Virtual Private Networks & Interfaces Flashcards
Typical VPN technologies used in Site-to-Site VPNs
1) Individual point-to-point VPN - 2 sites interconnect using a secure VPN path
2) Hub-and-spoke - One central site is considered a hub, and all other sites (spokes) peer exclusively with the central site devices
3) Fully meshed - Every device is connected to every other network device
4) Partial Mesh - A network in which some devices are organized in a full mesh topology, and other devices form either a hub-and-spoke or a point-to-point connection to some of the fully meshed devices.
5) Tiered hub-and-spoke - A network of hub-and-spoke topologies in which a device can behave as a hub in one or more topologies and a spoke in other topologies. Traffic is permitted from spoke groups to their most immediate hub.
6) Joined hub-and-spoke - A combination of two topologies (hub-and-spoke, point-to-point, or full mesh) that connect to form a point-to-point tunnel. For example, a joined hub-and-spoke topology could comprise two hub-and-spoke topologies, with the hubs acting as peer devices in a point-to-point topology.
Site-to-Site VPN Bullet Points
Connect sites as a replacement for a classic WAN
Use peer (site) authentication and cryptographic path protection
Require basic network traffic controls
Frequently use IPsec for its cryptographic security services
Often work over controlled networks (MPLS) or internet backbones
Often require high availability and performance guarantees (QoS)
Can be configured to function in several different ways
Dynamic Multipoint VPN (DMVPN)
enables site-to-site VPNs without a permanent VPN connection between sites and can dynamically create IP Security (IPsec) tunnels
FlexVPN
uses the capabilities of the Internet Key Exchange version 2 (IKEv2)
IPsec
- designed to provide interoperable, high-quality, and cryptographically based transmission security to IP traffic
- Defined in RFC 4301 and combines the protocols IKE/IKEv2, Authentication Header (AH), and Encapsulation Security Payload (ESP) into a cohesive security framework
- offers access control, connectionless integrity, data origin authentication, protection against replays, confidentiality, and limited traffic flow confidentiality
- For transport mode, new headers are placed after the IP header and before the Layer 4 protocol (typically TCP or UDP)
- For tunnel mode, a new IP header is created in place of the original; this allows for the encryption of the entire original packet.
- The new headers provide information for securing the payload of the IP packet. Note that all IPsec VPNs use tunnel mode by default.
IKE/IKEv2
- Provides a framework for policy negotiation and key management
- IKE provides key management to IPsec.
- hybrid protocol that is defined by RFC 2408
- uses parts of several other protocols (Internet Security Association and Key Management Protocol (ISAKMP), Oakley, and Skeme) to automatically establish a shared security policy and authenticated keys for services that require keys, such as IPsec
Authentication Header (AH)
Provides an encapsulation for authenitication traffic
- Mostly obsolete - AH is not supported on the Cisco ASA security appliance.
- AH defines a user traffic encapsulation that provides data integrity, data origin authentication, and protection against replay to user traffic. There is no encryption provided by AH.
Encapsulation Security Payload (ESP)
Provides an encapsulation for encryption and authentication of user traffic
- ESP defines a user traffic encapsulation that provides data integrity, data origin authentication, protection against replays, and confidentiality to user traffic. ESP offers data encryption, and is preferred over AH.
Security Associations (SA)
defines the following parameters:
Algorithms Keys Traffic Other parameters - If AH or ESP protection is applied to a traffic stream, two (or more) security associations are created to provide protection to the traffic stream - To secure typical, bidirectional communication between two hosts or between two security gateways, two security associations (one in each direction) are required.
Reasons to implement IKE in IPsec
Scalability
Manageable manual configuration Security association characteristics negotiation Automatic key generation Automatic key refresh
IPsec Modes
1) Transport mode: Encrypts only the data portion (payload) of each packet and leaves the packet header untouched. Transport mode is applicable to either gateway or host implementations, and provides protection for upper layer protocols and selected IP header fields.
2) Tunnel mode: More secure than transport mode because it encrypts both the payload and the header. IPsec in tunnel mode is normally used when the ultimate destination of a packet is different than the security termination point. This mode is also used in cases when the security is provided by a device that did not originate packets, as in the case of VPNs. Tunnel mode is often used in networks with unregistered IP addresses. The unregistered address can be tunneled from one gateway encryption device to another by hiding the unregistered addresses in the tunneled packet.
ISAKMP Policy Contents
An authentication method, to ensure the identity of the peers.
An encryption method, to protect the data and ensure privacy. A Hashed Message Authentication Code (HMAC) method to ensure the identity of the sender, and to ensure that the message has not been modified in transit. A Diffie-Hellman (DH) group to determine the strength of the encryption-key-determination algorithm. The security appliance uses this algorithm to derive the encryption and hash keys. A limit to the time the security appliance uses an encryption key before replacing it.
IPsec VPN Types
1) virtual tunnel interfaces (VTIs)
2) Dynamic Multipoint VPNs (DMVPNs)
3) Cisco IOS FlexVPN
Cisco IPsec VTI
a tool that customers can use to configure IPsec-based VPNs between site-to-site devices.
- A major benefit of IPsec VTIs is that the configuration does not require a static mapping of IPsec sessions to a physical interface. The IPsec tunnel endpoint is associated with a virtual interface. Because there is a routable interface at the tunnel endpoint, you can apply many common interface capabilities to the IPsec tunnel.
- It requires fewer configuration lines because crypto maps are automatically generated for each tunnel. Features for plaintext packets are configured on the VTI
- features for encrypted packets are applied on the physical, outside interface.
They behave as regular tunnels, one for each remote site of the VPN.
Their encapsulation must be either IPsec Encapsulating Security Payload (ESP) or Authentication Header (AH). Their line protocol depends on the state of the VPN tunnel (IPsec Security Associations [SAs]).
DMVPN Benefits
Lowers capital and operational expenses: Reduces costs in integrating voice and video with VPN security.
Simplifies branch communications: Enables direct branch-to-branch connectivity for business applications such as voice. Reduces deployment complexity: Offers a zero-touch configuration, dramatically reducing the deployment complexity in VPNs. Improves business resiliency: Prevents disruption of business-critical applications and services by incorporating routing with standards-based IPsec technology.
