Cisco Secure VPN Exam Certification Guide - Cisco press

474 Chapter 11: Scenarios

Site Descriptions

The following sections describe the characteristics of the VPN environment at the Detroit, Portland, Seattle, Memphis, and Richmond sites and for the two user types represented by Terry and Carol.

Detroit

Detroit is the central headquarters for Value-Packed Nutrition Corporation. All IPSec connections from branch offices and mobile users are through the Cisco VPN 3030 Concentrator in Detroit. VPN IPSec tunnels from remote sites and users all connect to the VPN 3030 Concentrator. A variety of corporate resources are available in Detroit’s private network, including DHCP, DNS, CA (SCEP support), and Windows 2000 Directory Services. An access server is available to support employees when they come to Detroit for business meetings. DHCP is to be used to assign all IPSec endpoint IP addresses, with unique address ranges being used for each location. Detroit’s private network IP addresses fall within the 172.16.0.0 subnet.

Portland

Portland’s four users connect to the network through a Cisco VPN 3002 Hardware Client equipped with an internal Ethernet 8-port switch. These users require numerous resources on the Internet as well as a local connection to a shared network printer. The VPN connection to Detroit is a remote access connection using digital signatures. Detroit has chosen to perform user authentication for the Portland office using the 3030’s internal authentication server. Set up the 3002 for Network Extension mode.

Seattle

Seattle is much like Portland, except that the users in Seattle do not use resources on the Internet. The users also require access to local LAN resources. The 3002 Hardware Client here also has an internal 8-port switch, but the remote access connection is authenticated using preshared keys. Seattle users are also authenticated using the 3030’s internal server. Set up the 3002 for Client Extension mode.

Memphis

The network at Memphis is more robust than that at Portland or Seattle. Users require use of the Internet and must be authenticated using NT Domain authentication. The VPN 3005 Concentrator at Memphis uses a LAN-to-LAN connection and is authenticated with digital certificates. Secure all traffic except HTTP traffic through the IPSec tunnel.

Scenario 11-1— The Basics 475

Richmond

Richmond is the same as Memphis, with the exception that the LAN-to-LAN connection’s authentication is through preshared keys.

Terry and Carol

Terry and Carol represent 30 salespeople that connect through a national ISP. These salespersons use the Cisco VPN Client, and a mixture of digital certificates and preshared keys is used for device authentication. User authentication for the preshared key users is through the 3030’s internal authentication server. Detroit is converting these users to digital certificates, Zone Labs’ ZoneAlarm Pro client firewall, and NT Domain authentication; to date, 20 users have been converted, including Terry. Original system users, such as Carol, are currently using the Cisco Integrated Client (CIC) firewall. Terry will use Are You There (AYT) firewall policy. Carol will use Central Protection Policy (CPP) firewall policy.

Use the information contained in the descriptions of the various locations and users to complete the requirements of the following scenarios.

Scenario 11-1—The Basics

Determine the additional information that you need to configure the systems based on the information provided in the following sections.

IKE Policy

Identify the parameters that you need to configure the IKE policy required for each site and user type. These parameters are as follows:

476 Chapter 11: Scenarios

IPSec Policy

Identify the parameters that you need to configure the IPSec policy required for each site and user type. These parameters are as follows:

•The IPSec protocol, which provides encryption

•128-bit hashing algorithm

•168-bit encryption

•SA to be established by IKE

•Identify the traffic to be protected for each site:

—Portland

—Seattle

—Memphis

—Richmond

—Terry

—Carol

•Select a unique IP address subnet for each site for DHCP address assignment:

—Portland

—Seattle

—Memphis

—Richmond

—Terry and other digital certificate users

—Carol and other preshared key users

Scenario 11-2—Portland

Configure the Detroit VPN 3030 Concentrator and the Portland VPN 3002 Hardware Client to support the Portland users.

Scenario 11-3—Seattle

Configure the Detroit VPN 3030 Concentrator and the Seattle VPN 3002 Hardware Client to support the Seattle users.

Scenario 11-4—Memphis

Configure the Detroit and Memphis VPN concentrators to support the Memphis users.