Upload
denda-sandika
View
41
Download
1
Embed Size (px)
Citation preview
1
IPSec - VPN
2
What is VPN? VPN (Virtual Private Network) :
“Logical connections on public networks.”
Two type VPN Connections:–Layer 2 VPN: Asynchronous transfer mode (ATM) and Frame Relay –Layer 3 VPN: Generic Route Encapsulation (GRE), Layer 2 Tunneling Protocol (L2TP,
Multiprotocol Label Switching (MPLS), and IP Security (IPSec)
3
Applications of IPSec IPSec provides the capability to secure
communications across a LAN, across private and public WANs, and across the Internet. Examples of its use include:
Secure branch office connectivity over the Internet Secure remote access over the Internet
4
Application of IPSec
5
Benefits of IPSec
The benefits of IPSec include: –Strong security that can be applied to all traffic crossing the perimeter.
–Transparent to applications.
–No need to change software on a user or server system
•When IPSec is implemented in a router or firewall
–IPSec can be transparent to end users.
–There is no need to train users on security mechanisms
–IPSec can provide security for individual
6
The Scope of IPSec
IPSec provides three main facilities–An authentication-only function,
•Referred to as Authentication Header (AH)
–A combined authentication/ encryption function
•Called Encapsulating Security Payload (ESP)
–A key exchange function.
•IKE (ISAKMP / Oakley)
7
Basic IPsec Example
Internet10.1.1.0/24
10.1.2.0/24
• IKE Policy (Phase I)crypto isakmp policy 1
authentication pre-shared
hash sha
encryption 3des
crypto isakmp key cisco123isabadkey address 2.2.2.2
crypto isakmp key passwordisiabadkey address 3.3.3.3
1.1.1.1
2.2.2.2
10.1.3.0/243.3.3.3
8
Basic IPsec Example
• IPsec Policy (Phase II) crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
access-list 102 permit ip 10.1.1.0 0.0.0.255 10.1.2.0 0.0.0.255
access-list 103 permit ip 10.1.1.0 0.0.0.255 10.1.3.0 0.0.0.255
Internet10.1.1.0/24
10.1.2.0/241.1.1.1
2.2.2.2
10.1.3.0/243.3.3.3
9
Basic IPsec Example
• IPsec Policy (Phase II) crypto map IPSEC 20 ipsec-isakmp
set peer 2.2.2.2
match address 102
set transform-set ESP-3DES-SHA
crypto map IPSEC 30 ipsec-isakmp
set peer 3.3.3.3
match address 103
set transform-set ESP-3DES-SHA
Internet10.1.1.0/24
10.1.2.0/241.1.1.1
2.2.2.2
10.1.3.0/243.3.3.3
10
Basic IPsec Example
• Apply Crypto Map interface serial 0
crypto map IPSEC
!
ip route 10.0.0.0 255.0.0.0 serial 0
Internet10.1.1.0/24
10.1.2.0/241.1.1.1
2.2.2.2
10.1.3.0/243.3.3.3
11
Frame Relay Communication
12
Terminology The connection through the Frame Relay network between two DTEs
is called a virtual circuit (VC).
Virtual circuits may be established dynamically by sending signaling messages to the network. In this case they are called switched virtual circuits (SVCs).
Virtual circuits can be configured manually through the network. In this case they are called permanent virtual circuits (PVCs).
13
Frame Relay Concepts
14
Frame Relay Operation
15
Frame Relay ConceptsQueue
16
Frame Relay Switches
17
Frame Relay Functions
18
Virtual Circuits
19
Local Significance of DLCIsThe data-link connection identifier (DLCI) is stored in the Address field of every frame transmitted.
20
Star (Hub and Spoke)
Full Mesh
Partial Mesh
Selecting a Frame Relay Topology
21
Local Management Interface (LMI)
Three types of LMIs are supported by Cisco routers:–Cisco — The original LMI extensions –Ansi — Corresponding to the ANSI standard T1.617 Annex D –q933a — Corresponding to the ITU standard Q933 Annex A
22
Configuring Basic Frame Relay
23
Configuring a Static Frame Relay Map
24
Configuring Point-to-Point Subinterfaces
25
The show interface Command
LMI Type
LMI DLCI
LMI Status
26
The show frame-relay lmi Command
27
The show frame-relay pvc Command
28
The show frame-relay map Command
29
Troubleshooting Frame Relay The debug frame-relay lmi Command
PVC Status0x2 – Active0x0 – Inactive0x4 – Deleted
30