Foreword |
|
xv | |
Introduction |
|
xix | |
|
|
1 | (18) |
|
|
2 | (1) |
|
|
3 | (1) |
|
|
3 | (3) |
|
|
4 | (1) |
|
|
4 | (1) |
|
|
5 | (1) |
|
|
6 | (1) |
|
|
6 | (1) |
|
|
6 | (4) |
|
Network Security Considerations |
|
|
7 | (1) |
|
Services Offered versus Security Provided |
|
|
7 | (1) |
|
Ease of Use versus Security |
|
|
8 | (1) |
|
Cost of Security versus Risk of Loss |
|
|
8 | (1) |
|
The Need for Security Policies |
|
|
9 | (1) |
|
|
9 | (1) |
|
|
9 | (1) |
|
|
10 | (1) |
|
|
10 | (1) |
|
|
11 | (2) |
|
|
13 | (2) |
|
|
13 | (1) |
|
|
14 | (1) |
|
Enhanced Communication Security |
|
|
14 | (1) |
|
|
15 | (4) |
|
|
15 | (1) |
|
|
15 | (1) |
|
|
16 | (1) |
|
|
16 | (1) |
|
|
16 | (3) |
|
|
19 | (32) |
|
|
20 | (18) |
|
|
20 | (2) |
|
|
22 | (1) |
|
|
23 | (1) |
|
|
24 | (1) |
|
|
24 | (1) |
|
|
25 | (1) |
|
|
25 | (1) |
|
|
26 | (1) |
|
|
27 | (1) |
|
|
28 | (1) |
|
|
29 | (1) |
|
|
30 | (1) |
|
Transmission Control Protocol (TCP) |
|
|
30 | (1) |
|
|
31 | (1) |
|
|
31 | (1) |
|
User Datagram Protocol (UDP) |
|
|
31 | (1) |
|
|
31 | (1) |
|
|
32 | (1) |
|
Internet Control Message Protocol (ICMP) |
|
|
33 | (1) |
|
|
34 | (1) |
|
Non-routable IP Addresses |
|
|
34 | (1) |
|
Network Address Translation (NAT) |
|
|
35 | (3) |
|
|
38 | (1) |
|
|
39 | (8) |
|
Layer 2 Tunneling Protocol (L2TP) |
|
|
39 | (2) |
|
|
41 | (1) |
|
|
41 | (1) |
|
Aventail SSL VPN Solution |
|
|
42 | (5) |
|
|
47 | (4) |
|
|
48 | (1) |
|
|
48 | (1) |
|
|
48 | (1) |
|
|
48 | (1) |
|
Message Authentication Code |
|
|
48 | (1) |
|
Hash-Message Authentication Code |
|
|
48 | (3) |
|
|
51 | (10) |
|
|
52 | (1) |
|
|
52 | (1) |
|
|
53 | (4) |
|
|
54 | (1) |
|
|
54 | (1) |
|
|
55 | (1) |
|
Encapsulating Security Payload |
|
|
56 | (1) |
|
Shims and Virtual Adapters |
|
|
56 | (1) |
|
Operating Systems Support |
|
|
56 | (1) |
|
Operations within the Standard |
|
|
57 | (2) |
|
|
57 | (1) |
|
|
57 | (1) |
|
IPSec Communication Suite |
|
|
58 | (1) |
|
IKE and IPSec Relationship |
|
|
58 | (1) |
|
|
58 | (1) |
|
|
59 | (2) |
|
|
61 | (22) |
|
|
62 | (1) |
|
|
62 | (4) |
|
Typical Symmetrical Algorithms |
|
|
63 | (1) |
|
|
64 | (1) |
|
|
64 | (1) |
|
|
64 | (1) |
|
|
65 | (1) |
|
|
65 | (1) |
|
|
65 | (1) |
|
|
65 | (1) |
|
|
66 | (7) |
|
|
69 | (1) |
|
|
69 | (1) |
|
|
69 | (1) |
|
|
70 | (1) |
|
|
70 | (1) |
|
|
70 | (1) |
|
Certificate Revocation (CRL) |
|
|
71 | (1) |
|
|
71 | (1) |
|
|
71 | (1) |
|
Automatic Update of Certificates and Key Pairs |
|
|
71 | (1) |
|
|
72 | (1) |
|
|
72 | (1) |
|
Certificate Validation Process |
|
|
72 | (1) |
|
|
73 | (6) |
|
|
73 | (1) |
|
|
73 | (2) |
|
|
75 | (1) |
|
|
75 | (1) |
|
Message Authentication Code (MAC) |
|
|
76 | (1) |
|
Block Cipher-based Message Authentication |
|
|
76 | (1) |
|
Hash Function-based Message Authentication Code (HMAC) |
|
|
77 | (1) |
|
|
77 | (1) |
|
|
78 | (1) |
|
Application Considerations |
|
|
78 | (1) |
|
|
78 | (1) |
|
|
78 | (1) |
|
|
79 | (1) |
|
|
79 | (1) |
|
|
79 | (3) |
|
|
82 | (1) |
|
|
83 | (18) |
|
|
84 | (7) |
|
|
86 | (2) |
|
|
88 | (1) |
|
|
89 | (1) |
|
|
90 | (1) |
|
|
91 | (1) |
|
Current Remote Access Technology |
|
|
91 | (1) |
|
|
91 | (1) |
|
LAN Security Augmentation |
|
|
92 | (1) |
|
Performance Considerations |
|
|
93 | (5) |
|
|
94 | (2) |
|
|
96 | (1) |
|
|
96 | (1) |
|
Implemented versus Required |
|
|
97 | (1) |
|
Network Address Translation |
|
|
98 | (3) |
|
|
101 | (10) |
|
|
102 | (1) |
|
|
103 | (1) |
|
|
104 | (7) |
|
Remote User Authentication |
|
|
105 | (1) |
|
|
105 | (1) |
|
IPSec and Remote Authentication |
|
|
106 | (1) |
|
|
107 | (1) |
|
Password Authentication Protocol (PAP) |
|
|
107 | (1) |
|
Challenge Handshake Authentication Protocol (CHAP) |
|
|
108 | (1) |
|
|
109 | (1) |
|
|
109 | (2) |
|
|
111 | (38) |
|
|
112 | (9) |
|
IKE Security Associations |
|
|
112 | (1) |
|
IPSec Security Associations |
|
|
112 | (2) |
|
Security Parameter Index (SPI) |
|
|
114 | (1) |
|
Security Policy Database (SPD) |
|
|
114 | (1) |
|
|
115 | (1) |
|
Security Association Database |
|
|
116 | (1) |
|
|
117 | (1) |
|
|
117 | (2) |
|
|
119 | |
|
|
118 | (1) |
|
|
118 | (2) |
|
Availability versus Standards |
|
|
120 | (1) |
|
|
121 | (1) |
|
|
122 | (1) |
|
Remote Access, Routing, and Networks |
|
|
123 | (12) |
|
|
124 | (1) |
|
|
124 | (1) |
|
|
125 | (1) |
|
|
126 | (1) |
|
|
127 | (3) |
|
Acting As a Router versus a Bridge |
|
|
130 | (1) |
|
Finding Gateways with Maps |
|
|
130 | (3) |
|
|
133 | (2) |
|
Vendor Modes and Remote Access |
|
|
135 | (3) |
|
|
136 | (1) |
|
|
137 | (1) |
|
Hybrid Tunnel Realization |
|
|
138 | (2) |
|
|
138 | (1) |
|
|
138 | (1) |
|
|
139 | (1) |
|
Implementation Considerations of Tunnel Types |
|
|
140 | (1) |
|
|
141 | (3) |
|
|
144 | (1) |
|
|
144 | (3) |
|
|
147 | (2) |
|
|
148 | (1) |
|
|
149 | (10) |
|
Encapsulating Security PAYLOAD CESP) |
|
|
150 | (4) |
|
|
150 | (2) |
|
|
152 | (1) |
|
|
152 | (1) |
|
|
152 | (1) |
|
|
153 | (1) |
|
ESP Authentication and Replay Protection |
|
|
153 | (1) |
|
Changes from Previous RFC |
|
|
154 | (1) |
|
Authentication Header (AH) |
|
|
154 | (5) |
|
|
155 | (1) |
|
|
155 | (1) |
|
|
155 | (2) |
|
|
157 | (1) |
|
|
157 | (1) |
|
Changes from Previous RFC |
|
|
158 | (1) |
|
|
159 | (50) |
|
The Role of Key Management |
|
|
160 | (1) |
|
|
161 | (1) |
|
|
161 | (1) |
|
|
161 | (3) |
|
|
162 | (1) |
|
|
162 | (1) |
|
|
163 | (1) |
|
|
163 | (1) |
|
|
164 | (1) |
|
|
164 | (14) |
|
|
166 | (1) |
|
Security Association Payload |
|
|
166 | (1) |
|
|
166 | (3) |
|
|
169 | (1) |
|
|
170 | (1) |
|
|
170 | (1) |
|
Certificate Request Payload |
|
|
171 | (1) |
|
|
172 | (1) |
|
|
172 | (1) |
|
|
172 | (2) |
|
|
174 | (2) |
|
|
176 | (1) |
|
|
177 | (1) |
|
|
178 | (21) |
|
|
178 | (1) |
|
|
179 | (1) |
|
|
179 | (1) |
|
|
180 | (2) |
|
|
182 | (1) |
|
Digital Signatures with Certificates |
|
|
183 | (1) |
|
|
184 | (1) |
|
|
184 | (1) |
|
|
185 | (1) |
|
|
186 | (1) |
|
|
186 | (1) |
|
|
187 | (1) |
|
|
188 | (1) |
|
Revised Public Key Encryption |
|
|
188 | (1) |
|
|
189 | (1) |
|
|
190 | (1) |
|
|
191 | (1) |
|
|
191 | (1) |
|
|
192 | (1) |
|
|
193 | (1) |
|
|
193 | (1) |
|
Digital Signatures with Certificates |
|
|
194 | (1) |
|
|
194 | (1) |
|
|
194 | (1) |
|
|
194 | (1) |
|
|
195 | (1) |
|
|
195 | (1) |
|
Public Key Encryption Revised |
|
|
195 | (1) |
|
|
196 | (1) |
|
|
197 | (1) |
|
Digital Signature with Certificates |
|
|
197 | (1) |
|
Public Key Encryption and Revised Public Key Encryption |
|
|
198 | (1) |
|
|
199 | (6) |
|
|
199 | (1) |
|
|
200 | (2) |
|
|
202 | (1) |
|
|
202 | (2) |
|
Initialization Vectors (IVs) in Quick Mode |
|
|
204 | (1) |
|
|
205 | (4) |
|
|
205 | (1) |
|
|
206 | (3) |
|
|
209 | (18) |
|
|
210 | (3) |
|
Explanation of the R1 Configuration |
|
|
210 | (3) |
|
|
213 | (3) |
|
Explanation of the R2 Configuration |
|
|
213 | (3) |
|
|
216 | (11) |
|
|
216 | (11) |
|
Areas of Interest Within IKE |
|
|
227 | (14) |
|
Phase I with Shared Secret |
|
|
228 | (4) |
|
|
232 | (1) |
|
More on UDP 500 Limitations |
|
|
233 | (1) |
|
IKE, Algorithms, and the Creation of Keys |
|
|
234 | (1) |
|
Public Keys and Certificate Hashes |
|
|
235 | (1) |
|
Remote User Authentication Options |
|
|
236 | (5) |
|
|
236 | (5) |
|
Security Policies and the Security of VPNs |
|
|
241 | (10) |
|
Security of Dial-in versus Continuous Internet Access |
|
|
242 | (1) |
|
|
243 | (1) |
|
|
244 | (1) |
|
Common Operating System and Increased Vulnerabilities |
|
|
245 | (2) |
|
More Time on the Internet, More Time for Attackers |
|
|
245 | (1) |
|
Identification and Location |
|
|
246 | (1) |
|
Connected to the Internet and the VPN |
|
|
246 | (1) |
|
|
247 | (1) |
|
|
247 | (4) |
|
Implementation Considerations |
|
|
251 | (42) |
|
|
252 | (3) |
|
IPSec and L2TP Limitations |
|
|
253 | (2) |
|
|
255 | (1) |
|
|
255 | (1) |
|
IPSec Communication Policies |
|
|
256 | (17) |
|
IPSec Policy Implementation Requirements |
|
|
257 | (3) |
|
|
260 | (1) |
|
|
261 | (7) |
|
Advanced Configuration of MS VPN |
|
|
268 | (3) |
|
|
271 | (2) |
|
|
273 | (13) |
|
|
278 | (2) |
|
|
280 | (1) |
|
|
281 | (2) |
|
|
283 | (2) |
|
Current Status of Routing and VPNs |
|
|
285 | (1) |
|
|
286 | (2) |
|
|
286 | (1) |
|
|
287 | (1) |
|
|
287 | (1) |
|
Interoperability with Standard Applications |
|
|
288 | (1) |
|
|
288 | (5) |
|
Vendor-specific Considerations |
|
|
288 | (1) |
|
Product Interoperability Considerations |
|
|
289 | (1) |
|
|
290 | (1) |
|
|
290 | (1) |
|
|
290 | (3) |
|
|
293 | (14) |
|
|
294 | (8) |
|
|
295 | (1) |
|
|
295 | (1) |
|
Infrastructure Interactions |
|
|
296 | (1) |
|
General Functionality Areas |
|
|
296 | (1) |
|
|
296 | (1) |
|
|
297 | (1) |
|
Authentication Collateral |
|
|
297 | (1) |
|
|
298 | (1) |
|
|
299 | (1) |
|
|
299 | (1) |
|
|
299 | (1) |
|
|
300 | (1) |
|
|
300 | (1) |
|
Security of the Management Application |
|
|
300 | (1) |
|
|
300 | (1) |
|
|
301 | (1) |
|
|
301 | (1) |
|
|
302 | (4) |
|
|
303 | (1) |
|
|
303 | (1) |
|
Authentication Mechanisms |
|
|
304 | (1) |
|
|
304 | (1) |
|
|
304 | (1) |
|
|
304 | (1) |
|
|
305 | (1) |
|
|
305 | (1) |
|
|
306 | (1) |
|
|
306 | (1) |
|
|
307 | (16) |
|
|
308 | (15) |
Appendix |
|
323 | (12) |
|
|
323 | (7) |
|
|
323 | (7) |
|
|
330 | (5) |
|
Assigned Internet Protocol Numbers |
|
|
330 | (3) |
|
|
333 | (2) |
Index |
|
335 | |