Cisco Secure VPN Exam Certification Guide - Cisco press

58 Chapter 2: Overview of VPN and IPSec Technologies

Step 2 Establish an IPSec policy—The IPSec security and authentication capabilities are applied to certain traffic that passes between peers. You can choose to send all traffic between peers through the IPSec tunnel, but there is a significant performance penalty when using IPSec, so you should be selective in its application. However you choose to implement the IPSec tunnel, both ends of the tunnel must implement identical IPSec policies. Careful planning and documentation can simplify this process. You need the following information for your IPSec policy:

— IPSec protocol—AH or ESP

— Authentication—MD5 or SHA-1

— Encryption—DES or 3DES

— Transform or transform set—ah-sha-hmac esp-3des esp-md5-hmac or one of the other allowable combinations

— Identify traffic to be protected—Protocol, source, destination, and port

— SA establishment—Manual or IKE

Step 3 Examine the current configuration—Avoid issues with conflicting configuration parameters by checking existing IPSec settings on your device.

Step 4 Test the network before IPSec—Can you ping the peers that are going to participate in IPSec with your device? If not, you must fix that before you go any further.

Step 5 Permit IPSec ports and protocols—If you have enabled ACLs on any

Establishing VPNs with IPSec 59

You can think of the IPSec process as the following five-step process:

Step 1 Interesting traffic initiates the setup of an IPSec tunnel.

Step 2 IKE Phase 1 authenticates peers and establishes a secure tunnel for IPSec negotiation.

Step 3 IKE Phase 2 completes the IPSec negotiations and establishes the IPSec tunnel.

Step 4 Once the tunnel has been established, secured VPN communications occur.

Step 5 When there is no more traffic to use IPSec, the tunnel is torn down, either explicitly or through timeout of the SA lifetimes.

The following sections examine these five processes in more detail.

Step 1: Interesting Traffic Triggers IPSec Process

As previously stated, you have absolute control over the traffic that gets processed by IPSec. You might want certain traffic between peers authenticated only, for example, for mail or intranet traffic. You might want to encrypt client/server traffic that interacts with your financial server. Maybe you want to encrypt everything going from peer A to peer B.

Whatever your security policy dictates is mirrored in access lists. Peers must contain the same access lists, and you can have multiple access lists for different purposes between peers. These ACLs are called crypto ACLs because of their application. They are simply extended IP access lists, but they work slightly differently because the permit and deny keywords have a different purpose for crypto ACLs. Figure 2-12 shows the effect of permit and deny statements on source and destination peers.

The permit and deny keywords have different functions on the source and destination devices. The following list describes those functions:

•permit at the source peer—Passes the traffic to IPSec for authentication, encryption, or both. IPSec modifies the packet by inserting an AH or ESP header and possibly encrypting some of or all of the original packet and then places it on the wire to the destination.

•deny at the source peer—Bypasses IPSec and puts the clear-text packet on the wire to the destination.

•permit at the destination peer—Passes the traffic to IPSec for authentication, decryption, or both. The ACL uses the information in the header to make its decision. In ACL logic, if the header contains the correct source, destination, and protocol, the packet must have been processed by IPSec at the sender and must now be processed by IPSec at the receiver.

•deny at the destination peer—Bypasses IPSec and assumes that the traffic has been sent in the clear.

64 Chapter 2: Overview of VPN and IPSec Technologies

Table 2-11 Protocols Used with IPSec (Continued)

Creating VPNs with IPSec 65

Table 2-11 Protocols Used with IPSec (Continued)

IPSec Preconfiguration Processes

Most projects go much easier if you spend some careful planning time before you begin. The same is true for implementing IPSec security. Take the following steps before you begin the task of configuring IPSec on your Cisco devices:

Step 1 Establish an IKE policy.

Step 2 Establish an IPSec policy.

Step 3 Examine the current configuration.

Step 4 Test the network before IPSec.

Step 5 Permit IPSec ports and protocols.

Creating VPNs with IPSec

After you configure your Cisco devices for IPSec, the setup and termination of IPSec happens automatically. The following steps are involved in that process:

Step 1 Interesting traffic triggers IPSec process.

Step 2 Authenticate peers and establish IKE SAs (IKE Phase 1).

Step 3 Establish IPSec SAs (IKE Phase 2).

Step 4 Allow secured communications.

Step 5 Terminate VPN.

66 Chapter 2: Overview of VPN and IPSec Technologies

Chapter Glossary

The following terms were introduced in this chapter or have special significance to the topics within this chapter.

antireplay A security service where the receiver can reject old or duplicate packets to protect itself against replay attacks. IPSec provides this optional service by use of a sequence number combined with the use of data authentication.

Cisco Unified Client Framework A consistent connection, policy, and key management method across Cisco routers, security appliances, and VPN Clients.

data authentication Process of verifying that data have not been altered during transit (data integrity), or that the data came from the claimed originator (data origin authentication).

data confidentiality A security service where the protected data cannot be observed.

data flow A grouping of traffic, identified by a combination of source address/mask, destination address/mask, IP next protocol field, and source and destination ports, where the protocol and port fields can have the values of any. In effect, all traffic matching a specific combination of these values is logically grouped together into a data flow. A data flow can represent a single TCP connection between two hosts, or it can represent all the traffic between two subnets. IPSec protection is applied to data flows.

Elliptic Curve Cryptography (ECC) A public-key encryption technique based on elliptic curve theory that can be used to create faster, smaller, and more efficient cryptographic keys. ECC generates keys through the properties of the elliptic curve equation instead of using the traditional method of generation as the product of large prime numbers. The technology can be used in conjunction with most public-key encryption methods, such as RSA and Diffie-Hellman.

peer In the context of this document, a router, firewall, VPN concentrator, or other device that participates in IPSec.

Perfect Forward Secrecy (PFS) A cryptographic characteristic associated with a derived shared secret value. With PFS, if one key is compromised, previous and subsequent keys are not compromised, because subsequent keys are not derived from previous keys.

Scalable Encryption Processing (SEP) Cisco VPN 3000 Series Concentrator modules that enable users to easily add capacity and throughput.

Security Association (SA) An IPSec security association (SA) is a description of how two or more entities use security services in the context of a particular security protocol (AH or ESP) to communicate securely on behalf of a particular data flow. It includes things such as the transform and the shared secret keys to be used for protecting the traffic.

Chapter Glossary 67

Security Parameters Index (SPI) This is a number that, together with an IP address and security protocol, uniquely identifies a particular security association. When using IKE to establish the security associations, the SPI for each security association is a pseudo-randomly derived number. Without IKE, the SPI is manually specified for each security association.

transform A transform lists a security protocol (AH or ESP) with its corresponding algorithms. For example, one transform is the AH protocol with the HMAC-MD5 authentication algorithm; another transform is the ESP protocol with the 56-bit DES encryption algorithm and the HMAC-SHA authentication algorithm.

tunnel In the context of this document, a secure communication path between two peers, such as two routers. It does not refer to using IPSec in Tunnel mode.