Chapter

Germn Bastidas, Ing. Universidad San Francisco de Quito

8

Implementing Virtual Private Networks

CCNA Security 1.0 Implementing Network Security Cisco Networking Academy

Overview

VPN

VPN Overview

A VPN is a private network that is created via tunneling over a public network, usually the Internet.

VPNs have many benefits: Cost savings Security Scalability Compatibility with broadband technology

Types of VPN Networks

Site-to-site. Devices on both sides of the VPN connection are aware of the VPN configuration in advance. The VPN remains static, and internal hosts have no knowledge that a VPN exists. Frame Relay, ATM, GRE, and MPLS VPNs are examples of site-to-site VPNs.

Remote-access. VPN information is not statically set up, but instead allows for dynamically changing information and can be enabled and disabled.

Cisco VPN Client Software The Cisco VPN Client software encapsulates and encrypts that traffic before sending it over the Internet to the VPN gateway at the edge of the target network

Cisco IOS SSL VPN SSL VPNs allow users to access web pages and services, including the ability to access files, send and receive email, and run TCP-based applications without IPsec VPN Client software.

The primary restriction of SSL VPNs is that they are currently supported only in software.

SSL VPN Modes of Access

Clientless SSL VPN. A remote client needs only an SSL-enabled web browser to access HTTP- or HTTPS-enabled web servers on the corporate LAN.

Client SSL VPN. A remote client must download a small, Java-based applet for secure access of TCP applications that use static port numbers. UDP is not supported in a thin client environment.

VPN Solutions

VPN Specialized Hardware

AIM - A broad range of Cisco routers can be equipped with AIM. Advanced integration modules are installed inside the router chassis and offload encryption tasks from the router CPU. Cisco IPsec VPN Shared Port Adapter (SPA) - Delivers scalable and cost-effective VPN performance for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers.

Cisco IPsec VPN SPA

GRE VPN

Generic Routing Encapsulation (GRE)

GRE does not include any strong security mechanisms to protect its payload.

GRE Tunnel Header The GRE header, together with the tunneling IP header, creates at least 24 bytes of additional overhead for tunneled packets.

Configuring a Site-to-Site GRE Tunnel

When To Use GRE

IPSEC VPN COMPONENTS AND OPERATION

IPsec

IETF standard (RFC 2401-2412) that defines how a VPN can be configured using the IP addressing protocol.

IPsec is not bound to any specific encryption, authentication, security algorithms, or keying technology.

IPsec is a framework of open standards that spells out the rules for secure communications.

IPsec relies on existing algorithms to implement the encryption, authentication, and key exchange.

IPsec Framework

Confidentiality

Integrity

Authentication - PSK

Authentication - RSA

Secure Key Exchange

The Diffie-Hellman (DH) key agreement is a public key exchange method that provides a way for two peers to establish a shared secret key that only they know, even though they are communicating over an insecure channel.

There are four DH groups: 1, 2, 5, and 7. DH groups 1, 2, and 5 support exponentiation over a prime

modulus with a key size of 768 bits, 1024 bits, and 1536 bits, respectively.

Cisco 3000 clients support DH groups 1, 2, and 5. DES and 3DES encryption support DH groups 1 and 2.

AES encryption supports DH groups 2 and 5. The Certicom movianVPN client supports group 7. Group 7 supports Elliptical Curve Cryptography (ECC), which

reduces the time needed to generate keys.

IPsec Framework Protocols

IP protocol 51

IP protocol 50

Transport Mode and Tunnel Mode

Internet Key Exchange (IKE)

Protocol used to set up a Security Association (SA)

An SA is a basic building block of IPsec. Security associations are maintained within a SA database (SADB).

IKE uses UDP port 500.

An alternative to using IKE is to manually configure all parameters required to establish a secure IPsec connection.

IKE Phase 1 Main Mode

IKE Phase 1 Aggressive Mode

IKE Phase 2 (Quick Mode)

The purpose of IKE Phase 2 is to negotiate the IPsec security parameters that will be used to secure the IPsec tunnel.

IKE Phase 2 performs the following functions:

Negotiates IPsec security parameters, known as IPsec transform sets

Establishes IPsec SAs

Periodically renegotiates IPsec SAs to ensure security

Optionally performs an additional DH exchange

IMPLEMENTING SITE-TO-SITE IPSEC VPN WITH CLI

IPsec VPN Steps

Task to Configure IPsec

Task 1. Ensure that ACLs configured on the Interface are compatible with IPsec configuration. Usually there are restrictions on the interface that the VPN traffic uses; for example, block all traffic that is not IPsec or IKE.

Task 2. Create an ISAKMP policy to determine the ISAKMP parameters that will be used to establish the tunnel.

Task 3. Define the IPsec transform set. The definition of the transform set defines the parameters that the IPsec tunnel uses. The set can include the encryption and integrity algorithms.

Task 4. Create a crypto ACL. The crypto ACL defines which traffic is sent through the IPsec tunnel and protected by the IPsec process.

Task 5. Create and apply a crypto map. The crypto map groups the previously configured parameters together and defines the IPsec peer devices. The crypto map is applied to the outgoing interface of the VPN device.

Task 1

Task 1 - Configuration

Task 2. Create an ISAKMP policy

Use an integer from 1 to 10,000, with 1 being the highest priority and 10,000 the lowest.

ISAKMP Parameters

Task 2. Configure a PSK

Task 3 Configure the Transform Sets

Transform Combinations

Transform Sets Negotiation Example

Transform Sets Configuration Example

Task 4 Configure the Crypto ACL

Task 5 Create the Crypto Map

Crypto Map Command

Crypto Map Configuration Mode Commands

Task 5 Configuration Example

Task 5 Apply the Crypto Map

Verify and Troubleshoot IPsec Configuration

Configure IPsec with SDM

IMPLEMENTING REMOTE-ACCESS VPNS

Teleworking Benefits

Methods for Deploying Remote-Access VPNs

IPsec vs SSL Remote-Access VPNs

Establishing an SSL Session

Cisco Easy VPN

Establishing an IPsec Remote-Access Session

Configure a VPN Server with SDM

Connect with a VPN Client