CCNA Complete Guide 2nd Edition.pdf - Cisco Learning Home

- The Internet Security Association and Key Management Protocol (ISAKMP) defines the
procedures for authenticating peers, IKASAMP and IPsec SAs establishment, negotiation,
modification, and deletion; key generation, and threat mitigation (eg: DoS and replay attacks).
- Instead of ISAKMP (the use of ipsec-isakmp keyword along with the crypto map global
configuration command), manual keying (the use of ipsec-manual keyword along with the
crypto map global configuration command) which require manual entry of the shared secret
session keys (used for hashing and encryption) on both crypto endpoints is also possible.
- IPsec operation requires both ends to be configured with the same transform set, which
specifies the methods for encrypt and decrypt the data. IPsec uses 2 primary security protocols –
Authentication Header (AH) and Encapsulating Security Payload (ESP). These protocols are
used for secured data transmission through an IPsec-based VPN tunnel. IPsec-based VPNs can
be established using AH only, ESP only, or both AH and ESP.
- The Authentication Header (AH) protocol provides authentication for both the IP header and
data of a packet using a one-way hash function. The sender first generates a one-way hash, and
then the receiver generates the same one-way hash. If the packet has changed in any way,
it won’t be authenticated and will be dropped. IPsec relies upon AH to guarantee authenticity.
AH provides integrity check on the entire packet, but it doesn’t provide any encryption services.
- ESP only provides integrity check (and encrypts) on the data of a packet (and the ESP header);
while AH checks the entire packet – both header and data. AH is used for authentication only,
while ESP can be used for either encryption or authentication only; or both.
- Although AH and ESP are typically used independently, they are often being used together to
provide data encryption service. Note: It is important to use authentication even if encryption is
used, as encrypt-only implementations are subject to some forms of effective attacks.
- ESP provides the following 4 functionalities or capabilities:
Confidentiality (Encryption) Provided through the use of symmetric encryption algorithms,
eg: DES, 3DES. Confidentiality can be selected separately
from all other services, but the confidentiality selected must be
the same on all VPN endpoints.
Data Origin Authentication
and Connectionless Integrity
Joint services offered as an option in conjunction with the
confidentiality option. Authentication ensures that the
connection is established with the desired system.
Anti-Replay Protection This service works only if data origin authentication is
selected. It is based upon the receiver – it is effective only if
the receiver checks the sequence number of the received
packets with a sliding window of the destination gateway or
host to prevent replay attacks.
Traffic Flow Confidentiality This service works only when tunnel mode is selected.
It is most effective if implemented at a security gateway,
where the source-destination patterns of attacks is visible.
- The degree of security of IPsec VPN is based on the encryption algorithm used and the length of
the pre-shared key. The longer the key, the harder it is to be broken.
- IPsec is not bound to any specific encryption or authentication algorithm, keying or technology,
or security algorithms, which allows IPsec to support newer and better algorithms.
297
Copyright © 2008 Yap Chin Hoong
yapchinhoong@hotmail.com