Introducción a las Redes Virtuales

Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.Presentation_ID.scr 1

13051112_06F9_c2 © 1999, Cisco Systems, Inc. 13051112_06F9_c1 © 1999, Cisco Systems, Inc.

23051112_06F9_c2 © 1999, Cisco Systems, Inc.

Introduction toIntroduction to Virtual Private Networks Virtual Private Networks

Session 305Session 305



AgendaAgenda

• Scope of this Session

• Intro and History of VPNs

• VPN Technology Building Blocks

• Basic VPN Architectures

• Next Generation VPN Solutions


Scope of this SessionScope of this Session

• Provide a basic understanding of thecomponent technologies relevant to VPNs

• Show how these technologies fit togetherto provide today’s VPN solutions

• Speculate on some of the VPN advancesthat may come along in the near future

• For further info attend Dave Phillip’s Level2 Deploying VPN Solutions (Session 313)



What Is a VPN Service ?What Is a VPN Service ?

A “VPN service” is a service which offerssecure, reliable connectivity over a sharedpublic network infrastructure such as the

Internet. Because the infrastructure is“shared”, connectivity can be provided at

lower cost than existing dedicatedprivate networks


A VPN Analogy!A VPN Analogy!



Enterprise

FrameRelay

Service Provider

T1128 K

64 K

RemoteOffice

RegionalOffice

RemoteOffice

56 K

AAA

IP Network

GRETunnel

Traditional VPNsTraditional VPNs

DMZ

Web ServersDNS Server

STMP Mail Relay


What’s Driving VPN OfferingsWhat’s Driving VPN Offerings

ReducedNetworking

Costs

IncreasedNetwork

Flexibility



TunnelingTunneling

VPN Building BlocksVPN Building Blocks

SecuritySecurity QoSQoS

ManagementManagement ProvisioningProvisioning


Tunneling TypesTunneling Types

Compulsory or VoluntaryCompulsory or Voluntary

Layer 2/Layer 3Layer 2/Layer 3

TunnelingTunneling



Layer 2 vs. Layer 3Layer 2 vs. Layer 3

TunnelingTunneling

Tunneling ComparisonTunneling Comparison

Layer 3Layer 3

Layer 2Layer 2

IP Centric

Less Integrated Solutions

Solutions Still in Definition Stage

IP Centric

Less Integrated Solutions

Solutions Still in Definition Stage

Center on PPP

Multiprotocol

Integrated With Existing Access Technologies

Center on PPP

Multiprotocol

Integrated With Existing Access Technologies


PassengerProtocol

CarrierProtocol

TransportProtocol

Network PacketNetwork PacketGREGREIPIP

IP Network

GRE TunnelGRE Tunnel

Generic Route EncapsulationGeneric Route Encapsulation(GRE)(GRE)



LAC LNS

VPDNVPDN DATADATAPPPPPP VPDNVPDN DATADATA

Compulsory Tunnel ModelCompulsory Tunnel Model

• Client software wraps data in tunnelingprotocol then in transport protocol

• Transparent to LAC


Voluntary Tunnel ModelVoluntary Tunnel Model

• Generic PPP encapsulated datafrom any standard client

LAC LNS

DATADATAPPPPPP VPDNVPDN DATADATA



PPP TunnelingPPP Tunneling

TunnelingTunneling

L2TPL2TP PPTPPPTP PPPoEPPPoE


L2TPL2TP

TunnelingTunnelingLAC

LNS

• L2TP is an IETF draft movingtowards standards status

• Mostly used in voluntary mode

• Some third party clients available



• An informational RFC

• Primarily used in compulsory mode

• Widely available clientsWin95, Win98, NT, Third parties

Microsoft Point-to-PointMicrosoft Point-to-PointTunneling ProtocolTunneling Protocol

TunnelingTunnelingLAC

LNS


VIVI

ISP

Corporate

PPPTunneling

Routing, etc.

ATM PVC

PPP over Ethernet

DSL

DSLAMDSLCPE

LAC

Host 1

Host 2

PPP over EthernetPPP over Ethernet

Key Benefits• Preservation of Dial Model—

PPP session-basedcommunication

• Leverages existing Ethernetbased infrastructure

• Allows multiple PPP sessions to be initiated within home LAN

• Enables destination selection

• DSL Modem Independent (mustrun RFC 1483 Bridging)

Key Benefits• Preservation of Dial Model—

PPP session-basedcommunication

• Leverages existing Ethernetbased infrastructure

• Allows multiple PPP sessions to be initiated within home LAN

• Enables destination selection

• DSL Modem Independent (mustrun RFC 1483 Bridging)

Hosts Run PPPoE

Client SW

Runs RFC 1483 Bridge

ModeTunnelingTunneling

• Informational RFC

• Primarily used in xDSL environments

VIVI



VPN SecurityVPN Security

• IPSec

• MPPE

SecuritySecurity


IPSec Transport ModeIPSec Transport Mode

IP HDRIP HDRMay Be Encrypted

IP HDRIP HDR DataData

IPSec HDRIPSec HDR DataData

Router LEFT Router RIGHT

IP NetworkIPSec Transport ModeIPSec Transport Mode

SecuritySecurity



IP HDRIP HDR DataData

IPSec HDRIPSec HDR IP HDRIP HDRNew IP HDRNew IP HDR

May Be Encrypted

DataData

IPSec Tunnel ModeIPSec Tunnel Mode

SecuritySecurity

Router LEFT Router RIGHT

SP 1

SP 2

IPSec Tunnel ModeIPSec Tunnel Mode


Remote User w/IPSec Client

Home GatewayRouter

HomeNetwork

CertificateAuthority/AAA

Public Network

Dial Access to Corporate NetworkExchange X.509 or One-Time Password

IKE NegotiationAuthentication Approved

Encrypted Data flows

SecuritySecurity

IPSec VPN Client OperationIPSec VPN Client Operation

Secure Tunnel EstablishedSecure Tunnel Established



Microsoft Point-to-PointMicrosoft Point-to-PointEncryptionEncryption

• RC4 encryption of PPP packets

• Used almost exclusively with PPTP

• Informational RFC 2118

SecuritySecurity

LNS

PPTP TunnelPPTP Tunnel


VPNs and Quality of ServiceVPNs and Quality of Service

• Optimize use of the WAN link

• Guarantee bandwidth for missioncritical applications

• Take advantage of differentiatedservices offered by the ISP



VoicePremium IPBest Effort

Tunnel

Conforming TrafficConforming Traffic

VPNs and Quality of ServiceVPNs and Quality of Service

• ClassificationCAR

• ClassificationCAR

• PolicingCAR

• PolicingCAR

• Congestion• Avoidance

WRED

• Congestion• Avoidance

WRED

• TunnelLayer 2TPIPSec, GRE

• TunnelLayer 2TPIPSec, GRE

AAACA

PBX


Management and ProvisioningManagement and Provisioning

• Genericconfiguration

• AAA

• Policy management

• Certificateauthorities



ArchitecturesArchitectures

So, How Does It All Go Together ?So, How Does It All Go Together ?


CiscoIOS®

VPN ArchitecturesVPN Architectures



Type

AccessVPN

AccessVPN

Application

RemoteConnectivity

RemoteConnectivity

Alternative To

DedicatedDial

ISDN

DedicatedDial

ISDN

IntranetVPN

IntranetVPN

ExtranetVPN

ExtranetVPN

InternalCorporate

Connectivity

InternalCorporate

Connectivity

LeasedLines

LeasedLines

Business-toBusiness

ExternalConnectivity

Business-toBusiness

ExternalConnectivity

Fax, Mail,EDI

Fax, Mail,EDI

Ubiquitous Access

Lower Cost

Ubiquitous Access

Lower Cost

Benefits

Extend ConnectivityLower Cost

Extend ConnectivityLower Cost

Facilitates E-Commerce

Facilitates E-Commerce

VPN ArchitecturesVPN Architecturesand Applicationsand Applications


Enterprise

DMZ


STMP Mail Relay

AAACA

Service Provider A

SmallOffice

Mobile Useror Corporate

Telecommuter

UbiquitousAccess

• Modem, ISDN• Xdsl, Cable

PotentialOperations

andInfrastructure Cost Savings

Compulsory or Voluntary Tunneling

Solutions

Access VPNsAccess VPNs



Enterprise

DMZ


STMP Mail Relay

AAACA

RemoteOffice

Service Provider A

RegionalOffice

Potential Operations and Infrastructure

Cost Savings

Extends the Corporate IP Network across a

Shared WAN

The Intranet VPNThe Intranet VPN


Enterprise

DMZ


STMP Mail Relay

AAACA

Extends ConnectivityTo Business Partners,

Suppliers and Customers Security PolicyVery Important

BusinessPartner

Service Provider B

Supplier

The Extranet VPNThe Extranet VPN

Service Provider A



The Complete VPNThe Complete VPN

Enterprise

DMZ


STMP Mail Relay

AAACA

SupplierBusinessPartner

RemoteOffice

Service Provider A

Service Provider B

RegionalOffice

SmallOffice

Mobile UserOr Corporate

Telecommuter


Service ProviderFocused

EnterpriseFocusedCollaborative

Service ProviderSupplies Majority of

VPN SolutionEquipment

ServiceTraining

Help Desk

EnterpriseManages Security

Services

Service Provider Supplies Hardware

Qos to Bandwidth Offering

Service ProviderSupplies Basic

NetworkAccess

Deployment AlternativesDeployment Alternatives

EnterpriseApplication and Configuration

ManagementHelp Desk Support

EnterpriseSupplies VPN

EquipmentManages Network



Next Generation VPNsNext Generation VPNs

• Multiservice VPNs

• MPLS VPNs“Next generationnetworks must allowthe corporation tothrive on change…”

The Burton Group

“Next generationnetworks must allowthe corporation tothrive on change…”

The Burton Group


Internet

London

Australia

BrazilBrazil

LiveAudio/Video

Feed

Tokyo

StoredVideo

StoredVideo

Multiservice VPNsMultiservice VPNs



Enterprise

DMZDMZ

Web ServersDNS ServerSTMP Mail Relay

AAACA

RemoteOffice

Service Provider A

RegionalOffice Remote

Office

Mobile UserOr Corporate

Telecommuter

PBX

Multiservice VPNsMultiservice VPNs


MPLS VPNsMPLS VPNs

MplsNetwork

MplsNetwork

Corp ASite 1

Corp ASite 2

Corp ASite 3

Corp BSite 2

Corp BSite 1

Corp BSite 3

Corporate A MPLS VPNCorporate A MPLS VPN

Corporate B MPLS VPNCorporate B MPLS VPN

Traffic SeparationBy Interface

ScalableIETF Standards Based

VPN MembershipBased on Interface

And Unique RD



ScalabilityScalability

Standards BasedStandards BasedPlatformsPlatforms

QoSQoS SecuritySecurity Mgmt.Mgmt.

Future FlexibilityFuture Flexibility

CoreCore Services

Services

SummarySummary


Cisco VPNSolutions

IPSec

MPPE

http://www.cisco.com/warp/public/779/largeent/learn/technologies/vpn/

http://www.cisco.com/warp/public/779/servpro/solutions/vpn/

http://www.cisco.com/warp/public/cc/cisco/mkt/security/encryp/tech/ipsec_wp.htm

http://search.ietf.org/internet-drafts/draft-ietf-pppext-mppe-03.txt

L2TP http://search.ietf.org/internet-drafts/draft-ietf-pppext-l2tp-15.txt

Location

PPTP http://search.ietf.org/internet-drafts/draft-ietf-pppext-pptp-10.txt

Other Useful InformationOther Useful Information



Q & AQ & A



Thank YouThank You




Please Complete YourPlease Complete YourEvaluation FormEvaluation Form

Session 305Session 305



Documents

Introducción a las Redes Virtuales