Cisco Secure VPN Exam Certification Guide - Cisco press

90 Chapter 3: Cisco VPN 3000 Concentrator Series Hardware Overview

Table 3-2 Cisco VPN 3000 Concentrator Series Capabilities (Continued)

Security

Because the Cisco VPN Concentrators have such a high throughput level for encrypted communications, you can set up all your users for the highest security levels without a loss of functionality or performance. Currently, the highest security option would be IPSec with 3DES encryption. Robust authentication options permit you to set up authentication using either an internal database or external authentication servers. Digital certificates and tokens can also be used to add an extra measure of security.

With the integral firewall capabilities, you have options in where you can locate the concentrators. You can augment the protection of your existing firewall by placing the VPN concentrator in front of or behind the existing firewall. Additionally, you can allow the concentrator to provide its own firewall protection by placing the VPN concentrator in parallel with your existing firewall.

Major Advantages of Cisco VPN 3000 Series Concentrators 91

Many firewalls also provide an isolated network called a demilitarized zone (DMZ), which is often used to house public access facilities such as Internet web servers. When the firewall does provide a DMZ, the VPN concentrator can be placed there, providing a fourth method of installing the Cisco VPN 3000 Concentrator in conjunction with a firewall. The following figures illustrate the four methods of implementing a VPN concentrator with a firewall.

Figure 3-3 shows the VPN concentrator placed in front of the firewall.

Figure 3-3 VPN Concentrator in Front of Firewall

Internet

Internet

Router VPN

Concentrator

DMZ Firewall

Internal LAN

Web

Server

Application

Server

Figure 3-4 shows the VPN concentrator placed behind the firewall.

Major Advantages of Cisco VPN 3000 Series Concentrators 93

Figure 3-6 shows the VPN concentrator placed in the firewall’s DMZ.

Figure 3-6 VPN Concentrator in DMZ

Internet

Internet

Router

DMZ Firewall

VPN

Concentrator

Web

Server

Internal LAN

Application

Server

You can establish filters to permit or deny almost any kind of traffic, and you can handshake with client-based firewalls. The Cisco VPN 3000 Series Concentrators can push firewall settings to the VPN Client, which then monitors firewall activity through an enforcement mechanism called Are You There (AYT). The AYT policy causes the client to poll the firewall every 30 seconds. If the firewall doesn’t respond, the VPN client drops the connection.

Centralized management of concentrators and clients is another powerful security feature. The VPN manager is a web-based management tool that can be secured using HTTPS or through an encrypted tunnel.

The Cisco VPN 3000 Concentrators and the Cisco VPN Client also provide additional security by providing 3DES encryption over IPSec for wireless transmissions. While the wireless WEP protocol provides some encryption for a portion of the connection, IPSec with 3DES enables end-to-end encryption security from the client to the concentrator.

Major Advantages of Cisco VPN 3000 Series Concentrators 95

are shown in Example 3-1. But the web interface is the tool that you want to use. Intuitive menu systems, onscreen help, drop-down-box selection windows, error checking, and security make this one of the slickest management interfaces in Cisco’s product line.

Example 3-1 VPN Concentrator Command Line Interface

Login: admin

Password:

Welcome to

Cisco Systems

VPN 3000 Concentrator Series

Command Line Interface

Copyright (C) 1998-2002 Cisco Systems, Inc.

1)Configuration

2)Administration

3)Monitoring

4)Save changes to Config file

5)Help Information

6)Exit

Main ->

The VPN Concentrator Manager breaks the concentrator management process into three management areas: Configuration, Administration, and Monitoring. Figure 3-8 shows the main menu screen of the manager.

Figure 3-8 VPN Concentrator Manager Main Page

Major Advantages of Cisco VPN 3000 Series Concentrators 97

The other three options on the Configuration menu cover the following areas:

•System—Server access, address assignment, tunneling protocols, IP routing, built-in management servers, system events, and system identification

•User Management—Attributes for groups and users that determine their access to and use of the VPN

•Policy Management—Policies that control data traffic through the VPN via filters, rules, and IPSec Security Associations; network lists; access times; and NAT

A hierarchy in the User Management section determines the inherited properties that groups and users assume. The root of all inherited properties is the group called the Base Group. The properties within this group are the default properties for all users, unless the users are members of specific groups. When specific groups are defined, for example, Accounting, Topeka Sales, or Network, those groups inherit their default settings from the Base Group. Those settings can be overridden within the specific groups. Users inherit the properties of the group when they are added to specific groups. If a user is not a member of a specific group, he or she defaults to the settings of the Base Group. It is a simple yet effective method of assigning properties to groups and users.

The following two sections present an overview of the Administration and Monitoring sections of the VPN Manager. Chapter 7, “Monitoring and Administering the Cisco VPN 3000 Series Concentrator,” provides more detail on these topics.

Administration

The Administration screen is shown in Figure 3-11.

Figure 3-11 VPN Concentrator Manager—Administration