Designing Cisco Network Service Architectures - Free Books

Case Study 4 Answer Key: CP Hotels Security and IPsec VPNNetworkBased on the scenario, this section includes a proposed solution. According to the case studyguidelines, there may be some minor variations in your solutions.Step 1 Hotel IPsec VPN• There is certainly some room for discussion concerning type of IPsec VPN. Some thoughtsare provided here:— Basic IPsec tunnels with EasyVPN is not appropriate due to weak security based onshared passwords.— “Raw” IPsec VPN with Reverse Route Injection (RRI) is a possibility to consider. Insome ways, it greatly simplifies addressing and routing. Some coherent assignmentof addresses to hotels would be needed, so that the injected routes would summarize.There would be no tunnels, so no need for addresses for tunnels. The RRI wouldeffectively make the hotels “stubby”, needing only to know summary routes to thedestinations at the data center. Raw IPsec does create a separate security associationper configured crypto ACL entry, which would represent some extra overhead onthe aggregating IPsec termination routers in the data center.— Generic Route Encapsulation (GRE) over IPsec would be messy to configure, butprovides dynamic routing and support for IP multicast. IP addressing for GRE ismoderately complex, since remote hotel addresses plus GRE tunnel addresses wouldneed to be considered.— DMVPN would reduce the number of tunnel interfaces at the head end, allowinglarger subnets than /30 to be used. It would allow dynamic routing but not IPmulticast. Since hotels do not need to directly communicate, the Next Hop RoutingProtocol (NHRP) features accompanying DMVPN would not be needed.— Group Encrypted Transport VPN (GET VPN) is another alternative. Since a fullmesh is not needed, GET VPN appears to provide little advantage to CP Hotels.— In all of the methods (except Easy VPN), specifying endpoint IP addresses, toprovide some control and security is recommended. This does mean that hotelswould need to have fixed IP addresses, and could not use DHCP from their ISP(s).There is another debate issue here. Generally, one would want business class DSL orcable services, with faster outage response times, and such plans generally include afixed (static) IP address.• The two best options in this case appear to be GRE over IPsec or DMVPN. The rest of thisanswer will assume GRE over IPsec has been chosen.• Each hotel would connect with two GRE tunnels, one to each data center.• The data center Hotel Module access routers would use default to the Internet to reachhotels. This is acceptable since they would not be forwarding any traffic to the CorporateInternet Module. Hotels would use default routes to the Internet and their ISP’s routing toreach the data centers.• For routing to each hotel, EIGRP is recommended. The design should make each hotelstubby, and filter all routes from the GRE tunnels except for corporate summary routes torelevant data center blocks of addresses. An alternative to filtering would be to summarizeall the hotel prefixes back to the hotel, eliminating all the more-specific prefixes.© 2007 Cisco Systems, Inc. Lab Guide 53