Cisco Secure VPN Exam Certification Guide - Cisco press

210 Chapter 4: Configuring Cisco VPN 3000 for Remote Access Using Preshared Keys

Scenario Answers

The answers provided in this section are not necessarily the only correct answers. They merely represent one possibility for each scenario. The intention is to test your base knowledge and understanding of the concepts discussed in this chapter.

Should your answers be different (as they likely will be), consider the differences. Are your answers in line with the concepts of the answers provided and explained here? If not, reread the chapter, focusing on the sections that are related to the problem scenario.

Scenario 4-1 Answers

1Concentrator model? The Cisco VPN 3005 Concentrator is probably adequate for this installation. If your company were growing quickly, you might opt for the 3015. It has about the same capabilities but is expandable, all the way to a 3080, if you ever needed the additional capacity.

2Type of device authentication? Because this is a chapter on preshared keys, you would opt to use preshared keys. For this small user base, the maintenance for preshared keys should not be a big concern.

3Authentication? Internal authentication was one of the reasons for choosing the concentrator over the router. The internal database keeps authentication on the same device and is flexible enough to meet the needs of this application.

4Address assignment? Set aside a pool of 100 IP addresses and let the VPN concentrator assign the IP addresses from the pool. You could use DHCP, but that brings another network device into the picture. Keep it simple.

5Split tunneling? Yes. The R&D group is going to need the Internet for research and the 56-kbps modems are going to be killers. Eliminate the need for encryption on trivial traffic to help this group out.

6Multiple IPSec groups? It would make sense to use multiple IPSec groups. Some of your users might not need split tunneling, and you could use different rules for access time, idle timeout, or maximum connect times. You might want to set up functional groups such as R&D, Sales, Engineering, Accounting, Execs, and so on. You are only constrained by the 100 combined users and groups limitation on the concentrator.

7IPSec protocol? ESP. AH is authentication only with no encryption. You would want to encrypt some of these data, especially for the R&D group.

8Encryption? Probably Triple-DES. You could choose DES, but the extra security does not cost that much more in performance.

Scenario 4-2 Answers 211

9Unlimited access? This would be a group-by-group decision. Does the R&D team work around the clock or just during business hours? Do you need to set aside a regular maintenance window for network upgrades? Do the execs need unlimited access?

10Idle timeout and maximum connect time? You probably want to drop connections after they have been idle for 20 to 30 minutes. There is no overpowering reason to establish limits on connect time. If you close the connection when it is idle, you should not have to worry about lengthy connections.

Scenario 4-2 Answers

1General tab settings for the DonutShops group:

•Access Hours—No Restrictions

•Simultaneous Logins—1, uncheck Inherit?

•Minimum Password Length—8

•Allow Alphabetic-Only Passwords—No, uncheck Inherit?

•Idle Timeout—30

•Maximum Connect Time—0

•Filter—None

•Primary DNS—192.168.44.20, uncheck Inherit?

•Secondary DNS—192.168.63.20, uncheck Inherit?

•Primary WINS—192.168.44.25, uncheck Inherit?

•Secondary WINS—192.168.63.25, uncheck Inherit?

•SEP Card Assignment—You can leave these checked. Without SEP modules, this attribute has no effect.

•Tunneling Protocols—Check only IPSec, uncheck Inherit?

•Strip Realm—Leave unchecked. You will be using an external authentication service, so this field has no effect.

2IPSec tab settings for the DonutShops group:

•IPSec SA—ESP-3DES-MD5

•IKE Peer Identity Validation—If supported by certificate

•IKE Keepalives—Enabled

•Reauthentication on Rekey—Enabled, uncheck Inherit?

212Chapter 4: Configuring Cisco VPN 3000 for Remote Access Using Preshared Keys

•Tunnel Type—Remote access

•Group Lock—Disabled

•Authentication—NT Domain, uncheck Inherit?

•IPComp—None

•Mode Configuration—Enabled

Exam Topics Discussed in This Chapter

This chapter covers the following topics, which you need to master in your pursuit of certification as a Cisco Certified Security Professional:

15CA support overview

16Certificate generation

17Validating certificates

18Configuring the Cisco VPN 3000 Concentrator Series for CA support

C H A P T E R 5

Configuring Cisco VPN 3000 for Remote Access Using Digital Certificates

Chapter 4, “Configuring Cisco VPN 3000 for Remote Access Using Preshared Keys,” discussed the opportunity of using preshared keys for device authentication between VPN peers, specifically between a remote access client and the VPN 3000 Concentrator. An IPSec group was defined on the VPN concentrator, and that group and its associated password were used as the preshared key for the VPN Client application.

While the process of using preshared keys is simple when using the Cisco VPN Concentrator and VPN Client, it is a process that does not scale well for large VPN applications. The Cisco application of preshared keys requires little work to implement initially. You just set up a group on the concentrator and supply the group name and password to your VPN user community. You could put everyone into one group to make it simple.

So where’s the problem of scale? It’s not with user authentication. The concentrator has finite limitations on the number of groups and users it can support for internal authentication. You will probably be using an external authentication service, and the per-user maintenance required for that does not change.

The official line is that as your user base grows, the number of passwords that you have to keep track of becomes unmanageable. But that’s not really so. Cisco makes keeping track of passwords simple. You do not have to keep track of a unique key for each user, just for a group. If you only have a handful of groups, then that is how many passwords you have to keep track of. It’s not a big problem.

The real problem of scale occurs because the passwords are compromised from time to time, and you have to change them. That is an easy task on the VPN concentrator, but you cannot change those passwords until you coordinate the change with all your users. These users might be using the Cisco VPN Client, but they are most likely also using a variety of operating systems. The logistics of changing device authentication passwords for a large user base would be difficult.

Security best practice says that you should be changing these passwords regularly, even if they are not compromised (in fact, that is one of the best ways to protect against compromised passwords). In this case, regularly means semiannually, quarterly, or better still, every

30 days.

What’s the alternative to preshared keys? That’s what this chapter is all about. The alternative to using preshared keys for device authentication is to use Certificate Authorities (CAs) and digital certificates.

“Do I Know This Already?” Quiz 217

“Do I Know This Already?” Quiz

The purpose of the “Do I Know This Already?” quiz is to help you decide what parts of the chapter to use. If you already intend to read the entire chapter, you do not need to answer these questions now.

This 16-question quiz helps you determine how to spend your limited study time. The quiz is sectioned into four smaller “quizlets,” which correspond to the four major topic headings in the chapter. Figure 5-1 outlines suggestions on how to spend your time in this chapter based on your quiz score. Use Table 5-1 to record your scores.

1What Public Key Cryptography Standard (PKCS) is used to enroll with a CA?

2What field in the certificate request should match the IPSec group name on the VPN concentrator?

3What elements make up the X.500 distinguished name?