the Transform Set
545454© 2009 Cisco Learning Institute. Transform Sets • Transform sets are negotiated during IKE Phase 2. • The 9th attempt found matching transform sets (CHARLIE - YELLOW). Host B 10.0.1.3 10.0.2.3 R1 R2Host A transform-set ALPHA esp-3des tunnel transform-set BETA esp-des, esp-md5-hmac tunnel transform-set CHARLIE esp-3des, esp-sha-hmac tunnel transform-set RED esp-des tunnel transform-set BLUE esp-des, ah-sha-hmac tunnel transform-set YELLOW esp-3des, esp-sha-hmac tunnel Match Internet 1 2 3 4 5 6 7 8 9 172.30.2.2 172.30.1.2
555555© 2009 Cisco Learning Institute. Site 1 Site 2 A B 10.0.1.3 10.0.2.3 R1 R2 Internet R1(config)# crypto isakmp key cisco123 address 172.30.2.2 R1(config)# crypto ipsec transform-set MYSET esp-aes 128 R1(cfg-crypto-trans)# exit R1(config)# R2(config)# crypto isakmp key cisco123 address 172.30.1.2 R2(config)#crypto ipsec transform-set OTHERSET esp-aes 128 R2(cfg-crypto-trans)# exit 172.30.2.2 172.30.1.2 Note: • Peers must share the same transform set settings. • Names are only locally significant. Sample Configuration
565656© 2009 Cisco Learning Institute. Task 4 Configure the Crypto ACLs • Outbound indicates the data flow to be protected by IPsec. • Inbound filters and discards traffic that should have been protected by IPsec. Host A R1 Internet Outbound Traffic Inbound Traffic Encrypt Bypass (Plaintext) Permit Bypass Discard (Plaintext)
575757© 2009 Cisco Learning Institute. 10.0.1.3 10.0.2.3 R1 R2 Internet router(config)# access-list access-list-number [dynamic dynamic-name [timeout minutes]]{deny | permit} protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos] [log] access-list access-list-number Parameters access-list access-list-number Command Description permit This option causes all IP traffic that matches the specified conditions to be protected by cryptography, using the policy described by the corresponding crypto map entry. deny This option instructs the router to route traffic in plaintext. protocol This option specifies which traffic to protect by cryptography based on the protocol, such as TCP, UDP, or ICMP. If the protocol is IP, then all traffic IP traffic that matches that permit statement is encrypted. source and destination If the ACL statement is a permit statement, these are the networks, subnets, or hosts between which traffic should be protected. If the ACL statement is a deny statement, then the traffic between the specified source and destination is sent in plaintext. 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.1.2 S0/0/0 172.30.2.2 Command Syntax
585858© 2009 Cisco Learning Institute. S0/1 10.0.1.3 10.0.2.3R1 R2 Internet Site 2 Applied to R1 S0/0/0 outbound traffic: R1(config)# access-list 110 permit tcp 10.0.1.0 0.0.0.255 10.0.2.0 0.0.0.255 (when evaluating inbound traffic– source: 10.0.2.0, destination: 10.0.1.0) S0/0/0 172.30.2.2 S0/0/0 172.30.1.2 Applied to R2 S0/0/0 outbound traffic: R2(config)# access-list 101 permit tcp 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255 (when evaluating inbound traffic- source: 10.0.1.0, destination: 10.0.2.0) 10.0.1.0/24 Site 1 10.0.2.0/24 Symmetric Crypto ACLs
595959© 2009 Cisco Learning Institute. Task 5 Apply the Crypto Map Crypto maps define the following:  ACL to be used  Remote VPN peers  Transform set to be used  Key management method  SA lifetimes Site 1 10.0.1.3 R1 R2 10.0.2.3 Site 2 Internet Encrypted Traffic Router Interface or Subinterface
606060© 2009 Cisco Learning Institute. crypto map map-name seq-num ipsec-manual crypto map map-name seq-num ipsec-isakmp [dynamic dynamic-map-name] router(config)# crypto map Parameters Command Parameters Description map-name Defines the name assigned to the crypto map set or indicates the name of the crypto map to edit. seq-num The number assigned to the crypto map entry. ipsec-manual Indicates that ISAKMP will not be used to establish the IPsec SAs. ipsec-isakmp Indicates that ISAKMP will be used to establish the IPsec SAs. cisco (Default value) Indicates that CET will be used instead of IPsec for protecting the traffic. dynamic (Optional) Specifies that this crypto map entry references a preexisting static crypto map. If this keyword is used, none of the crypto map configuration commands are available. dynamic-map-name (Optional) Specifies the name of the dynamic crypto map set that should be used as the policy template. Crypto Map Command
616161© 2009 Cisco Learning Institute. Crypto Map Configuration Mode Commands Command Description set Used with the peer, pfs, transform-set, and security-association commands. peer [hostname | ip- address] Specifies the allowed IPsec peer by IP address or hostname. pfs [group1 | group2] Specifies DH Group 1 or Group 2. transform-set [set_name(s)] Specify list of transform sets in priority order. When the ipsec-manual parameter is used with the crypto map command, then only one transform set can be defined. When the ipsec-isakmp parameter or the dynamic parameter is used with the crypto map command, up to six transform sets can be specified. security-association lifetime Sets SA lifetime parameters in seconds or kilobytes. match address [access- list-id | name] Identifies the extended ACL by its name or number. The value should match the access-list-number or name argument of a previously defined IP-extended ACL being matched. no Used to delete commands entered with the set command. exit Exits crypto map configuration mode.
626262© 2009 Cisco Learning Institute. Multiple peers can be specified for redundancy. R3 S0/0/0 172.30.3.2 R1(config)# crypto map MYMAP 10 ipsec-isakmp R1(config-crypto-map)# match address 110 R1(config-crypto-map)# set peer 172.30.2.2 default R1(config-crypto-map)# set peer 172.30.3.2 R1(config-crypto-map)# set pfs group1 R1(config-crypto-map)# set transform-set mine R1(config-crypto-map)# set security-association lifetime seconds 86400 10.0.1.3 10.0.2.3 R1 R2 Internet Sample Configuration 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.2.2
636363© 2009 Cisco Learning Institute. • Applies the crypto map to outgoing interface • Activates the IPsec policy crypto map map-name R1(config)# interface serial0/0/0 R1(config-if)# crypto map MYMAP router(config-if)# MYMAP Assign the Crypto Map Set 10.0.1.3 10.0.2.3 R1 R2 Internet 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.1.2 S0/0/0 172.30.2.2
646464© 2009 Cisco Learning Institute. CLI Commands Show Command Description show crypto map Displays configured crypto maps show crypto isakmp policy Displays configured IKE policies show crypto ipsec sa Displays established IPsec tunnels show crypto ipsec transform-set Displays configured IPsec transform sets debug crypto isakmp Debugs IKE events debug crypto ipsec Debugs IPsec events
656565© 2009 Cisco Learning Institute. R1# show crypto map Crypto Map “MYMAP" 10 ipsec-isakmp Peer = 172.30.2.2 Extended IP access list 110 access-list 102 permit ip host 10.0.1.3 host 10.0.2.3 Current peer: 172.30.2.2 Security association lifetime: 4608000 kilobytes/3600 seconds PFS (Y/N): N Transform sets={ MYSET, } show crypto map Displays the currently configured crypto maps router# show crypto map 10.0.1.3 10.0.2.3 R1 R2 Internet 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.1.2 S0/0/0 172.30.2.2
666666© 2009 Cisco Learning Institute. show crypto isakmp policy R1# show crypto isakmp policy Protection suite of priority 110 encryption algorithm: 3DES - Data Encryption Standard (168 bit keys). hash algorithm: Secure Hash Standard authentication method: preshared Diffie-Hellman group: #2 (1024 bit) lifetime: 86400 seconds, no volume limit Default protection suite encryption algorithm: DES - Data Encryption Standard (56 bit keys). hash algorithm: Secure Hash Standard authentication method: Rivest-Shamir-Adleman Signature Diffie-Hellman group: #1 (768 bit) lifetime: 86400 seconds, no volume limit router# show crypto isakmp policy 10.0.1.3 10.0.2.3 R1 R2 Internet 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.1.2 S0/0/0 172.30.2.2
676767© 2009 Cisco Learning Institute. show crypto ipsec transform-set Displays the currently defined transform sets R1# show crypto ipsec transform-set Transform set AES_SHA: { esp-128-aes esp-sha-hmac } will negotiate = { Tunnel, }, show crypto ipsec transform-set 10.0.1.3 10.0.2.3 R1 R2 Internet 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.1.2 S0/0/0 172.30.2.2
686868© 2009 Cisco Learning Institute. show crypto ipsec sa R1# show crypto ipsec sa Interface: Serial0/0/0 Crypto map tag: MYMAP, local addr. 172.30.1.2 local ident (addr/mask/prot/port): (172.30.1.2/255.255.255.255/0/0) remote ident (addr/mask/prot/port): (172.30.2.2/255.255.255.255/0/0) current_peer: 172.30.2.2 PERMIT, flacs={origin_is_acl,} #pkts encaps: 21, #pkts encrypt: 21, #pkts digest 0 #pkts decaps: 21, #pkts decrypt: 21, #pkts verify 0 #send errors 0, #recv errors 0 local crypto endpt.: 172.30.1.2, remote crypto endpt.: 172.30.2.2 path mtu 1500, media mtu 1500 current outbound spi: 8AE1C9C 10.0.1.3 10.0.2.3 R1 R2 Internet 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.1.2 S0/0/0 172.30.2.2
696969© 2009 Cisco Learning Institute. debug crypto isakmp router# debug crypto isakmp • This is an example of the Main Mode error message. • The failure of Main Mode suggests that the Phase I policy does not match on both sides. • Verify that the Phase I policy is on both peers and ensure that all the attributes match. 1d00h: ISAKMP (0:1): atts are not acceptable. Next payload is 0 1d00h: ISAKMP (0:1); no offers accepted! 1d00h: ISAKMP (0:1): SA not acceptable! 1d00h: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Main Mode failed with peer at 172.30.2.2
707070© 2009 Cisco Learning Institute. Starting a VPN Wizard Wizards for IPsec Solutions, includes type of VPNs and Individual IPsec components 1 2 4 5 3 VPN implementation Subtypes. Vary based On VPN wizard chosen. 1. Click Configure in main toolbar 2. Click the VPN button to open the VPN page 3. Choose a wizard 4. Click the VPN implementation subtype 5. Click the Launch the Selected Task button
717171© 2009 Cisco Learning Institute. VPN Components Individual IPsec components used to build VPNs VPN Wizards SSL VPN parameters Easy VPN server parameters Public key certificate parameters Encrypt VPN passwords VPN Components
727272© 2009 Cisco Learning Institute. Configuring a Site-to-Site VPN Click the Launch the Selected Task button Choose Configure > VPN > Site-to-Site VPN Click the Create a Site-to-Site VPN
737373© 2009 Cisco Learning Institute. Site-to-Site VPN Wizard Choose the wizard mode Click Next to proceed to the configuration of parameters.
747474© 2009 Cisco Learning Institute. Quick Setup Configure the parameters •Interface to use •Peer identity information •Authentication method •Traffic to encrypt
757575© 2009 Cisco Learning Institute. Verify Parameters
767676© 2009 Cisco Learning Institute. 1 2 3 4 Step-by-Step Wizard Choose the outside interface that is used to connect to the IPSec peer Specify the IP address of the peer Choose the authentication method and specify the credentials Click Next
777777© 2009 Cisco Learning Institute. Creating a Custom IKE Proposal 1 2 3Click Add to define a proposal Make the selections to configure the IKE Policy and click OK Click Next
787878© 2009 Cisco Learning Institute. 1 2 3 Creating a Custom IPSec Transform Set Click NextClick Add Define and specify the transform set name, integrity algorithm, encryption algorithm, mode of operation and optional compression
797979© 2009 Cisco Learning Institute. 1 2 3 Protecting Traffic Subnet to Subnet Click Protect All Traffic Between the Following subnets Define the IP address and subnet mask of the local network Define the IP address and subnet mask of the remote network
808080© 2009 Cisco Learning Institute. 2 3 1 Protecting Traffic Custom ACL Click the Create/Select an Access-List for IPSec Traffic radio button Click the ellipses button to choose an existing ACL or create a new one To use an existing ACL, choose the Select an Existing Rule (ACL) option. To create a new ACL, choose the Create a New Rule (ACL) and Select option
818181© 2009 Cisco Learning Institute. Add a Rule 1 2Give the access rule a name and description Click Add
828282© 2009 Cisco Learning Institute. Configuring a New Rule Entry 1 2 3 Choose an action and enter a description of the rule entry Define the source hosts or networks in the Source Host/Network pane and the destination hosts or network in the Destination/Host Network pane (Optional) To provide protection for specific protocols, choose the specific protocol radio box and desired port numbers
838383© 2009 Cisco Learning Institute. • Click Back to modify the configuration. • Click Finish to complete the configuration. Configuration Summary
848484© 2009 Cisco Learning Institute. Check VPN status. Create a mirroring configuration if no Cisco SDM is available on the peer. Test the VPN configuration. Verify VPN Configuration Choose Configure > VPN > Site-to-Site VPN > Edit Site-to-Site VPN
858585© 2009 Cisco Learning Institute. Lists all IPsec tunnels, their parameters, and status. 1 Monitor Choose Monitor > VPN Status > IPSec Tunnels
868686© 2009 Cisco Learning Institute. Telecommuting • Flexibility in working location and working hours • Employers save on real- estate, utility and other overhead costs • Succeeds if program is voluntary, subject to management discretion, and operationally feasible
878787© 2009 Cisco Learning Institute. Telecommuting Benefits • Organizational benefits: - Continuity of operations - Increased responsiveness - Secure, reliable, and manageable access to information - Cost-effective integration of data, voice, video, and applications - Increased employee productivity, satisfaction, and retention • Social benefits: - Increased employment opportunities for marginalized groups - Less travel and commuter related stress • Environmental benefits: - Reduced carbon footprints, both for individual workers and organizations
888888© 2009 Cisco Learning Institute. Implementing Remote Access
898989© 2009 Cisco Learning Institute. Methods for Deploying Remote Access IPsec Remote Access VPN SSL-Based VPN Any Application Anywhere Access
909090© 2009 Cisco Learning Institute. Comparison of SSL and IPSec SSL IPsec Applications Web-enabled applications, file sharing, e- mail All IP-based applications Encryption Moderate Key lengths from 40 bits to 128 bits Stronger Key lengths from 56 bits to 256 bits Authentication Moderate One-way or two-way authentication Strong Two-way authentication using shared secrets or digital certificates Ease of Use Very high Moderate Can be challenging to nontechnical users Overall Security Moderate Any device can connect Strong Only specific devices with specific configurations can connect
919191© 2009 Cisco Learning Institute. SSL VPNs • Integrated security and routing • Browser-based full network SSL VPN access SSL VPN Workplace Resources Headquarters Internet SSL VPN Tunnel
929292© 2009 Cisco Learning Institute. Types of Access
939393© 2009 Cisco Learning Institute. Full Tunnel Client Access Mode
949494© 2009 Cisco Learning Institute. User using SSL client Establishing an SSL Session User makes a connection to TCP port 443 Router replies with a digitally signed public key Shared-secret key, encrypted with public key of the server, is sent to the router Bulk encryption occurs using the shared-secret key with a symmetric encryption algorithm User software creates a shared-secret key 1 2 3 4 5 SSL VPN enabled ISR router
959595© 2009 Cisco Learning Institute. SSL VPN Design Considerations • User connectivity • Router feature • Infrastructure planning • Implementation scope
969696© 2009 Cisco Learning Institute. Cisco Easy VPN • Negotiates tunnel parameters • Establishes tunnels according to set parameters • Automatically creates a NAT / PAT and associated ACLs • Authenticates users by usernames, group names, and passwords • Manages security keys for encryption and decryption • Authenticates, encrypts, and decrypts data through the tunnel
979797© 2009 Cisco Learning Institute. Cisco Easy VPN
989898© 2009 Cisco Learning Institute. Securing the VPN Initiate IKE Phase 1 Establish ISAKMP SA Accept Proposal1 Username/Password Challenge Username/Password System Parameters Pushed Reverse Router Injection (RRI) adds a static route entry on the router for the remote clients IP address Initiate IKE Phase 2: IPsec IPsec SA 1 2 3 4 5 6 7
999999© 2009 Cisco Learning Institute. Configuring Cisco Easy VPN Server 1 2 3 4 5
100100100© 2009 Cisco Learning Institute. Configuring IKE Proposals 1 2 3Click Add Specify required parameters Click OK
101101101© 2009 Cisco Learning Institute. Creating an IPSec Transform Set 1 2 3 4
102102102© 2009 Cisco Learning Institute. Group Authorization and Group Policy Lookup 1 2 3 4 5 Select the location where Easy VPN group policies can be stored Click Next Click Add Click Next Configure the local group policies
103103103© 2009 Cisco Learning Institute. Summary of Configuration Parameters
104104104© 2009 Cisco Learning Institute. VPN Client Overview • Establishes end-to-end, encrypted VPN tunnels for secure connectivity • Compatible with all Cisco VPN products • Supports the innovative Cisco Easy VPN capabilities R1 R1-vpn-cluster.span.com R1 R1-vpn-cluster.span.com
105105105© 2009 Cisco Learning Institute. Establishing a Connection R1-vpn-cluster.span.com R1 R1-vpn-cluster.span.com “R1” Once authenticated, status changes to connected.
106106106© 2009 Cisco Learning Institute.

More Related Content

PDF
Fortinet_ProductGuide_NOV2021_R127.pdf
byAlonzoJames2
 
PDF
CCNA CheatSheet
byEng. Emad Al-Atoum
 
PPTX
Vlans and inter vlan routing
byMohammedseleim
 
PPTX
BGP Advanced topics
byOlivier Bonaventure
 
PDF
CCNP Security-Firewall
bymohannadalhanahnah
 
PDF
5G PRACH Document-KPIs Improvemnt and understanding
byQasimQadir3
 
PPT
Modes of router
byEr. Anmol Bhagat
 
PPT
Vlan
bysanss40
 
Fortinet_ProductGuide_NOV2021_R127.pdf
byAlonzoJames2
 
CCNA CheatSheet
byEng. Emad Al-Atoum
 
Vlans and inter vlan routing
byMohammedseleim
 
BGP Advanced topics
byOlivier Bonaventure
 
CCNP Security-Firewall
bymohannadalhanahnah
 
5G PRACH Document-KPIs Improvemnt and understanding
byQasimQadir3
 
Modes of router
byEr. Anmol Bhagat
 
Vlan
bysanss40
 

What's hot

PPT
Spanning tree protocol
byMuuluu
 
PDF
Share File easily between computers using sftp
byTushar B Kute
 
PPTX
CCNA
byAbhishek Parihari
 
PPTX
SDWAN Introduction presentation & Public Speaking
bydatnc09
 
PDF
4.4.1.2 packet tracer configure ip ac ls to mitigate attacks-instructor
bySalem Trabelsi
 
PDF
CCNP Security-VPN
bymohannadalhanahnah
 
PDF
Cisco Commands
byFredrick Hall
 
PDF
Lte radio netwok planning
bytharinduwije
 
DOC
Cisco switch commands cheat sheet
by3Anetwork com
 
PDF
Les technologies des réseaux sans Fil: GSM, Bluetooth
byFaouzia Benabbou
 
PDF
How BGP Works
byThousandEyes
 
PPTX
CCNA training 101
byRohan Reddy
 
PPSX
Packet Tracer Tutorial # 2
byAbdul Basit
 
PPT
Chapter_1_V7.01.ppt Computer Networking: A Top Down Approach
bymwfproleb
 
PPTX
Bgp protocol
bySmriti Tikoo
 
PPTX
project on OSPF
byOm Prakash
 
PPTX
Dhcp server configuration
byUttamAgarwal9
 
PDF
EVPN Introduction
byBangladesh Network Operators Group
 
PDF
Bgp tutorial for ISP
byWahyu Nasution
 
PPT
dokumen.tips_ericsson-lte-throughput-troubleshooting-techniquesppt.ppt
byLibaBali
 
Spanning tree protocol
byMuuluu
 
Share File easily between computers using sftp
byTushar B Kute
 
CCNA
byAbhishek Parihari
 
SDWAN Introduction presentation & Public Speaking
bydatnc09
 
4.4.1.2 packet tracer configure ip ac ls to mitigate attacks-instructor
bySalem Trabelsi
 
CCNP Security-VPN
bymohannadalhanahnah
 
Cisco Commands
byFredrick Hall
 
Lte radio netwok planning
bytharinduwije
 
Cisco switch commands cheat sheet
by3Anetwork com
 
Les technologies des réseaux sans Fil: GSM, Bluetooth
byFaouzia Benabbou
 
How BGP Works
byThousandEyes
 
CCNA training 101
byRohan Reddy
 
Packet Tracer Tutorial # 2
byAbdul Basit
 
Chapter_1_V7.01.ppt Computer Networking: A Top Down Approach
bymwfproleb
 
Bgp protocol
bySmriti Tikoo
 
project on OSPF
byOm Prakash
 
Dhcp server configuration
byUttamAgarwal9
 
EVPN Introduction
byBangladesh Network Operators Group
 
Bgp tutorial for ISP
byWahyu Nasution
 
dokumen.tips_ericsson-lte-throughput-troubleshooting-techniquesppt.ppt
byLibaBali
 

Viewers also liked

PDF
VPN Security
bydromerotrejo
 
PDF
IPsec
byslow love
 
PPT
Chapter 5
byali raza
 
PPT
Chapter 7
byali raza
 
PPT
Chapter 6 overview
byali raza
 
PPT
Chapter 8
byali raza
 
PPTX
IPsec with AH
byjtlevesque
 
PPT
Chapter 9 overview
byali raza
 
PPT
Chapter 5 overview
byali raza
 
PPT
Chapter 3
byali raza
 
PPT
Chapter 6
byali raza
 
PPT
Chapter 2
byali raza
 
PPT
Cisco orientation
byali raza
 
PPT
Chapter 4
byali raza
 
PPT
Chapter 4 overview
byali raza
 
PPT
Chapter 1
byali raza
 
PPT
Chapter 1 overview
byali raza
 
PPT
Chapter 7 overview
byali raza
 
PPT
CCNA Discovery 4 - Chapter 7
byIrsandi Hasan
 
PPT
Chapter 3 overview
byali raza
 
VPN Security
bydromerotrejo
 
IPsec
byslow love
 
Chapter 5
byali raza
 
Chapter 7
byali raza
 
Chapter 6 overview
byali raza
 
Chapter 8
byali raza
 
IPsec with AH
byjtlevesque
 
Chapter 9 overview
byali raza
 
Chapter 5 overview
byali raza
 
Chapter 3
byali raza
 
Chapter 6
byali raza
 
Chapter 2
byali raza
 
Cisco orientation
byali raza
 
Chapter 4
byali raza
 
Chapter 4 overview
byali raza
 
Chapter 1
byali raza
 
Chapter 1 overview
byali raza
 
Chapter 7 overview
byali raza
 
CCNA Discovery 4 - Chapter 7
byIrsandi Hasan
 
Chapter 3 overview
byali raza
 

Similar to Chapter 8 overview

PDF
Ch8 - Implementing Virtual Private Networks
byOhmRon
 
PPTX
ENSA_Module_8.pptx
bySkyBlue659156
 
PPTX
ENSA_Module_8_learn_network_fundamnetals123.pptx
byahmedmahmoudece
 
PPTX
ENSA_Module_8.pptx_nice_ipsec_presentation
byRanaMukherjee24
 
PPTX
ENSA_Module_9 VPN NETWORK SITE TO SITE.pptx
byashleykimofc24
 
PPTX
Module 8 - Ccna - Pre.pptx
byAliMohamed855266
 
PPTX
4. VPN4. VPN4. VPN4. VPN4. VPN4. VPN.pptx
byFutureTechnologies3
 
PPTX
Network Security version Virtual Private Networks
byZaheer Parvez
 
PDF
Vpn security agenda by cover our privacy
byEric Fedewa
 
PPT
Vpn site to site
byIT Tech
 
PPTX
cisco-nti-Day20
byeyad alaa
 
PPT
CCNA Security - Chapter 8
byIrsandi Hasan
 
PPT
Acit Mumbai - understanding vpns
bySleek International
 
PPTX
Ccna sv2 instructor_ppt_ch8
byBabaa Naya
 
PPT
Vpn(4)
bySuraj Kumar
 
PPTX
Ccna sv2 instructor_ppt_ch8
bySalmenHAJJI1
 
PPT
VPN presentation - moeshesh
byMohamed Shishtawy
 
PPTX
PACE-IT: Networking Services and Applications (part 1) - N10 006
byPace IT at Edmonds Community College
 
PPTX
CCNASv2_InstructorPPT_CH8.en.es.pptx
byRichardChecca1
 
PPT
12 Understanding V P Ns
byAamirAziz
 
Ch8 - Implementing Virtual Private Networks
byOhmRon
 
ENSA_Module_8.pptx
bySkyBlue659156
 
ENSA_Module_8_learn_network_fundamnetals123.pptx
byahmedmahmoudece
 
ENSA_Module_8.pptx_nice_ipsec_presentation
byRanaMukherjee24
 
ENSA_Module_9 VPN NETWORK SITE TO SITE.pptx
byashleykimofc24
 
Module 8 - Ccna - Pre.pptx
byAliMohamed855266
 
4. VPN4. VPN4. VPN4. VPN4. VPN4. VPN.pptx
byFutureTechnologies3
 
Network Security version Virtual Private Networks
byZaheer Parvez
 
Vpn security agenda by cover our privacy
byEric Fedewa
 
Vpn site to site
byIT Tech
 
cisco-nti-Day20
byeyad alaa
 
CCNA Security - Chapter 8
byIrsandi Hasan
 
Acit Mumbai - understanding vpns
bySleek International
 
Ccna sv2 instructor_ppt_ch8
byBabaa Naya
 
Vpn(4)
bySuraj Kumar
 
Ccna sv2 instructor_ppt_ch8
bySalmenHAJJI1
 
VPN presentation - moeshesh
byMohamed Shishtawy
 
PACE-IT: Networking Services and Applications (part 1) - N10 006
byPace IT at Edmonds Community College
 
CCNASv2_InstructorPPT_CH8.en.es.pptx
byRichardChecca1
 
12 Understanding V P Ns
byAamirAziz
 

Recently uploaded

PDF
Orlando by Virginia Woolf: The Granite and The Rainbow
byAdityarajsinh Gohil
 
PPTX
MEMORY &FORGETTING. Shilpa Hotakar.Psychology pptx
bySHILPA HOTAKAR
 
PDF
java full stack programming and interview questions
byrajuashokit
 
PDF
PHARMACOLOGY 1 ( BP 404 T) Unit 1 (Cology 1)
byChetan Mali
 
PPTX
Greengnorance Toolkit Module 3 Shopping and Food
byKarl Donert
 
PPTX
Renal Physiology- Functional anatomy of Kidney.pptx
byDisha Soriya
 
PPTX
PRE TERM LABOR ( PREMATURE LABOUR IN PREGNANCY)
byMuthu Kumar
 
PPTX
Math 8 Quarter 4 Week 3 PRIMARY DATA.pptx
byshahanieabbat3
 
PDF
Pharmaceutical Quality Assurance Unit 1 (BP606T)
byChetan Mali
 
PPTX
Greengnorance Toolkit Module 2 Energy saving
byKarl Donert
 
PDF
The Sheep and the Goat: Beckett’s Subversion of Divine Justice in Waiting for...
bysejadchokiya
 
PPTX
Greengnorance Toolkit Module1 Climate Change
byKarl Donert
 
PPTX
How to perform product search based on a custom field from the Website Shop p...
byCeline George
 
PDF
Chapter 05 Drugs Acting on the Central Nervous System: Anti-Depressant Drugs
bySandeshSul
 
PDF
Beyond the Absurd: A Comparative Reading of Waiting for Godot and the Bhagava...
byKruti Vyas
 
PPTX
Greengnorance Toolkit Module 6 Water Resources
byKarl Donert
 
PPTX
Plant fibres used as surgical dressings & Sutures – Surgical Catgut and Ligat...
bySai Meer College of Pharmacy
 
PDF
Artificial Intelligence in Research and Academic Writing, Workshop on Researc...
byProf. Vinod Kumar Kanvaria
 
PDF
How "Raiders of the Lost Ark" and "Ordinary People" Employ Non-Verbal Acting
by6x5csns4pn
 
PPTX
Math 8 Quarter 4 Week 4-SECONDARY DATA.pptx
byshahanieabbat3
 
Orlando by Virginia Woolf: The Granite and The Rainbow
byAdityarajsinh Gohil
 
MEMORY &FORGETTING. Shilpa Hotakar.Psychology pptx
bySHILPA HOTAKAR
 
java full stack programming and interview questions
byrajuashokit
 
PHARMACOLOGY 1 ( BP 404 T) Unit 1 (Cology 1)
byChetan Mali
 
Greengnorance Toolkit Module 3 Shopping and Food
byKarl Donert
 
Renal Physiology- Functional anatomy of Kidney.pptx
byDisha Soriya
 
PRE TERM LABOR ( PREMATURE LABOUR IN PREGNANCY)
byMuthu Kumar
 
Math 8 Quarter 4 Week 3 PRIMARY DATA.pptx
byshahanieabbat3
 
Pharmaceutical Quality Assurance Unit 1 (BP606T)
byChetan Mali
 
Greengnorance Toolkit Module 2 Energy saving
byKarl Donert
 
The Sheep and the Goat: Beckett’s Subversion of Divine Justice in Waiting for...
bysejadchokiya
 
Greengnorance Toolkit Module1 Climate Change
byKarl Donert
 
How to perform product search based on a custom field from the Website Shop p...
byCeline George
 
Chapter 05 Drugs Acting on the Central Nervous System: Anti-Depressant Drugs
bySandeshSul
 
Beyond the Absurd: A Comparative Reading of Waiting for Godot and the Bhagava...
byKruti Vyas
 
Greengnorance Toolkit Module 6 Water Resources
byKarl Donert
 
Plant fibres used as surgical dressings & Sutures – Surgical Catgut and Ligat...
bySai Meer College of Pharmacy
 
Artificial Intelligence in Research and Academic Writing, Workshop on Researc...
byProf. Vinod Kumar Kanvaria
 
How "Raiders of the Lost Ark" and "Ordinary People" Employ Non-Verbal Acting
by6x5csns4pn
 
Math 8 Quarter 4 Week 4-SECONDARY DATA.pptx
byshahanieabbat3
 

Chapter 8 overview

  • 1.
    1© 2009 CiscoLearning Institute. CCNA Security Chapter Eight Implementing Virtual Private Networks
  • 2.
    222© 2009 CiscoLearning Institute. Lesson Planning • This lesson should take 3-4 hours to present • The lesson should include lecture, demonstrations, discussions and assessments • The lesson can be taught in person or using remote instruction
  • 3.
    333© 2009 CiscoLearning Institute. Major Concepts • Describe the purpose and operation of VPN types • Describe the purpose and operation of GRE VPNs • Describe the components and operations of IPsec VPNs • Configure and verify a site-to-site IPsec VPN with pre- shared key authentication using CLI • Configure and verify a site-to-site IPsec VPN with pre- shared key authentication using SDM • Configure and verify a Remote Access VPN
  • 4.
    444© 2009 CiscoLearning Institute. Lesson Objectives Upon completion of this lesson, the successful participant will be able to: 1. Describe the purpose and operation of VPNs 2. Differentiate between the various types of VPNs 3. Identify the Cisco VPN product line and the security features of these products 4. Configure a site-to-site VPN GRE tunnel 5. Describe the IPSec protocol and its basic functions 6. Differentiate between AH and ESP 7. Describe the IKE protocol and modes 8. Describe the five steps of IPSec operation
  • 5.
    555© 2009 CiscoLearning Institute. Lesson Objectives 9. Describe how to prepare IPSec by ensuring that ACLs are compatible with IPSec 10. Configure IKE policies using the CLI 11. Configure the IPSec transform sets using the CLI 12. Configure the crypto ACLs using the CLI 13. Configure and apply a crypto map using the CLI 14. Describe how to verify and troubleshoot the IPSec configuration 15. Describe how to configure IPSec using SDM 16. Configure a site-to-site VPN using the Quick Setup VPN Wizard in SDM 17. Configure a site-to-site VPN using the step-by-step VPN Wizard in SDM
  • 6.
    666© 2009 CiscoLearning Institute. Lesson Objectives 18. Verify, monitor and troubleshoot VPNs using SDM 19. Describe how an increasing number of organizations are offering telecommuting options to their employees 20. Differentiate between Remote Access IPSec VPN solutions and SSL VPNs 21. Describe how SSL is used to establish a secure VPN connection 22. Describe the Cisco Easy VPN feature 23. Configure a VPN Server using SDM 24. Connect a VPN client using the Cisco VPN Client software
  • 7.
    777© 2009 CiscoLearning Institute. What is a VPN? - Virtual: Information within a private network is transported over a public network. - Private: The traffic is encrypted to keep the data confidential. VPN VPN Firewall CSA Regional branch with a VPN enabled Cisco ISR router SOHO with a Cisco DSL Router VPN Mobile Worker with a Cisco VPN Client Business Partner with a Cisco Router Corporate NetworkWAN Internet
  • 8.
    888© 2009 CiscoLearning Institute. Layer 3 VPN • Generic routing encapsulation (GRE) • Multiprotocol Label Switching (MPLS) • IPSec SOHO with a Cisco DSL Router VPN Internet IPSec IPSec
  • 9.
    999© 2009 CiscoLearning Institute. Types of VPN Networks MARS VPN VPN Iron Port Firewall IP S Web Server Email Server DNS CSA CSACSACSA CSA CSA CSA Regional branch with a VPN enabled Cisco ISR router SOHO with a Cisco DSL Router VPN Mobile Worker with a Cisco VPN Client Business Partner with a Cisco Router Site-to-Site VPNs Remote-access VPNs Internet WAN
  • 10.
    101010© 2009 CiscoLearning Institute. Site-to-Site VPN MARS VPN VPN Iron Port Firewall IP S Web Server Email Server DNS CS A CS A CS A CSA CSA CSA CSA Regional branch with a VPN enabled Cisco ISR router SOHO with a Cisco DSL Router VP N Business Partner with a Cisco Router Site-to-Site VPNs Internet WAN Hosts send and receive normal TCP/IP traffic through a VPN gateway
  • 11.
    111111© 2009 CiscoLearning Institute. Remote-Access VPNs MARS VPN Iron Port Firewall IPS Web Server Email Server DNS CSA CSA CSACSA CSA CSA CSA Mobile Worker with a Cisco VPN Client Remote-access VPNs Internet
  • 12.
    121212© 2009 CiscoLearning Institute. VPN Client Software R1 R1-vpn-cluster.span.com “R1” In a remote-access VPN, each host typically has Cisco VPN Client software
  • 13.
    131313© 2009 CiscoLearning Institute. Cisco IOS SSL VPN • Provides remote-access connectivity from any Internet-enabled host • Uses a web browser and SSL encryption • Delivers two modes of access: - Clientless - Thin client
  • 14.
    141414© 2009 CiscoLearning Institute. Cisco VPN Product Family Product Choice Remote-Access VPN Site-to-Site VPN Cisco VPN-Enabled Router Secondary role Primary role Cisco PIX 500 Series Security Appliances Secondary role Primary role Cisco ASA 5500 Series Adaptive Security Appliances Primary role Secondary role Cisco VPN 3000 Series Concentrators Primary role Secondary role Home Routers Primary role
  • 15.
    151515© 2009 CiscoLearning Institute. Cisco VPN-Optimized Routers Remote Office Cisco Router Regional Office Cisco Router SOHO Cisco Router Main Office Cisco Router Internet VPN Features: •Voice and video enabled VPN (V3PN) •IPSec stateful failover •DMVPN •IPSec and Multiprotocol Label Switching (MPLS) integration •Cisco Easy VPN
  • 16.
    161616© 2009 CiscoLearning Institute. Cisco ASA 5500 Series Adaptive Security Appliances • Flexible platform • Resilient clustering • Cisco Easy VPN • Automatic Cisco VPN • Cisco IOS SSL VPN • VPN infrastructure for contemporary applications • Integrated web-based management Extranet Business-to-Business Intranet Remote User Remote Site Central Site Internet
  • 17.
    171717© 2009 CiscoLearning Institute. IPSec Clients Small Office Internet Cisco AnyConnect VPN Client Certicom PDA IPsec VPN Client Internet Cisco VPN Software Client Router with Firewall and VPN Client A wireless client that is loaded on a pda Software loaded on a PC A network appliance that connects SOHO LANs to the VPN Provides remote users with secure VPN connections
  • 18.
    181818© 2009 CiscoLearning Institute. Hardware Acceleration Modules • AIM • Cisco IPSec VPN Shared Port Adapter (SPA) • Cisco PIX VPN Accelerator Card+ (VAC+) • Enhanced Scalable Encryption Processing (SEP-E) Cisco IPsec VPN SPA
  • 19.
    191919© 2009 CiscoLearning Institute. GRE VPN Overview
  • 20.
    202020© 2009 CiscoLearning Institute. Encapsulation Original IP Packet Encapsulated with GRE
  • 21.
    212121© 2009 CiscoLearning Institute. Configuring a GRE Tunnel R1(config)# interface tunnel 0 R1(config–if)# ip address 10.1.1.1 255.255.255.252 R1(config–if)# tunnel source serial 0/0 R1(config–if)# tunnel destination 192.168.5.5 R1(config–if)# tunnel mode gre ip R1(config–if)# R2(config)# interface tunnel 0 R2(config–if)# ip address 10.1.1.2 255.255.255.252 R2(config–if)# tunnel source serial 0/0 R2(config–if)# tunnel destination 192.168.3.3 R2(config–if)# tunnel mode gre ip R2(config–if)# Create a tunnel interface Assign the tunnel an IP address Identify the source tunnel interface Identify the destination of the tunnel Configure what protocol GRE will encapsulate
  • 22.
    222222© 2009 CiscoLearning Institute. Using GRE User Traffic IP Only ? Use GRE Tunnel NoNo YesYes NoNo YesYes Unicast Only? Use IPsec VPN GRE does not provide encryption
  • 23.
    232323© 2009 CiscoLearning Institute. IPSec Topology • Works at the network layer, protecting and authenticating IP packets. - It is a framework of open standards which is algorithm-independent. - It provides data confidentiality, data integrity, and origin authentication. Business Partner with a Cisco Router Regional Office with a Cisco PIX Firewall SOHO with a Cisco SDN/DSL Router Mobile Worker with a Cisco VPN Client on a Laptop Computer ASA Legacy Concentrator Main Site Perimeter Router Legacy Cisco PIX Firewall IPsec POP Corporate
  • 24.
    242424© 2009 CiscoLearning Institute. IPSec Framework Diffie-Hellman DH7
  • 25.
    252525© 2009 CiscoLearning Institute. DH7Diffie-Hellman Confidentiality Key length: - 56-bits Key length: - 56-bits (3 times) Key length: - 160-bits Key lengths: -128-bits -192 bits -256-bits Least secure Most secure
  • 26.
    262626© 2009 CiscoLearning Institute. DH7Diffie-Hellman Integrity Key length: - 128-bits Key length: - 160-bits) Least secure Most secure
  • 27.
    272727© 2009 CiscoLearning Institute. DH7Diffie-Hellman Authentication
  • 28.
    282828© 2009 CiscoLearning Institute. DH7Diffie-Hellman Pre-shared Key (PSK) •At the local device, the authentication key and the identity information (device-specific information) are sent through a hash algorithm to form hash_I. One-way authentication is established by sending hash_I to the remote device. If the remote device can independently create the same hash, the local device is authenticated. • The authentication process continues in the opposite direction. The remote device combines its identity information with the preshared-based authentication key and sends it through the hash algorithm to form hash_R. hash_R is sent to the local device. If the local device can independently create the same hash, the remote device is authenticated.
  • 29.
    292929© 2009 CiscoLearning Institute. RSA Signatures • At the local device, the authentication key and identity information (device-specific information) are sent through the hash algorithm forming hash_I. hash_I is encrypted using the local device's private encryption key creating a digital signature. The digital signature and a digital certificate are forwarded to the remote device. The public encryption key for decrypting the signature is included in the digital certificate. The remote device verifies the digital signature by decrypting it using the public encryption key. The result is hash_I. • Next, the remote device independently creates hash_I from stored information. If the calculated hash_I equals the decrypted hash_I, the local device is authenticated. After the remote device authenticates the local device, the authentication process begins in the opposite direction and all steps are repeated from the remote device to the local device.
  • 30.
    303030© 2009 CiscoLearning Institute. Diffie-Hellman Secure Key Exchange DH7
  • 31.
    313131© 2009 CiscoLearning Institute. IPSec Framework Protocols All data is in plaintext. R1 R2 Data payload is encrypted. R1 R2 Authentication Header Encapsulating Security Payload AH provides the following:  Authentication  Integrity ESP provides the following:  Encryption  Authentication  Integrity
  • 32.
    323232© 2009 CiscoLearning Institute. Authentication Header Authentication Data (00ABCDEF) IP Header + Data + Key R1 R2 Hash Recomputed Hash (00ABCDEF) IP Header + Data + Key Hash Received Hash (00ABCDEF)= DataAHIP HDR DataAHIP HDR Internet 1. The IP Header and data payload are hashed 2. The hash builds a new AH header which is prepended to the original packet 3. The new packet is transmitted to the IPSec peer router 4. The peer router hashes the IP header and data payload, extracts the transmitted hash and compares
  • 33.
    333333© 2009 CiscoLearning Institute. ESP Diffie-Hellman DH7
  • 34.
    343434© 2009 CiscoLearning Institute. Function of ESP ESP Trailer ESP Auth • Provides confidentiality with encryption • Provides integrity with authentication Router Router IP HDR Data ESP HDRNew IP HDR IP HDR Data Authenticated IP HDR Data Internet Encrypted
  • 35.
    353535© 2009 CiscoLearning Institute. IP HDR ESP HDR Data ESP HDR IP HDRNew IP HDR Data Tunnel Mode Transport Mode ESP Trailer ESP Auth ESP Trailer ESP Auth Authenticated Authenticated IP HDR Data Encrypted Encrypted Original data prior to selection of IPSec protocol mode Mode Types
  • 36.
    363636© 2009 CiscoLearning Institute. Security Associations IPSec parameters are configured using IKE
  • 37.
    373737© 2009 CiscoLearning Institute. Host A Host B R1 R2 10.0.1.3 10.0.2.3 IKE Phase 1 Exchange 1. Negotiate IKE policy sets 2. DH key exchange 3. Verify the peer identity IKE Phases IKE Phase 2 Exchange Negotiate IPsec policy Negotiate IPsec policy Policy 15 DES MD5 pre-share DH1 lifetime Policy 10 DES MD5 pre-share DH1 lifetime 1. Negotiate IKE policy sets 2. DH key exchange 3. Verify the peer identity
  • 38.
    383838© 2009 CiscoLearning Institute. Negotiates matching IKE policies to protect IKE exchange Policy 15 DES MD5 pre-share DH1 lifetime Policy 10 DES MD5 pre-share DH1 lifetime IKE Policy Sets Policy 20 3DES SHA pre-share DH1 lifetime Negotiate IKE Proposals Host A Host B R1 R2 10.0.1.3 10.0.2.3 IKE Phase 1 – First Exchange
  • 39.
    393939© 2009 CiscoLearning Institute. IKE Phase 1 – Second Exchange ((YB ) mod p = K (YA ) mod p = K XB XA Private value, XA Public value, YA Private value, XB Public value, YBAlice Bob YYAA YYBB YB = g mod pXBYYAA = g mod pXA A DH exchange is performed to establish keying material. Establish DH Key
  • 40.
    404040© 2009 CiscoLearning Institute. IKE Phase 1 – Third Exchange Peer authentication methods • PSKs • RSA signatures • RSA encrypted nonces HR Servers Remote Office Corporate Office Internet Peer Authentication A bidirectional IKE SA is now established. Authenticate Peer
  • 41.
    414141© 2009 CiscoLearning Institute. Host A Host B R1 R2 10.0.1.3 10.0.2.3 IKE Phase 1 Aggressive Mode Exchange 1.Send IKE policy set and R1’s DH key 3.Calculate shared secret, verify peer identify, and confirm with peer IKE Phase 2 Exchange Negotiate IPsec policy Negotiate IPsec policy Policy 15 DES MD5 pre-share DH1 lifetime Policy 10 DES MD5 pre-share DH1 lifetime 2. Confirm IKE policy set, calculate shared secret and send R2’s DH key 4. Authenticate peer and begin Phase 2. IKE Phase 1 – Aggressive Mode
  • 42.
    424242© 2009 CiscoLearning Institute. Negotiate IPsec Security Parameters Host A Host B R1 R2 10.0.1.3 10.0.2.3 IKE Phase 2 • IKE negotiates matching IPsec policies. • Upon completion, unidirectional IPsec Security Associations(SA) are established for each protocol and algorithm combination.
  • 43.
    434343© 2009 CiscoLearning Institute. IKE Phase 1 IKE Phase 2 IKE SA IKE SA IPsec SAIPsec SA 1. Host A sends interesting traffic to Host B. 2. R1 and R2 negotiate an IKE Phase 1 session. 3. R1 and R2 negotiate an IKE Phase 2 session. 4. Information is exchanged via IPsec tunnel. 5. The IPsec tunnel is terminated. R1 R2 10.0.2.3 IPsec Tunnel 10.0.1.3 IPSec VPN Negotiation
  • 44.
    444444© 2009 CiscoLearning Institute. Configuring IPsec Task 1: Ensure that ACLs are compatible with IPsec. Task 2: Create ISAKMP (IKE) policy. Task 3: Configure IPsec transform set. Task 4: Create a crypto ACL. Task 5: Create and apply the crypto map. Tasks to Configure IPsec:
  • 45.
    454545© 2009 CiscoLearning Institute. Task 1 Configure Compatible ACLs • Ensure that protocols 50 (ESP), 51 (AH) and UDP port 500 (ISAKMP) traffic are not blocked by incoming ACLs on interfaces used by IPsec. AH ESP IKE Site 1 Site 2 10.0.1.3 10.0.2.3 R1 R2 Internet S0/0/0 172.30.1.2 S0/0/0 172.30.2.2 10.0.1.0/24 10.0.2.0/24
  • 46.
    464646© 2009 CiscoLearning Institute. R1(config)# access-list 102 permit ahp host 172.30.2.2 host 172.30.1.2 R1(config)# access-list 102 permit esp host 172.30.2.2 host 172.30.1.2 R1(config)# access-list 102 permit udp host 172.30.2.2 host 172.30.1.2 eq isakmp R1(config)# R1(config)# interface Serial0/0/0 R1(config-if)# ip address 172.30.1.2 255.255.255.0 R1(config-if)# ip access-group 102 in ! R1(config)# exit R1# R1# show access-lists access-list 102 permit ahp host 172.30.2.2 host 172.30.1.2 access-list 102 permit esp host 172.30.2.2 host 172.30.1.2 access-list 102 permit udp host 172.30.2.2 host 172.30.1.2 eq isakmp R1# AH ESP IKESite 1 Site 2 10.0.1.3 10.0.2.3R1 R2 Internet S0/0/0 172.30.1.2 S0/0/0 172.30.2.2 10.0.1.0/2 4 10.0.2.0/24 Permitting Traffic
  • 47.
    474747© 2009 CiscoLearning Institute. Defines the parameters within the IKE policy crypto isakmp policy priority router(config)# R1(config)# crypto isakmp policy 110 R1(config–isakmp)# authentication pre-share R1(config–isakmp)# encryption des R1(config–isakmp)# group 1 R1(config–isakmp)# hash md5 R1(config–isakmp)# lifetime 86400 Tunnel Policy 110 DES MD5 Preshare 86400 DH1 Site 1 Site 2 10.0.1.3 10.0.2.3R1 R2 Internet 10.0.1.0/24 10.0.2.0/24 Task 2 Configure IKE
  • 48.
    484848© 2009 CiscoLearning Institute. ISAKMP Parameters Parameter Keyword Accepted Values Default Value Description encryption des 3des aes aes 192 aes 256 56-bit Data Encryption Standard Triple DES 128-bit AES 192-bit AES 256-bit AES des Message encryption algorithm hash sha md5 SHA-1 (HMAC variant) MD5 (HMAC variant) sha Message integrity (Hash) algorithm authenticati on pre-share rsa-encr rsa-sig preshared keys RSA encrypted nonces RSA signatures rsa-sig Peer authentication method group 1 2 5 768-bit Diffie-Hellman (DH) 1024-bit DH 1536-bit DH 1 Key exchange parameters (DH group identifier) lifetime seconds Can specify any number of seconds 86,400 sec (one day) ISAKMP-established SA lifetime
  • 49.
    494949© 2009 CiscoLearning Institute. Multiple Policies crypto isakmp policy 100 hash md5 authentication pre-share ! crypto isakmp policy 200 hash sha authentication rsa-sig ! crypto isakmp policy 300 hash md5 authentication rsa-sig crypto isakmp policy 100 hash md5 authentication pre-share ! crypto isakmp policy 200 hash sha authentication rsa-sig ! crypto isakmp policy 300 hash md5 authentication pre-share R1(config)# R2(config)# Site 1 Site 2 10.0.1.3 10.0.2.3R1 R2 Internet 10.0.1.0/24 10.0.2.0/24
  • 50.
    505050© 2009 CiscoLearning Institute. R1(config)# crypto isakmp policy 110 R1(config–isakmp)# authentication pre-share R1(config–isakmp)# encryption 3des R1(config–isakmp)# group 2 R1(config–isakmp)# hash sha R1(config–isakmp)# lifetime 43200 Policy 110 Preshare 3DES SHA DH2 43200 R2(config)# crypto isakmp policy 100 R2(config–isakmp)# authentication pre-share R2(config–isakmp)# encryption 3des R2(config–isakmp)# group 2 R2(config–isakmp)# hash sha R2(config–isakmp)# lifetime 43200 R2 must have an ISAKMP policy configured with the same parameters. Tunnel Site 1 Site 2 10.0.1.3 10.0.2.3R1 R2 Internet 10.0.1.0/24 10.0.2.0/24 R1 attempts to establish a VPN tunnel with R2 and sends its IKE policy parameters Policy Negotiations
  • 51.
    515151© 2009 CiscoLearning Institute. Crypto ISAKMP Key • The peer-address or peer-hostname can be used, but must be used consistently between peers. • If the peer-hostname is used, then the crypto isakmp identity hostname command must also be configured. crypto isakmp key keystring address peer-address router(config)# crypto isakmp key keystring hostname hostname router(config)# Parameter Description keystring This parameter specifies the PSK. Use any combination of alphanumeric characters up to 128 bytes. This PSK must be identical on both peers. peer- address This parameter specifies the IP address of the remote peer. hostname This parameter specifies the hostname of the remote peer. This is the peer hostname concatenated with its domain name (for example, myhost.domain.com).
  • 52.
    525252© 2009 CiscoLearning Institute. R1(config)# crypto isakmp policy 110 R1(config–isakmp)# authentication pre-share R1(config–isakmp)# encryption 3des R1(config–isakmp)# group 2 R1(config–isakmp)# hash sha R1(config–isakmp)# lifetime 43200 R1(config-isakmp)# exit R1(config)# crypto isakmp key cisco123 address 172.30.2.2 R1(config)# R2(config)# crypto isakmp policy 110 R2(config–isakmp)# authentication pre-share R2(config–isakmp)# encryption 3des R2(config–isakmp)# group 2 R2(config–isakmp)# hash sha R2(config–isakmp)# lifetime 43200 R2(config-isakmp)# exit R2(config)# crypto isakmp key cisco123 address 172.30.1.2 R2(config)# Note: • The keystring cisco1234 matches. • The address identity method is specified. • The ISAKMP policies are compatible. • Default values do not have to be configured. Site 1 Site 2 10.0.1.3 10.0.2.3R1 R2 Internet 10.0.1.0/24 10.0.2.0/24 Sample Configuration
  • 53.
    535353© 2009 CiscoLearning Institute. router(config)# crypto ipsec transform–set transform-set-name transform1 [transform2] [transform3]] crypto ipsec transform-set Parameters Command Description transform-set-name This parameter specifies the name of the transform set to create (or modify). transform1, transform2, transform3 Type of transform set. You may specify up to four "transforms": one Authentication Header (AH), one Encapsulating Security Payload (ESP) encryption, one ESP authentication. These transforms define the IP Security (IPSec) security protocols and algorithms. A transform set is a combination of IPsec transforms that enact a security policy for traffic. Task 3 Configure the Transform Set
  • 54.
    545454© 2009 CiscoLearning Institute. Transform Sets • Transform sets are negotiated during IKE Phase 2. • The 9th attempt found matching transform sets (CHARLIE - YELLOW). Host B 10.0.1.3 10.0.2.3 R1 R2Host A transform-set ALPHA esp-3des tunnel transform-set BETA esp-des, esp-md5-hmac tunnel transform-set CHARLIE esp-3des, esp-sha-hmac tunnel transform-set RED esp-des tunnel transform-set BLUE esp-des, ah-sha-hmac tunnel transform-set YELLOW esp-3des, esp-sha-hmac tunnel Match Internet 1 2 3 4 5 6 7 8 9 172.30.2.2 172.30.1.2
  • 55.
    555555© 2009 CiscoLearning Institute. Site 1 Site 2 A B 10.0.1.3 10.0.2.3 R1 R2 Internet R1(config)# crypto isakmp key cisco123 address 172.30.2.2 R1(config)# crypto ipsec transform-set MYSET esp-aes 128 R1(cfg-crypto-trans)# exit R1(config)# R2(config)# crypto isakmp key cisco123 address 172.30.1.2 R2(config)#crypto ipsec transform-set OTHERSET esp-aes 128 R2(cfg-crypto-trans)# exit 172.30.2.2 172.30.1.2 Note: • Peers must share the same transform set settings. • Names are only locally significant. Sample Configuration
  • 56.
    565656© 2009 CiscoLearning Institute. Task 4 Configure the Crypto ACLs • Outbound indicates the data flow to be protected by IPsec. • Inbound filters and discards traffic that should have been protected by IPsec. Host A R1 Internet Outbound Traffic Inbound Traffic Encrypt Bypass (Plaintext) Permit Bypass Discard (Plaintext)
  • 57.
    575757© 2009 CiscoLearning Institute. 10.0.1.3 10.0.2.3 R1 R2 Internet router(config)# access-list access-list-number [dynamic dynamic-name [timeout minutes]]{deny | permit} protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos] [log] access-list access-list-number Parameters access-list access-list-number Command Description permit This option causes all IP traffic that matches the specified conditions to be protected by cryptography, using the policy described by the corresponding crypto map entry. deny This option instructs the router to route traffic in plaintext. protocol This option specifies which traffic to protect by cryptography based on the protocol, such as TCP, UDP, or ICMP. If the protocol is IP, then all traffic IP traffic that matches that permit statement is encrypted. source and destination If the ACL statement is a permit statement, these are the networks, subnets, or hosts between which traffic should be protected. If the ACL statement is a deny statement, then the traffic between the specified source and destination is sent in plaintext. 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.1.2 S0/0/0 172.30.2.2 Command Syntax
  • 58.
    585858© 2009 CiscoLearning Institute. S0/1 10.0.1.3 10.0.2.3R1 R2 Internet Site 2 Applied to R1 S0/0/0 outbound traffic: R1(config)# access-list 110 permit tcp 10.0.1.0 0.0.0.255 10.0.2.0 0.0.0.255 (when evaluating inbound traffic– source: 10.0.2.0, destination: 10.0.1.0) S0/0/0 172.30.2.2 S0/0/0 172.30.1.2 Applied to R2 S0/0/0 outbound traffic: R2(config)# access-list 101 permit tcp 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255 (when evaluating inbound traffic- source: 10.0.1.0, destination: 10.0.2.0) 10.0.1.0/24 Site 1 10.0.2.0/24 Symmetric Crypto ACLs
  • 59.
    595959© 2009 CiscoLearning Institute. Task 5 Apply the Crypto Map Crypto maps define the following:  ACL to be used  Remote VPN peers  Transform set to be used  Key management method  SA lifetimes Site 1 10.0.1.3 R1 R2 10.0.2.3 Site 2 Internet Encrypted Traffic Router Interface or Subinterface
  • 60.
    606060© 2009 CiscoLearning Institute. crypto map map-name seq-num ipsec-manual crypto map map-name seq-num ipsec-isakmp [dynamic dynamic-map-name] router(config)# crypto map Parameters Command Parameters Description map-name Defines the name assigned to the crypto map set or indicates the name of the crypto map to edit. seq-num The number assigned to the crypto map entry. ipsec-manual Indicates that ISAKMP will not be used to establish the IPsec SAs. ipsec-isakmp Indicates that ISAKMP will be used to establish the IPsec SAs. cisco (Default value) Indicates that CET will be used instead of IPsec for protecting the traffic. dynamic (Optional) Specifies that this crypto map entry references a preexisting static crypto map. If this keyword is used, none of the crypto map configuration commands are available. dynamic-map-name (Optional) Specifies the name of the dynamic crypto map set that should be used as the policy template. Crypto Map Command
  • 61.
    616161© 2009 CiscoLearning Institute. Crypto Map Configuration Mode Commands Command Description set Used with the peer, pfs, transform-set, and security-association commands. peer [hostname | ip- address] Specifies the allowed IPsec peer by IP address or hostname. pfs [group1 | group2] Specifies DH Group 1 or Group 2. transform-set [set_name(s)] Specify list of transform sets in priority order. When the ipsec-manual parameter is used with the crypto map command, then only one transform set can be defined. When the ipsec-isakmp parameter or the dynamic parameter is used with the crypto map command, up to six transform sets can be specified. security-association lifetime Sets SA lifetime parameters in seconds or kilobytes. match address [access- list-id | name] Identifies the extended ACL by its name or number. The value should match the access-list-number or name argument of a previously defined IP-extended ACL being matched. no Used to delete commands entered with the set command. exit Exits crypto map configuration mode.
  • 62.
    626262© 2009 CiscoLearning Institute. Multiple peers can be specified for redundancy. R3 S0/0/0 172.30.3.2 R1(config)# crypto map MYMAP 10 ipsec-isakmp R1(config-crypto-map)# match address 110 R1(config-crypto-map)# set peer 172.30.2.2 default R1(config-crypto-map)# set peer 172.30.3.2 R1(config-crypto-map)# set pfs group1 R1(config-crypto-map)# set transform-set mine R1(config-crypto-map)# set security-association lifetime seconds 86400 10.0.1.3 10.0.2.3 R1 R2 Internet Sample Configuration 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.2.2
  • 63.
    636363© 2009 CiscoLearning Institute. • Applies the crypto map to outgoing interface • Activates the IPsec policy crypto map map-name R1(config)# interface serial0/0/0 R1(config-if)# crypto map MYMAP router(config-if)# MYMAP Assign the Crypto Map Set 10.0.1.3 10.0.2.3 R1 R2 Internet 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.1.2 S0/0/0 172.30.2.2
  • 64.
    646464© 2009 CiscoLearning Institute. CLI Commands Show Command Description show crypto map Displays configured crypto maps show crypto isakmp policy Displays configured IKE policies show crypto ipsec sa Displays established IPsec tunnels show crypto ipsec transform-set Displays configured IPsec transform sets debug crypto isakmp Debugs IKE events debug crypto ipsec Debugs IPsec events
  • 65.
    656565© 2009 CiscoLearning Institute. R1# show crypto map Crypto Map “MYMAP" 10 ipsec-isakmp Peer = 172.30.2.2 Extended IP access list 110 access-list 102 permit ip host 10.0.1.3 host 10.0.2.3 Current peer: 172.30.2.2 Security association lifetime: 4608000 kilobytes/3600 seconds PFS (Y/N): N Transform sets={ MYSET, } show crypto map Displays the currently configured crypto maps router# show crypto map 10.0.1.3 10.0.2.3 R1 R2 Internet 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.1.2 S0/0/0 172.30.2.2
  • 66.
    666666© 2009 CiscoLearning Institute. show crypto isakmp policy R1# show crypto isakmp policy Protection suite of priority 110 encryption algorithm: 3DES - Data Encryption Standard (168 bit keys). hash algorithm: Secure Hash Standard authentication method: preshared Diffie-Hellman group: #2 (1024 bit) lifetime: 86400 seconds, no volume limit Default protection suite encryption algorithm: DES - Data Encryption Standard (56 bit keys). hash algorithm: Secure Hash Standard authentication method: Rivest-Shamir-Adleman Signature Diffie-Hellman group: #1 (768 bit) lifetime: 86400 seconds, no volume limit router# show crypto isakmp policy 10.0.1.3 10.0.2.3 R1 R2 Internet 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.1.2 S0/0/0 172.30.2.2
  • 67.
    676767© 2009 CiscoLearning Institute. show crypto ipsec transform-set Displays the currently defined transform sets R1# show crypto ipsec transform-set Transform set AES_SHA: { esp-128-aes esp-sha-hmac } will negotiate = { Tunnel, }, show crypto ipsec transform-set 10.0.1.3 10.0.2.3 R1 R2 Internet 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.1.2 S0/0/0 172.30.2.2
  • 68.
    686868© 2009 CiscoLearning Institute. show crypto ipsec sa R1# show crypto ipsec sa Interface: Serial0/0/0 Crypto map tag: MYMAP, local addr. 172.30.1.2 local ident (addr/mask/prot/port): (172.30.1.2/255.255.255.255/0/0) remote ident (addr/mask/prot/port): (172.30.2.2/255.255.255.255/0/0) current_peer: 172.30.2.2 PERMIT, flacs={origin_is_acl,} #pkts encaps: 21, #pkts encrypt: 21, #pkts digest 0 #pkts decaps: 21, #pkts decrypt: 21, #pkts verify 0 #send errors 0, #recv errors 0 local crypto endpt.: 172.30.1.2, remote crypto endpt.: 172.30.2.2 path mtu 1500, media mtu 1500 current outbound spi: 8AE1C9C 10.0.1.3 10.0.2.3 R1 R2 Internet 10.0.1.0/24 Site 1 10.0.2.0/24 Site 2 S0/0/0 172.30.1.2 S0/0/0 172.30.2.2
  • 69.
    696969© 2009 CiscoLearning Institute. debug crypto isakmp router# debug crypto isakmp • This is an example of the Main Mode error message. • The failure of Main Mode suggests that the Phase I policy does not match on both sides. • Verify that the Phase I policy is on both peers and ensure that all the attributes match. 1d00h: ISAKMP (0:1): atts are not acceptable. Next payload is 0 1d00h: ISAKMP (0:1); no offers accepted! 1d00h: ISAKMP (0:1): SA not acceptable! 1d00h: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Main Mode failed with peer at 172.30.2.2
  • 70.
    707070© 2009 CiscoLearning Institute. Starting a VPN Wizard Wizards for IPsec Solutions, includes type of VPNs and Individual IPsec components 1 2 4 5 3 VPN implementation Subtypes. Vary based On VPN wizard chosen. 1. Click Configure in main toolbar 2. Click the VPN button to open the VPN page 3. Choose a wizard 4. Click the VPN implementation subtype 5. Click the Launch the Selected Task button
  • 71.
    717171© 2009 CiscoLearning Institute. VPN Components Individual IPsec components used to build VPNs VPN Wizards SSL VPN parameters Easy VPN server parameters Public key certificate parameters Encrypt VPN passwords VPN Components
  • 72.
    727272© 2009 CiscoLearning Institute. Configuring a Site-to-Site VPN Click the Launch the Selected Task button Choose Configure > VPN > Site-to-Site VPN Click the Create a Site-to-Site VPN
  • 73.
    737373© 2009 CiscoLearning Institute. Site-to-Site VPN Wizard Choose the wizard mode Click Next to proceed to the configuration of parameters.
  • 74.
    747474© 2009 CiscoLearning Institute. Quick Setup Configure the parameters •Interface to use •Peer identity information •Authentication method •Traffic to encrypt
  • 75.
    757575© 2009 CiscoLearning Institute. Verify Parameters
  • 76.
    767676© 2009 CiscoLearning Institute. 1 2 3 4 Step-by-Step Wizard Choose the outside interface that is used to connect to the IPSec peer Specify the IP address of the peer Choose the authentication method and specify the credentials Click Next
  • 77.
    777777© 2009 CiscoLearning Institute. Creating a Custom IKE Proposal 1 2 3Click Add to define a proposal Make the selections to configure the IKE Policy and click OK Click Next
  • 78.
    787878© 2009 CiscoLearning Institute. 1 2 3 Creating a Custom IPSec Transform Set Click NextClick Add Define and specify the transform set name, integrity algorithm, encryption algorithm, mode of operation and optional compression
  • 79.
    797979© 2009 CiscoLearning Institute. 1 2 3 Protecting Traffic Subnet to Subnet Click Protect All Traffic Between the Following subnets Define the IP address and subnet mask of the local network Define the IP address and subnet mask of the remote network
  • 80.
    808080© 2009 CiscoLearning Institute. 2 3 1 Protecting Traffic Custom ACL Click the Create/Select an Access-List for IPSec Traffic radio button Click the ellipses button to choose an existing ACL or create a new one To use an existing ACL, choose the Select an Existing Rule (ACL) option. To create a new ACL, choose the Create a New Rule (ACL) and Select option
  • 81.
    818181© 2009 CiscoLearning Institute. Add a Rule 1 2Give the access rule a name and description Click Add
  • 82.
    828282© 2009 CiscoLearning Institute. Configuring a New Rule Entry 1 2 3 Choose an action and enter a description of the rule entry Define the source hosts or networks in the Source Host/Network pane and the destination hosts or network in the Destination/Host Network pane (Optional) To provide protection for specific protocols, choose the specific protocol radio box and desired port numbers
  • 83.
    838383© 2009 CiscoLearning Institute. • Click Back to modify the configuration. • Click Finish to complete the configuration. Configuration Summary
  • 84.
    848484© 2009 CiscoLearning Institute. Check VPN status. Create a mirroring configuration if no Cisco SDM is available on the peer. Test the VPN configuration. Verify VPN Configuration Choose Configure > VPN > Site-to-Site VPN > Edit Site-to-Site VPN
  • 85.
    858585© 2009 CiscoLearning Institute. Lists all IPsec tunnels, their parameters, and status. 1 Monitor Choose Monitor > VPN Status > IPSec Tunnels
  • 86.
    868686© 2009 CiscoLearning Institute. Telecommuting • Flexibility in working location and working hours • Employers save on real- estate, utility and other overhead costs • Succeeds if program is voluntary, subject to management discretion, and operationally feasible
  • 87.
    878787© 2009 CiscoLearning Institute. Telecommuting Benefits • Organizational benefits: - Continuity of operations - Increased responsiveness - Secure, reliable, and manageable access to information - Cost-effective integration of data, voice, video, and applications - Increased employee productivity, satisfaction, and retention • Social benefits: - Increased employment opportunities for marginalized groups - Less travel and commuter related stress • Environmental benefits: - Reduced carbon footprints, both for individual workers and organizations
  • 88.
    888888© 2009 CiscoLearning Institute. Implementing Remote Access
  • 89.
    898989© 2009 CiscoLearning Institute. Methods for Deploying Remote Access IPsec Remote Access VPN SSL-Based VPN Any Application Anywhere Access
  • 90.
    909090© 2009 CiscoLearning Institute. Comparison of SSL and IPSec SSL IPsec Applications Web-enabled applications, file sharing, e- mail All IP-based applications Encryption Moderate Key lengths from 40 bits to 128 bits Stronger Key lengths from 56 bits to 256 bits Authentication Moderate One-way or two-way authentication Strong Two-way authentication using shared secrets or digital certificates Ease of Use Very high Moderate Can be challenging to nontechnical users Overall Security Moderate Any device can connect Strong Only specific devices with specific configurations can connect
  • 91.
    919191© 2009 CiscoLearning Institute. SSL VPNs • Integrated security and routing • Browser-based full network SSL VPN access SSL VPN Workplace Resources Headquarters Internet SSL VPN Tunnel
  • 92.
    929292© 2009 CiscoLearning Institute. Types of Access
  • 93.
    939393© 2009 CiscoLearning Institute. Full Tunnel Client Access Mode
  • 94.
    949494© 2009 CiscoLearning Institute. User using SSL client Establishing an SSL Session User makes a connection to TCP port 443 Router replies with a digitally signed public key Shared-secret key, encrypted with public key of the server, is sent to the router Bulk encryption occurs using the shared-secret key with a symmetric encryption algorithm User software creates a shared-secret key 1 2 3 4 5 SSL VPN enabled ISR router
  • 95.
    959595© 2009 CiscoLearning Institute. SSL VPN Design Considerations • User connectivity • Router feature • Infrastructure planning • Implementation scope
  • 96.
    969696© 2009 CiscoLearning Institute. Cisco Easy VPN • Negotiates tunnel parameters • Establishes tunnels according to set parameters • Automatically creates a NAT / PAT and associated ACLs • Authenticates users by usernames, group names, and passwords • Manages security keys for encryption and decryption • Authenticates, encrypts, and decrypts data through the tunnel
  • 97.
    979797© 2009 CiscoLearning Institute. Cisco Easy VPN
  • 98.
    989898© 2009 CiscoLearning Institute. Securing the VPN Initiate IKE Phase 1 Establish ISAKMP SA Accept Proposal1 Username/Password Challenge Username/Password System Parameters Pushed Reverse Router Injection (RRI) adds a static route entry on the router for the remote clients IP address Initiate IKE Phase 2: IPsec IPsec SA 1 2 3 4 5 6 7
  • 99.
    999999© 2009 CiscoLearning Institute. Configuring Cisco Easy VPN Server 1 2 3 4 5
  • 100.
    100100100© 2009 CiscoLearning Institute. Configuring IKE Proposals 1 2 3Click Add Specify required parameters Click OK
  • 101.
    101101101© 2009 CiscoLearning Institute. Creating an IPSec Transform Set 1 2 3 4
  • 102.
    102102102© 2009 CiscoLearning Institute. Group Authorization and Group Policy Lookup 1 2 3 4 5 Select the location where Easy VPN group policies can be stored Click Next Click Add Click Next Configure the local group policies
  • 103.
    103103103© 2009 CiscoLearning Institute. Summary of Configuration Parameters
  • 104.
    104104104© 2009 CiscoLearning Institute. VPN Client Overview • Establishes end-to-end, encrypted VPN tunnels for secure connectivity • Compatible with all Cisco VPN products • Supports the innovative Cisco Easy VPN capabilities R1 R1-vpn-cluster.span.com R1 R1-vpn-cluster.span.com
  • 105.
    105105105© 2009 CiscoLearning Institute. Establishing a Connection R1-vpn-cluster.span.com R1 R1-vpn-cluster.span.com “R1” Once authenticated, status changes to connected.
  • 106.
    106106106© 2009 CiscoLearning Institute.

Editor's Notes

  • #49 Note: Actual parameters vary based on IOS image.
  • #51 Notice however, that policy numbers are only locally significant and do not have to match between IPsec peers.
  • #54 A transform set can have one AH transform and up to two ESP transforms