Introduction |
|
xvii | |
Part I Introductory Concepts and Configuration/Troubleshooting |
|
3 | (202) |
|
Chapter 1 Introduction to VPN Technologies |
|
|
5 | (30) |
|
VPN Overview of Common Terms |
|
|
5 | (1) |
|
Characteristics of an Effective VPN |
|
|
6 | (3) |
|
|
9 | (16) |
|
Virtual Private Dialup Networks |
|
|
10 | (8) |
|
Layer 2 Forwarding Protocol |
|
|
10 | (2) |
|
Point-to-Point Tunneling Protocol |
|
|
12 | (4) |
|
Layer 2 Tunneling Protocol |
|
|
16 | (2) |
|
Multiprotocol Label Switching VPNs |
|
|
18 | (2) |
|
|
20 | (1) |
|
|
21 | (4) |
|
|
21 | (4) |
|
Transport Layer Security and SSL VPNs |
|
|
25 | (1) |
|
|
25 | (4) |
|
|
25 | (3) |
|
|
28 | (1) |
|
SSL in RAVPN Architectures |
|
|
28 | (1) |
|
Business Drivers for VPNs |
|
|
29 | (2) |
|
Remote Access VPN Business DriversA Practical Example |
|
|
30 | (1) |
|
Site-to-Site VPN Business DriversA Practical Example |
|
|
30 | (1) |
|
IPsec VPNs and the Cisco Security Framework |
|
|
31 | (1) |
|
|
32 | (3) |
|
Chapter 2 IPsec Fundamentals |
|
|
35 | (70) |
|
Overview of Cryptographic Components |
|
|
35 | (11) |
|
|
36 | (3) |
|
|
39 | (3) |
|
Message Authentication, Message Integrity, and Sender Non repudiation Mechanisms |
|
|
42 | (4) |
|
Hashing and Message Digests |
|
|
42 | (2) |
|
|
44 | (2) |
|
Public Key Encryption Methods |
|
|
46 | (5) |
|
RSA Public-Key Technologies |
|
|
48 | (3) |
|
|
48 | (2) |
|
|
50 | (1) |
|
Diffie-Hellman Key Exchange |
|
|
51 | (1) |
|
The IP Security Protocol (IPsec) |
|
|
51 | (27) |
|
|
52 | (3) |
|
|
52 | (2) |
|
|
54 | (1) |
|
|
55 | (4) |
|
|
57 | (1) |
|
IP Payload Compression Protocol (IPPCP) and LZS |
|
|
58 | (1) |
|
|
59 | (4) |
|
IPsec Configuration Elements |
|
|
63 | (5) |
|
Creating an IPsec Transform |
|
|
63 | (3) |
|
|
66 | (2) |
|
|
68 | (9) |
|
The Need for Security Association and Key Management |
|
|
77 | (1) |
|
|
78 | (22) |
|
IKE and ISAKMP Terminology and Background |
|
|
78 | (1) |
|
IKE SA Negotiation and Maintenance |
|
|
79 | (1) |
|
IPsec Diffie-Hellman Shared Secret Key Generation Using IKE |
|
|
79 | (4) |
|
IKE Authentication Services |
|
|
83 | (4) |
|
|
83 | (2) |
|
RSA Encryption (Encrypted Nonces) |
|
|
85 | (1) |
|
RSA Signatures and X.509 Certificates |
|
|
86 | (1) |
|
|
87 | (3) |
|
|
88 | (1) |
|
|
89 | (1) |
|
|
90 | (4) |
|
|
90 | (1) |
|
|
91 | (1) |
|
Dead Peer Detection and IKE Keepalives |
|
|
92 | (2) |
|
|
94 | (2) |
|
IKE with RAVPN Extensions |
|
|
96 | (11) |
|
|
96 | (2) |
|
|
98 | (2) |
|
|
100 | (5) |
|
Chapter 3 Basic IPsec VPN Topologies and Configurations |
|
|
105 | (36) |
|
Site-to-Site IPsec VPN Deployments |
|
|
107 | (14) |
|
Site-to-Site VPN Architectural Overview for a Dedicated Circuit |
|
|
107 | (10) |
|
Cisco IOS Site-to-Site IPsec VPN Configuration |
|
|
108 | (3) |
|
Verifying Cisco LOS Site-to-Site IPsec VPN Operation |
|
|
111 | (6) |
|
Site-to-Site Architectural Overview over a Routed Domain |
|
|
117 | (4) |
|
Site-to-Site IPsec VPN Deployments and GRE (IPsec+GRE) |
|
|
121 | (7) |
|
Site-to-Site IPsec+ GRE Architectural Overview |
|
|
121 | (2) |
|
Increased Packet Size and Path MTU Considerations |
|
|
122 | (1) |
|
GRE and Weighted Fair Queuing |
|
|
122 | (1) |
|
QoS and the IPsec Anti-Replay Window |
|
|
122 | (1) |
|
Site-to-Site IPsec +GRP: Sample Configurations |
|
|
123 | (5) |
|
Cisco IOS Site-to-Site IPsec+GRE Configuration |
|
|
123 | (3) |
|
Verification of IPsec+GRE Tunnel Establishment |
|
|
126 | (2) |
|
Hub-and-Spoke IPsec VPN Deployments |
|
|
128 | (4) |
|
Hub-and-Spoke Architectural Overview |
|
|
129 | (1) |
|
Standard Hub-and-Spoke Design without High Availability |
|
|
129 | (1) |
|
Clustered Spoke Design to Redundant Hubs |
|
|
130 | (1) |
|
Redundant Clustered Spoke Design to Redundant Hubs |
|
|
131 | (1) |
|
Remote Access VPN Deployments |
|
|
132 | (6) |
|
RAVPN Architectural Overview |
|
|
132 | (1) |
|
|
132 | (1) |
|
Standalone VPN Concentrator Designs |
|
|
133 | (4) |
|
VPN Concentrator on Outside Network with Single DMZ |
|
|
133 | (1) |
|
VPN Concentrator and Firewall in Parallel |
|
|
134 | (1) |
|
VPN Concentrator with Dual DMZs to Firewall |
|
|
135 | (1) |
|
What to Avoid in DMZ/VPN Concentrator Topologies |
|
|
136 | (1) |
|
Clustered VPN Concentrator Designs |
|
|
137 | (1) |
|
|
138 | (3) |
|
Chapter 4 Common IPsec VPN Issues |
|
|
141 | (64) |
|
IPsec Diagnostic Tools within Cisco IOS |
|
|
141 | (1) |
|
Common Configuration Issues with IPsec VPNs |
|
|
142 | (29) |
|
IKE SA Proposal Mismatches |
|
|
142 | (4) |
|
IKE Authentication Failures and Errors |
|
|
146 | (19) |
|
IKE Authentication Errors and PSKs |
|
|
146 | (5) |
|
IKE Authentication Errors with RSA Encryption |
|
|
151 | (7) |
|
IKE Authentication Errors with RSA Signatures |
|
|
158 | (7) |
|
IPsec SA Proposal Mismatches |
|
|
165 | (4) |
|
Crypto-Protected Address Space Issues (Crypto ACL Errors) |
|
|
169 | (2) |
|
Architectural and Design Issues with IPsec VPNs |
|
|
171 | (29) |
|
Troubleshooting IPsec VPNs in Firewalled Environments |
|
|
171 | (3) |
|
Allowing the Required IPsec Protocols to Pass |
|
|
171 | (2) |
|
Firewall's Handling of Fragmented IPsec Packets |
|
|
173 | (1) |
|
Filtering of ICMP Unreachables |
|
|
174 | (1) |
|
NAT Issues in IPsec VPN Designs |
|
|
174 | (6) |
|
Intrinsic IPsec/NAT Incompatibilities |
|
|
175 | (3) |
|
IPsec NAT Transparency (NAT-T) |
|
|
178 | (1) |
|
|
179 | (1) |
|
The Influence of IPsec on Traffic Flows Requiring QoS |
|
|
180 | (3) |
|
IPsec's Influence on DiffSery and LLQ/CBWFQ |
|
|
181 | (2) |
|
IPsec's Effect on IntSery and RSVP |
|
|
183 | (1) |
|
Solving Fragmentation Issues in IPsec VPNs |
|
|
183 | (14) |
|
|
184 | (5) |
|
Fragmentation Behavior on Cisco IOS VPN Endpoints |
|
|
189 | (4) |
|
Solutions for Preventing Fragmentation |
|
|
193 | (4) |
|
The Effect of Recursive Routing on IPsec VPNs |
|
|
197 | (3) |
|
|
200 | (5) |
Part II Designing VPN Architectures |
|
205 | (184) |
|
Chapter 5 Designing for High Availability |
|
|
207 | (28) |
|
Network and Path Redundancy |
|
|
208 | (2) |
|
IPSec Tunnel Termination Redundancy |
|
|
210 | (5) |
|
Multiple Physical Interface HA with Highly Available Tunnel Termination Interfaces |
|
|
210 | (1) |
|
Tunnel Termination HA Using HSRP/VRRP Virtual Interfaces |
|
|
211 | (1) |
|
HA with Multiple Peer Statements |
|
|
212 | (2) |
|
|
214 | (1) |
|
Managing Peer and Path Availability |
|
|
215 | (4) |
|
|
216 | (2) |
|
|
218 | (1) |
|
|
219 | (3) |
|
Load Balancing, Load Sharing, and High Availability |
|
|
222 | (10) |
|
Load-Sharing with Peer Statements |
|
|
222 | (2) |
|
|
224 | (1) |
|
|
225 | (2) |
|
Cisco VPN3000 Concentrator Clustering |
|
|
227 | (3) |
|
IPSec Session Load-Balancing Using External Load Balancers |
|
|
230 | (2) |
|
|
232 | (3) |
|
Chapter 6 Solutions for Local Site-to-Site High Availability |
|
|
235 | (32) |
|
Using Multiple Crypto Interfaces for High Availability |
|
|
235 | (7) |
|
Impact of Routing Protocol Reconvergence on IPsec Reconvergence |
|
|
238 | (2) |
|
Impact of Stale SAs on IPsec Reconvergence |
|
|
240 | (1) |
|
Impact of IPsec and ISAKMP SA Renegotiation on IPsec Reconvergence |
|
|
241 | (1) |
|
Stateless IPsec VPN High-Availability Alternatives |
|
|
242 | (15) |
|
Solution Overview for Stateless IPsec High Availability |
|
|
242 | (4) |
|
Hot Standby Routing Protocol |
|
|
244 | (1) |
|
|
245 | (1) |
|
Stateless High Availability Failover Process |
|
|
246 | (11) |
|
Step 1: Initial IPsec VPN Tunnel Establishment |
|
|
247 | (4) |
|
Step 2: Pre-HSRP RRI Execution |
|
|
251 | (3) |
|
Step 3: Active Router Failure |
|
|
254 | (1) |
|
Step 4: HSRP Reconvergence |
|
|
254 | (1) |
|
Step 5: IPsec Reconvergence |
|
|
255 | (2) |
|
Step 6: Post-HSRP RRI Execution |
|
|
257 | (1) |
|
Stateful IPsec VPN High- Availability Alternatives |
|
|
257 | (6) |
|
Solution Overview for Stateful IPsec High Availability |
|
|
258 | (3) |
|
|
259 | (1) |
|
Stateful Switchover (SSO) and IPsec High Availability |
|
|
259 | (2) |
|
Stateful High Availability Failure, Process |
|
|
261 | (2) |
|
Step 1: Initial IPsec VPN Tunnel Establishment |
|
|
261 | (1) |
|
Step 2: SADB Synchronization with SSO |
|
|
261 | (1) |
|
Step 3: Pre-HSRP Failover RRI Execution |
|
|
262 | (1) |
|
Step 4: Active Router Failure |
|
|
262 | (1) |
|
Step 5: HSRP Reconvergence |
|
|
262 | (1) |
|
Step 6: IPsec Reconvergence |
|
|
262 | (1) |
|
Step 7: Post-HSRP RRI Execution |
|
|
263 | (1) |
|
|
263 | (4) |
|
Stateless IPsec VPN High Availability Design Summary |
|
|
263 | (2) |
|
Stateful IPsec VPN High Availability Design Summary |
|
|
265 | (2) |
|
Chapter 7 Solutions for Geographic Site-to-Site High Availability |
|
|
267 | (30) |
|
Geographic IPsec VPN HA with Reverse Route Injection and Multiple IPsec Peers |
|
|
267 | (11) |
|
Solution Overview for RRI with Multiple IPsec Peers |
|
|
267 | (11) |
|
Geographic IPsec VPN High Availability with IPsec+GRE and Encrypted Routing Protocols |
|
|
278 | (9) |
|
Solution Overview for IPsec+GRE with Encrypted Routing Protocols |
|
|
279 | (8) |
|
Dynamic Multipoint Virtual Private Networks |
|
|
287 | (8) |
|
DMVPN Solution Design Drivers |
|
|
288 | (1) |
|
DMVPN Component-Level Overview and System Operation |
|
|
289 | (6) |
|
|
295 | (2) |
|
Chapter 8 Handling Vendor Interoperability with High Availability |
|
|
297 | (16) |
|
Vendor Interoperability Impact on Peer Availability |
|
|
297 | (4) |
|
The Inability to Specify Multiple Peers |
|
|
297 | (3) |
|
Lack of Peer Availability Mechanisms |
|
|
300 | (1) |
|
Vendor Interoperability Impact on Path Availability |
|
|
301 | (5) |
|
IPSec HA Design Considerations for Platforms with Limited Routing Protocol Support |
|
|
302 | (2) |
|
IPSec HA Design Considerations for Lack of RRI Support |
|
|
304 | (1) |
|
IPSec HA Design Considerations for Lack of Generic Routing Encapsulation (GRE) Support |
|
|
305 | (1) |
|
Vendor Interoperability Design Considerations and Options |
|
|
306 | (5) |
|
Phase 1 and 2 SA Lifetime Expiry |
|
|
307 | (1) |
|
SADB Management with Quick Mode Delete Notify Messages |
|
|
307 | (1) |
|
Invalid Security Parameter Index Recovery |
|
|
308 | (1) |
|
Vendor Interoperability with Stateful IPSec HA |
|
|
309 | (2) |
|
|
311 | (2) |
|
Chapter 9 Solutions for Remote-Access VPN High Availability |
|
|
313 | (46) |
|
IPsec RAVPN Concentrator High Availahility Virtual Interfaces for Tunnel Termination |
|
|
314 | (19) |
|
IPsec RAVPN Concentrator High Availability Using VRRP |
|
|
315 | (12) |
|
IPsec RAVPN Concentrator HA Using HSRP |
|
|
327 | (6) |
|
IPsec RAVPN Concentrator HA Using the VCA Protocol |
|
|
333 | (9) |
|
IPsec RAVPN Geographic HA Design Options |
|
|
342 | (13) |
|
VPN Concentrator Session Load Balancing Using DNS |
|
|
343 | (2) |
|
VPN Concentrator Redundancy Using Multiple Peers |
|
|
345 | (10) |
|
|
355 | (4) |
|
Chapter 10 Further Architectural Options for IPsec |
|
|
359 | (30) |
|
IPsec VPN Termination On-a-Stick |
|
|
359 | (9) |
|
IPsec with Router-on-a-Stick Design Overview |
|
|
359 | (3) |
|
Single, Flatly Addressed L3 Domain |
|
|
360 | (1) |
|
Lack of In-Path Design Options |
|
|
361 | (1) |
|
Single Interface to the Bridged LAN |
|
|
361 | (1) |
|
Crypto-Enabled Loopback Interface |
|
|
361 | (1) |
|
Case Study: Small Branch IPsec VPN Tunnel Termination with NAT On-a-Stick |
|
|
362 | (6) |
|
In-Path Versus Out-of-Path Encryption with IPsec |
|
|
368 | (11) |
|
Out-of-Path Encryption Design Overview |
|
|
370 | (1) |
|
Case Study: Firewalled Site-to-Site IPsec VPN Tunnel Termination |
|
|
370 | (9) |
|
Separate Termination of IPsec and GRE (GRE-Offload) |
|
|
379 | (7) |
|
GRE-Offload Design Overview |
|
|
379 | (3) |
|
Lack of Support for GRE Processing |
|
|
380 | (1) |
|
|
380 | (2) |
|
Case Study: Large-Scale IPsec VPN Tunnel Termination with GRE Offload |
|
|
382 | (1) |
|
Dynamic Crypto Maps and GRE-Offload |
|
|
383 | (1) |
|
IKE Extended Authentication (X-Auth) |
|
|
384 | (1) |
|
Firewalled Cleartext Traffic |
|
|
385 | (1) |
|
High-Speed GRE Tunnel Termination for GRE-Offload |
|
|
385 | (1) |
|
|
386 | (3) |
Part III Advanced Topics |
|
389 | (60) |
|
Chapter 11 Public Key Infrastructure and IPsec VPNs |
|
|
391 | (26) |
|
|
391 | (3) |
|
|
394 | (3) |
|
|
394 | (1) |
|
|
395 | (1) |
|
Certificate Revocation Lists and CRL Issuers |
|
|
396 | (1) |
|
|
397 | (1) |
|
PKI Cryptographic Endpoints |
|
|
397 | (1) |
|
Life of a Public Key Cell Certificate |
|
|
397 | (7) |
|
RSA Signatures and X.509v3 Certificates |
|
|
397 | (5) |
|
Generating Asymmetric Keypairs on Cryptographic Endpoints |
|
|
402 | (1) |
|
Registration and Endpoint Authentication |
|
|
402 | (1) |
|
Receipt and Authentication of the CA's Certificate |
|
|
403 | (1) |
|
Forwarding and Signing of Public Keys |
|
|
403 | (1) |
|
Obtaining and Using Public Key Certificates |
|
|
403 | (1) |
|
PKI and the IPSec Protocol SuiteWhere PKI Fits into the IPSec model |
|
|
404 | (1) |
|
|
404 | (1) |
|
|
405 | (1) |
|
Case Studies and Sample Configurations |
|
|
405 | (9) |
|
Case Study 1: PKI Integration of Cryptographic Endpoints |
|
|
407 | (3) |
|
Case Study 2: PKI with CA and RA |
|
|
410 | (2) |
|
Case Study 3: PKI with Redundant CAs (CA Hierarchy) |
|
|
412 | (2) |
|
|
414 | (3) |
|
Chapter 12 Solutions for Handling Dynamically Addressed Peers |
|
|
417 | (32) |
|
|
417 | (13) |
|
Dynamic Crypto Map Impact on VPN Behavior |
|
|
418 | (7) |
|
Dynamic Crypto Map Impact on ISAKMP/IKE |
|
|
418 | (1) |
|
Routing Considerations with Dynamic Crypto Maps |
|
|
419 | (2) |
|
Security Considerations for Dynamic Crypto Maps |
|
|
421 | (4) |
|
Dynamic Crypto Map Configuration and Verification |
|
|
425 | (5) |
|
Tunnel Endpoint Discovery |
|
|
430 | (2) |
|
TED Configuration and Verification |
|
|
432 | (1) |
|
Case StudyUsing Dynamic Addressing with Low-Maintenance Small Home Office Deployments |
|
|
432 | (14) |
|
|
446 | (3) |
Appendix A Resources |
|
449 | (3) |
|
|
449 | (1) |
|
|
449 | (1) |
|
|
450 | (2) |
Index |
|
452 | |