Download
1 / 65
660 likes | 683 Views
This module covers the implementation of digital certificates and VPN technology in network security. Topics include VPN types, VPN technologies like WebVPN and tunneling protocols such as L2TP, GRE, IPSec, and MPLS. Learn about certificate authority support, VPN topologies, VPN technologies, and how to select the right VPN technologies for your network.
E N D
Network Security 2 Module 3: VPN and Encryption Technology
Module 3: VPN and Encryption Technology Lesson 3.3 Implementing Digital Certificates
Certificate authority support • Restrictions • CA should be configured only when both IPSec and ISAKMP are configured in the network. • Cisco IOS does not support CA server public keys greater than 2048 bits. • Prerequisites • A CA must be available to the network • CA must support Simple Certificate Enrollment Protocol (SCEP)
The protocol is designed to make the issuing and revocation of digital certificates as scalable as possible. • The idea is that any standard network user should be able to request their digital certificate electronically and as simply as possible. • These processes have usually required intensive input from network administrators, and so have not been suited to large scale deployments. • Two authentication methods that SCEP provides are manual authentication and authentication based on pre-shared secret keys. Simple Certificate Enrollment Protocol SCEP
Module 3: VPN and Encryption Technology Lesson 3.4 VPN Topologies
VPNs • A VPN provides the same network connectivity for remote users over a public infrastructure as they would have over a private network. • VPN services for network connectivity include authentication, data integrity, and confidentiality. • Two basic VPN types: • LAN-to-LAN (Site to Site) VPNs • Intranet VPNs. • Extranet VPNs • Remote Access VPNs • Connect remote users, such as mobile users and telecommuters, to the enterprise.
Remote access VPNs • There two types of Remote Access VPNs: • Client-initiated – Remote users use a VPN client or web browser to establish a secure tunnel across a public network to the enterprise. • NAS-initiated – Remote users dial in to an ISP Network Access Server (NAS). The NAS establishes a secure tunnel to the enterprise private network that might support multiple remote user-initiated sessions.
Module 3: VPN and Encryption Technology Lesson 3.5 VPN Technologies
VPN technology options • With implementation of encryption on one layer, this layer and all layers above it are automatically protected. • Network layer protection offers one of the most flexible solutions. • It is media independent as well as application independent.
WebVPN • Lets users establish a secure, remote-access VPN tunnel to a head-end device using a web browser. • Not a replacement for IPSec, but widens application availability. • No need for either a software or hardware client. • Provides easy access to a broad range of enterprise applications, • WebVPN uses the SSL protocol and its successor, TLS
Tunneling Protocols L2TP • Cisco used Layer 2 Forwarding (L2F) as its proprietary tunneling protocol. • L2TP is entirely backwards compatible with L2F. L2F is not forward compatible with L2TP. • L2TP, is a combination of Cisco L2F and Microsoft Point-to-Point Tunneling Protocol (PPTP). • Microsoft supports PPTP in its earlier versions of Windows and PPTP/L2TP in Windows NT/2000/XP. • L2TP allows users to invoke corporate security policies across any VPN link as an extension of their internal networks. • L2TP is best suited for remote access VPNs that require multiprotocol support.
Tunneling Protocols GRE • Cisco GRE multiprotocol carrier encapsulates IP, CLNP, IPX, AppleTalk, DECnet Phase IV, and XNS inside IP tunnels. • Creates a virtual point-to-point link between routers across an IP cloud. • GRE is best suited for site-to-site VPNs that require multiprotocol support. • GRE is typically used to tunnel multicast packets such as routing protocols.
Tunneling Protocols IPSEC • Is the choice for secure corporate VPNs. • Supports IP unicast traffic only. • For multiprotocol or IP multicast tunneling, another tunneling protocol must be used. • Neither L2TP or GRE supports data encryption or packet integrity. • IPSec can be used in combination to provide encryption, such as L2TP/IPSec and GRE/IPSec. • If only IP unicast packets are tunneled, simple encapsulation provided by IPSec is sufficient.
Tunneling Protocols MPLS • MPLS is a VPN technology. • Implemented by ISPs and large corporations. • Uses label switching and label switched paths over various link level technologies. • Packet-over-SONET • Frame Relay • ATM • LAN technologies • Includes procedures and protocols for the distribution of labels between routers, encapsulations, and multicast considerations.
Tunneling Interfaces • Provide a point-to-point connection between two routers through a virtual software interface. • Appear as one direct link between routers hiding the underlying infrastructure • Should not to be confused with IPSec or L2TP tunnels, which can act as tunnels but not as true Cisco IOS interfaces.
Module 3: VPN and Encryption Technology Lesson 3.6 IPSec
Internet What Is IPsec? IPsec • IPsec is the IETF standard that enables encrypted communication between peers. • Consists of open standards for securing private communications • Ensures data confidentiality, integrity, and authentication through network layer encryption • Scales from small to very large networks
Options for IPSec framework • AH and ESP use symmetric secret key algorithms, although public key algorithms are feasible • The IPSec framework provides data integrity, authentication, and confidentiality, as well as security association and key management
Authentication Header (AH) • Used to provide connectionless integrity and data origin authentication for IP datagrams, and to provide protection against replays. • Provides authentication for as much of the IP header as possible, as well as for upper level protocol data. • AH is defined as IP protocol 51. • May be applied alone, in combination with the IP ESP, or in a nested fashion through the use of tunnel mode. • ESP may be used to provide the same security services, and it also provides a confidentiality, or encryption, service. • The primary difference between the authentication services provided by ESP and AH is the extent of the coverage. • ESP does not protect any IP header fields unless ESP encapsulates those fields, or the fields are in tunnel mode .
AH Header Fields • The following are reasons to use AH even though ESP seems to do all the security services. • Requires less overhead than ESP. • Is never export-restricted. • Is mandatory for IPv6 compliance.
Encapsulating Security Payload (ESP) • Used to provide confidentiality, data origin authentication, connectionless integrity, an anti-replay service • Confidentiality may be selected independent of all other services. • However, use of confidentiality without integrity authentication, either in ESP or separately in AH, may subject traffic to certain forms of active attacks • ESP is defined as IP protocol 50.
Encapsulating Security Payload (ESP) • Data origin authentication and connectionless integrity are joint services • Offered as an option in conjunction with optional confidentiality. • The anti-replay service may be selected only if data origin authentication is selected. • Its election is solely at the discretion of the receiver. • Anti-replay service is effective only if the receiver checks the sequence number. • Traffic flow confidentiality requires selection of tunnel mode. • Although both confidentiality and authentication are optional, at least one of them must be selected.
Encapsulating Security Payload (ESP) • One of the most important values is the Security Parameters Index (SPI) • Keep track to the current SA between two IPSec devices. • Encryption is done with DES or 3DES. • Optional authentication and integrity are provided with HMAC, keyed SHA-1, or keyed MD5 • There are two different key types contained in the SA : • Encryption session keys • HMAC session keys
Tunnel and transport modes • Transport mode • Each end host does IPSec encapsulation of its own data, host-to-host. • Tunnel mode • IPSec gateways provide IPSec services to other hosts in peer-to-peer tunnels. • End-hosts are not aware of IPSec being used
Tunnel and transport modes • ESP and AH can be applied to IP packets in transport mode and tunnel mode. • In transport mode, • Security is provided only for the transport layer and above. • Protects the payload of the packet but leaves the original IP address in the clear. • Original IP address is used to route the packet through the Internet. • Tunnel mode • Provides security for the whole original IP packet. • Original IP packet is encrypted. • Encrypted packet is encapsulated in another IP packet.
