BRK-134T VPNs Simplified

Virtual Private
Networks (VPNs)
Simplified
Erich Spengler
CSSIA CATC—Moraine Valley Community College
2008—60 Minute Session
BRK-134T
VPNs Simplified © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 1
Agenda
Demonstration
Introduction to VPNs
VPN Security (IPSec, PPTP, SSL)
VPN Technology Comparison
VPN Group Exercise
BRK-134T
Demonstration—Remote Network
Access via VPN
Corporate Servers
VPN Server/Gateway
Internet/
Unsecure Network
Remote User
VPN Tunnel Encrypted Traffic to the Corporate Server

BRK-134T
Introduction
to VPNs
Subtitle
BRK-134T
What Is a Virtual Private Network (VPN)?
Corporate HQ
Homeworker Public Telephone

with VPN Client Network
Software
Dial-Up User with

VPN Client Software
Internet
Homeworker
with VPN Router Teleworker with
Wireless VPN Client Software
Hotspot
Wireless Client
Branch Office with VPN Client Software
with VPN Router
A Remote Access VPN secures connections for remote users, such

as mobile users or telecommuters, to corporate LANs over shared
service provider networks
BRK-134T
Wireless: A New Big Driver for VPNs
Internet
An access point (AP) is a shared device

Remember the performance issues of shared hubs
Bridges, and other devices allow for interconnection
Protocols and applications work seamlessly
BRK-134T
Basic VPN Terms
Internet
Router to Router VPN Gateway

(Extranet) Internet
Router to VPN Firewall Gateway

(Extranet)
VPN Client to Router VPN via Dial-Up

(Access VPN)
VPN Client to Router VPN Network

Internet (Intranet)
Other Vendors to Router VPN

(Extranet)
BRK-134T
Using Site-to-Site VPNs
Frame Relay Central Site

WAN Network
Intranet
Branch/Remote Office
VP N
N VP
N
VP
Internet VPN
VP PSTN/ISDN
N Broadband
Extranet
Business-to-Business
BRK-134T
Using Remote-Access VPNs
Remote Access Client
DSL Central Site

Cable
Telecommuter
POP Or
Internet
Or
Router
Mobile POP
Extranet
Consumer-to-Consumer
Remote Access Client Remote Access Gateway

Cisco VPN Clients (IPSec) Cisco WAN Router
Microsoft Win 9x/NT/2000/XP (LTTPP) Cisco Secure PIX Firewall
Thire-party VPN client (PPTP) Or IPSec or PPTP aware device to provide
firewall/VPN Tunnel Termination
BRK-134T
VPN Components
Separate Data Increase Protection Prevent Tampering
Tunneling Encryption Integrity
GRE
IPSec
L2TP
DES, 3 DES
MPLS
MPPE
PPTP
TCP Checksum
AH in IPSec
Identify Source
Authentication
PKI
RSA RSA
BRK-134T
VPN Security
Subtitle
BRK-134T
What a VPN Must Provide
Av
y
rit
ail
teg
a bi
In
lit
y
Confidentiality
BRK-134T
Network Security Model
Data Security Assurance Model (CIA)
Confidentiality Integrity Authentication

Benefit Benefit Benefit
Ensures data is Ensures identity of
Ensures data privacy unaltered during originator or recipient
transit of data
Shuns
Shuns Shuns
Sniffing
Alteration Impersonation
Replay Replay Replay
Data Confidentiality and Data Integrity Depend on

Encryption and Encapsulation
BRK-134T
VPN Technology Options
SSH Application Layer SSL
Application
Layer (5–7)
Network Layer
Transport/
Network
Layer (3–4) GRE
PPTP
L2TP IPSEC
MPLS MPPE
Link/Physical
Layer (1–2)
Link-Layer Link-Layer
Encryption Encryption
BRK-134T
What Is an IPSec VPN?
Internet Protocol Security

A set of security protocols and algorithms used
to secure IP data at the network layer
IPSec provides data confidentiality (encryption),
integrity (hash), authentication (signature/certificates)
of IP packets while maintaining the ability to route
them through existing IP networks
BRK-134T
Advantages of IPSec
Access VPNs
Classic site-to-site managed VPNs
Trusted MPLS VPNs
Service Provider
Main Office
Mobile
Worker
POP
Business Partner Mobile
Worker
Remote Office Regional Office Home Office

BRK-134T
IPSec Key Points
IPSec can ensure the confidentiality

and/or the authenticity of IP packets
The key points are
Two modes of propagation
(transport and tunnel)
IP Data
Security associations (SAs) (Encrypted)
Two types of header (ESP and AH)
ESP Header
AH Header
IP Header
BRK-134T
IPSec Framework
IPSec
Framework
Choices
IPSec Protocol ESP

ESP AH
+ AH
Encryption 3
DES AES
DES
Authentication MD5 SHA
DH DH1 DH2 DH5
ESP—Encapsulating Security Payload MD5, SHA—Authentication

AH—Authentication Header DH—Diffie-Hellman Identifier to Derive
AES—Advanced Encryption Standard the Share Secret
BRK-134T
Two Types of IPSec Security Protocols
Authentication Header
All Data in Cleartext
Router A Router B
Ensures data integrity Uses keyed-hash mechanism

Provides origin authentication— Does not provide confidentiality
ensures packets definitely came (no encryption)
from peer router Provides optional replay protection
Encapsulating Security Payload

Data Payload Is Encrypted
Router A Router B
Data confidentiality (encryption) Optional data origin authentication

Limited traffic flow confidentiality Anti-replay protection
Data integrity Does not protect IP header
BRK-134T
IP Header with IPSec Information
IP Data
(Encrypted)
IP Header AH Header ESP Header IP Data
ESP Header
AH Header
IP Header
BRK-134T
IPSec in a Standards World
Headquarters
Periodic Re-Key
Router
Firewall
ATE
TI FIC
CER
Internet/IP VPN
Remote Office
Standards-Based Cryptography
Firewall
IKE, IPSec, 3DES
Equipment/vendor interoperability
BRK-134T
IKE Benefits an IPSec Environment
UNIVERSITY
Ensure confidential communications in an unsecured network

Also known as the Key Management Nightmare!!!
BRK-134T
IPSec: Building a Connection
IKE (Phase 1)
IKE (Phase 2)
Data
Two-phase protocol:
Phase 1 exchange: two peers establish a secure, authenticated channel
with which to communicate; Main mode or Aggressive mode accomplishes
a Phase 1 exchange
Phase 2 exchange: security associations are negotiated on behalf of IPSec
services; Quick mode accomplishes a Phase 2 exchange
Each phase has its SAs: ISAKMP SA (Phase 1) and IPSec SA

(Phase 2)
BRK-134T
How Does IKE/IPSec Work?
Phase I SA (ISAKMP SA)
Main Mode Aggressive Mode

(6 Messages) (3 Messages)
New IPSec Tunnel or Rekey
Phase II SA Phase II SA
(IPSec SA) (IPSec SA)
Quick Mode Quick Mode
A Protected Data B C Protected Data D
BRK-134T
ISAKMP Main, Quick and Aggressive Modes
ISAKMP
I SA Header 1 R
Main Mode N E
(Phase 1) I 2 Header SA S
T P
Nonce Key Header 3
I O
A 4 Header Key Nonce N
T D
O Sig [ Cert ] ID Header 5 E
R 6 Header ID [ Cert ] Sig R
ID/ID [Key] Nonce SA Hash Header 1
ISAKMP 2 Header Hash SA Nonce [Key] ID /ID

Quick Mode Hash Header 3
(Phase 2) ISAKMP
Aggressive Mode
(Phase 1)
ID Nonce [Key] SA Header 1
2 Header SA [Key] Nonce ID [Cert] Sig
Sig [Cert] Header 3

BRK-134T
What Is a Web/SSL VPN?
Certificate
Certificate
Uses certificates for identification

Private key used to prove identity
SSL server provides all encryption keys
Originally for HTTP/Web applications
BRK-134T
Web/SSL VPN Features
WebVPN
Broadband
Modem Broadband
Provider
ISP Corporate
Network
WebVPN Access
Point ASA Firewall
Wireless LAN
Feature
Access to internal web sites (HTTP/HTTPS) including filtering
Access to internal Windows (CIFS) File Shares
TCP port forwarding for legacy application support
Access to e-mail via POP, SMTP, and IMAP4 over SSL
BRK-134T
Web/SSL VPN and IPSec Comparison
WebVPN IPSEC VPN
Uses a standard web browser to Uses purpose built client
access the corporate network software for network access
SSL encryption native to browser Client provides encryption
provides transport security and desktop security
Application accessed through Client establishes seamless
browser portal connection to network
Limited client/server application All application are accessible
accessed using applets through their native interface
BRK-134T
What Is a PPTP VPN?
Point to Point Tunneling Protocol

PPTP is a network protocol used in the implementation
of Virtual Private Networks (VPN); RFC 2637 is the
PPTP technical specification
PPTP works on a client server model; PPTP clients are
included by default in Microsoft Windows and also
available for both Linux and Mac OS X; newer VPN
technologies like L2TP and IPSec may replace PPTP
someday, but PPTP/MPPE remains a popular network
protocol especially on Windows computers
BRK-134T
VPN Technology Options
SSH Application Layer SSL
Application
Layer (5–7)
Network Layer
Transport/
Network
GRE
Layer (3–4) PPTP
L2TP IPSEC
MPLS MPPE
Link/Physical
Layer (1–2)
Link-Layer Link-Layer
Encryption Encryption
BRK-134T
Benefits of PPTP
User Data
TCP User Data
GRE PPP IP TCP User Data IP TCP User Data
IP GRE PPP IP TCP User Data PPP IP TCP User Data
PPP IP GRE PPP IP TCP User Data
Organization
Secure
Network
Internet
PPTP
PPoE is point-point protocol over Ethernet
Single tunnel between end-points: Single device support (GRE = generic routing encapsulation)
Six bytes over overhead when compression used
No tunnel authentication
With RADIUS server supports authentication and accounting
CHAP V2 fixes password, masquerading, and encryption weakness
BRK-134T
40 or 128 bit RC4 packet encryption
Is PPTP Secure? Yes
Organization
Secure
Network Internet
CHAP V2 Authentication with 40 or 128 bit RC4 Encryption

Challenge Connection Request
Response
Challenge
Response
New Client Key New Client Key
New Server Key New Server Key
Encrypted Packet
Encrypted Packet
BRK-134T
Simplicity Advanced
Low Cost Security
Application to Application SSL
End to End IPSec Transport Mode
L2TP/IPSec
Gateway to Gateway PPTP
IPSec Tunnel Mode
Client to Gateway PPTP L2TP/IPSec
PPTP—Point to Point Tunneling Protocol—Layer 2—Multiprotocol

L2TP/IPSec—Layer 2 Tunneling Protocol—Multiprotocol—Encryption and Authentication
IPSec—IP Security—Layer 3—IP Protocol—Encryption and Authentication
SSL—Secure Sockets Layer—Layer 6/7—Application—Encryption and Authentication
BRK-134T
Group Exercise
Configuring
VPNs Lab
BRK-134T
Summary
Demonstration
Introduction to VPNs
VPN Security (IPSec, PPTP, SSL)
VPN Group Exercise
BRK-134T
BRK-134T
BRK-134T

BRK-134T VPNs Simplified

Încărcat de

Informații document

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

BRK-134T VPNs Simplified

Încărcat de

Drepturi de autor:

Formate disponibile

Virtual Private

VPN Tunnel Encrypted Traffic to the Corporate Server

Homeworker Public Telephone

Dial-Up User with

A Remote Access VPN secures connections for remote users, such

 An access point (AP) is a shared device

Router to Router VPN Gateway

Router to VPN Firewall Gateway

VPN Client to Router VPN via Dial-Up

VPN Client to Router VPN Network

Other Vendors to Router VPN

Frame Relay Central Site

DSL Central Site

Remote Access Client Remote Access Gateway

Data Security Assurance Model (CIA)

Confidentiality Integrity Authentication

Data Confidentiality and Data Integrity Depend on

Internet Protocol Security

Remote Office Regional Office Home Office

 IPSec can ensure the confidentiality

Two types of header (ESP and AH)

IPSec Protocol ESP

Authentication MD5 SHA

DH DH1 DH2 DH5

ESP—Encapsulating Security Payload MD5, SHA—Authentication

 Ensures data integrity  Uses keyed-hash mechanism

Encapsulating Security Payload

 Data confidentiality (encryption)  Optional data origin authentication

IP Header AH Header ESP Header IP Data

 Ensure confidential communications in an unsecured network

 Each phase has its SAs: ISAKMP SA (Phase 1) and IPSec SA

Main Mode Aggressive Mode

New IPSec Tunnel or Rekey

Quick Mode Quick Mode

A Protected Data B C Protected Data D

ID/ID [Key] Nonce SA Hash Header 1

ISAKMP 2 Header Hash SA Nonce [Key] ID /ID

Sig [Cert] Header 3

 Uses certificates for identification

Point to Point Tunneling Protocol

TCP User Data

GRE PPP IP TCP User Data IP TCP User Data

IP GRE PPP IP TCP User Data PPP IP TCP User Data

PPP IP GRE PPP IP TCP User Data

CHAP V2 Authentication with 40 or 128 bit RC4 Encryption

Application to Application SSL

End to End IPSec Transport Mode

Client to Gateway PPTP L2TP/IPSec

PPTP—Point to Point Tunneling Protocol—Layer 2—Multiprotocol

S-ar putea să vă placă și

An access point (AP) is a shared device

IPSec can ensure the confidentiality

Ensures data integrity Uses keyed-hash mechanism

Data confidentiality (encryption) Optional data origin authentication

Ensure confidential communications in an unsecured network

Each phase has its SAs: ISAKMP SA (Phase 1) and IPSec SA

Uses certificates for identification