Universidad San Francisco de Quito

Germán Bastidas, Ing.
Universidad San Francisco de Quito
Chapter
8
Implementing Virtual
Private Networks
CCNA Security 1.0
Implementing Network Security
Cisco Networking Academy

Overview

VPN

VPN Overview
• A VPN is a private network that is created via tunneling over a public
network, usually the Internet.
• VPNs have many benefits:
– Cost savings
– Security
– Scalability
– Compatibility with broadband technology

Types of VPN Networks
• Site-to-site. Devices on both sides of the VPN
connection are aware of the VPN configuration in
advance. The VPN remains static, and internal
hosts have no knowledge that a VPN exists. Frame
Relay, ATM, GRE, and MPLS VPNs are examples of
site-to-site VPNs.
• Remote-access. VPN information is not statically
set up, but instead allows for dynamically
changing information and can be enabled and
disabled.

Cisco VPN Client Software
The Cisco VPN Client software encapsulates and encrypts that traffic before sending it over
the Internet to the VPN gateway at the edge of the target network

Cisco IOS SSL VPN
SSL VPNs allow users to access web pages and services, including the ability to access files,
send and receive email, and run TCP-based applications without IPsec VPN Client software.
The primary restriction of SSL VPNs is that they are currently supported only in software.

SSL VPN Modes of Access
• Clientless SSL VPN. A remote client needs only an
SSL-enabled web browser to access HTTP- or
HTTPS-enabled web servers on the corporate LAN.
• Client SSL VPN. A remote client must download a
small, Java-based applet for secure access of TCP
applications that use static port numbers. UDP is
not supported in a thin client environment.

VPN Solutions

VPN Specialized Hardware
AIM - A broad range of Cisco routers can be equipped with AIM. Advanced integration
modules are installed inside the router chassis and offload encryption tasks from the
router CPU.
Cisco IPsec VPN Shared Port Adapter (SPA) - Delivers scalable and cost-effective VPN
performance for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers.
Cisco IPsec VPN SPA

GRE VPN

Generic Routing Encapsulation (GRE)
GRE does not include any strong security mechanisms to protect its payload.

GRE Tunnel Header
The GRE header, together with the tunneling IP header,
creates at least 24 bytes of additional overhead for
tunneled packets.

Configuring a Site-to-Site GRE Tunnel

When To Use GRE

IPSEC VPN COMPONENTS AND
OPERATION

IPsec
• IETF standard (RFC 2401-2412) that defines how a
VPN can be configured using the IP addressing
protocol.
• IPsec is not bound to any specific encryption,
authentication, security algorithms, or keying
technology.
• IPsec is a framework of open standards that spells
out the rules for secure communications.
• IPsec relies on existing algorithms to implement
the encryption, authentication, and key exchange.

IPsec Framework

Confidentiality

Integrity

Authentication - PSK

Authentication - RSA

Secure Key Exchange
• The Diffie-Hellman (DH) key agreement is a public key
exchange method that provides a way for two peers to
establish a shared secret key that only they know, even
though they are communicating over an insecure channel.
• There are four DH groups: 1, 2, 5, and 7.
– DH groups 1, 2, and 5 support exponentiation over a prime
modulus with a key size of 768 bits, 1024 bits, and 1536 bits,
respectively.
– Cisco 3000 clients support DH groups 1, 2, and 5. DES and 3DES
encryption support DH groups 1 and 2.
– AES encryption supports DH groups 2 and 5.
– The Certicom movianVPN client supports group 7.
– Group 7 supports Elliptical Curve Cryptography (ECC), which
reduces the time needed to generate keys.

IPsec Framework Protocols
IP protocol 51
IP protocol 50

Transport Mode and Tunnel Mode

Internet Key Exchange (IKE)
• Protocol used to set up a Security Association (SA)
• An SA is a basic building block of IPsec. Security
associations are maintained within a SA database
(SADB).
• IKE uses UDP port 500.
• An alternative to using IKE is to manually
configure all parameters required to establish a
secure IPsec connection.

IKE Phase 1 Main Mode

IKE Phase 1 Aggressive Mode

IKE Phase 2 (Quick Mode)
• The purpose of IKE Phase 2 is to negotiate the
IPsec security parameters that will be used to
secure the IPsec tunnel.
• IKE Phase 2 performs the following functions:
– Negotiates IPsec security parameters, known as IPsec
transform sets
– Establishes IPsec SAs
– Periodically renegotiates IPsec SAs to ensure security
– Optionally performs an additional DH exchange

IMPLEMENTING SITE-TO-SITE IPSEC
VPN WITH CLI

IPsec VPN Steps

Task to Configure IPsec
• Task 1. Ensure that ACLs configured on the Interface are compatible with IPsec
configuration. Usually there are restrictions on the interface that the VPN traffic
uses; for example, block all traffic that is not IPsec or IKE.
• Task 2. Create an ISAKMP policy to determine the ISAKMP parameters that will
be used to establish the tunnel.
• Task 3. Define the IPsec transform set. The definition of the transform set
defines the parameters that the IPsec tunnel uses. The set can include the
encryption and integrity algorithms.
• Task 4. Create a crypto ACL. The crypto ACL defines which traffic is sent through
the IPsec tunnel and protected by the IPsec process.
• Task 5. Create and apply a crypto map. The crypto map groups the previously
configured parameters together and defines the IPsec peer devices. The crypto
map is applied to the outgoing interface of the VPN device.

Task 1

Task 1 - Configuration

Task 2. Create an ISAKMP policy
Use an integer from 1 to 10,000, with 1 being
the highest priority and 10,000 the lowest.

ISAKMP Parameters

Task 2. Configure a PSK

Task 3 – Configure the Transform Sets

Transform Combinations

Transform Sets Negotiation Example

Transform Sets Configuration Example

Task 4 – Configure the Crypto ACL

Task 5 – Create the Crypto Map

Crypto Map Command

Crypto Map Configuration Mode Commands

Task 5 – Configuration Example

Task 5 – Apply the Crypto Map

Verify and Troubleshoot IPsec Configuration

Configure IPsec with SDM

IMPLEMENTING REMOTE-ACCESS
VPNS

Teleworking Benefits

Methods for Deploying Remote-Access VPNs

IPsec vs SSL Remote-Access VPNs

Establishing an SSL Session

Cisco Easy VPN

Establishing an IPsec Remote-Access Session

Configure a VPN Server with SDM

Connect with a VPN Client