CCNA Security 1.1 Instructional Resource

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "CCNA Security 1.1 Instructional Resource"

Transcription

1 CCNA Security 1.1 Instructional Resource Chapter 8 Implementing Virtual Private Networks 2012 Cisco and/or its affiliates. All rights reserved. 1

2 Describe the purpose and types of VPNs and define where to use VPNs in a network. Describe how to configure a GRE VPN tunnel. Describe the fundamental concepts and technologies of VPNs, and terms that IPsec VPNs use. Describe how to configure a site-to-site IPsec VPN. Configure a site-to-site IPsec VPN with PSK authentication using CLI and Cisco CCP. Describe the two common remote network access methods used in enterprise networks. Describe how the Cisco VPN Client is used in an IPsec remote-access VPN. Describe how Secure Socket Layer (SSL) is used in a remote-access VPN. Configure a remote-access IPsec VPN using CLI and Cisco CCP Cisco and/or its affiliates. All rights reserved. 2

3 9.0 Implementing VPN Technologies 9.2 Describe VPN technologies IPsec SSL 9.3 Describe the building blocks of IPsec IKE ESP AH Tunnel mode Transport mode 9.4 Implement an IOS IPSec site-to-site VPN with pre-shared key authentication CCP CLI 2012 Cisco and/or its affiliates. All rights reserved. 3

4 A VPN is a private network that is created via tunneling over a public network. It can deployed as a site-to-site and remote access VPN. Generic routing encapsulation (GRE) is a tunneling protocol that is used to create a point-to-point link, supports multiprotocol tunneling, and can be used in combination with IPsec. IPsec is a framework of open standards that establishes the rules for secure communications. It relies on existing algorithms to achieve encryption, authentication, and key exchange. When creating a site-to-site VPN, ensure that the existing ACLs do not block IPsec traffic, define the IKE parameters and IPsec transform set, configure the crypto ACL and create and apply a crypto map. Use the CCP Quick Setup VPN wizard or the Step-by-Step wizard to create and monitor an IPsec VPN. Remote access connections can be configured using CCP Cisco and/or its affiliates. All rights reserved. 4

5 Chapter 8 Lab A: Configuring a Site-to-Site VPN Using Cisco IOS and CCP Part 1: Basic Router Configuration Part 2: Configure a Site-to-Site VPN Using Cisco IOS Part 3: Configure a Site-to-Site VPN using CCP Chapter 8 Lab B: Configuring a Remote Access VPN Server and Client Part 1: Basic Router Configuration Part 2: Configuring a Remote Access VPN Chapter 8 Lab C: (Optional) Configuring a Remote Access VPN Server and Client Part 1: Basic Router Configuration Part 2: Configuring a Remote Access VPN 2012 Cisco and/or its affiliates. All rights reserved. 5

6 VPN IPsec SSL GRE ATM PVC MPLS POTS ISDN Virtual Private Network IP Security protocol provides a framework for configuring secure VPNs. Secure Sockets Layer (SSL) uses TCP port 443 (HTTPS) Generic routing encapsulation (GRE) is a tunneling protocol that is used to create a point-to-point link, supports multiprotocol tunneling, and can be used in combination with IPsec. Asynchronous Transfer Mode standard for cell relay in which multiple service types are converted to 53 byte cells. Permanent Virtual Circuit Multiprotocol Label Switching Plain old telephone service Integrated Services Digital Network 2012 Cisco and/or its affiliates. All rights reserved. 6

7 DMVPN V3PN HSRP NHRP Cisco VPN Client Cisco AnyConnect AIM SPA Dynamic Multipoint VPN enables the auto-provisioning of siteto-site IPsec VPNs, combining three Cisco IOS software features: NHRP, multipoint GRE, and IPsec VPN. Voice and Video Enabled VPN Hot Standby Routing Protocol Next Hop Resolution Protocol is used by routers to dynamically discover the MAC address of other routers connected to an NBMA network. Installed locally on host to establish a secure IPsec end-to-end VPN. Installed locally on host (or smart device) to establish a secure SSL or IPsec end-to-end VPN. Advanced integration modules Shared Port Adapter provides VPN support on Catalyst 6500 switches and higher end routers. VAM2+ VPN Accelerator Module Cisco and/or its affiliates. All rights reserved. 7

8 PSK ESP AH DES 3DES AES SEAL HMAC Pre-shared keys Encapsulation Security Payload (IP protocol 50) can provide authentication, integrity, and confidentiality using encryption. Authentication Header (IP protocol 51) provides authentication and integrity but it does not provide data confidentiality (encryption) of packets. Data Encryption Standard Triple Data Encryption Standard Advanced Encryption Standard Software-Optimized Encryption Algorithm Hashed Message Authentication Codes (HMAC) is a data integrity algorithm that guarantees the integrity of the message using a hash value Cisco and/or its affiliates. All rights reserved. 8

9 HMAC-MD5 HMAC-SHA-1 RSA DH Tunnel Mode Transport Mode SA HMAC-Message Digest 5 uses a 128-bit shared-secret key. The variable-length message and 128-bit shared secret key are combined and run through the HMAC-MD5 hash algorithm. The output is a 128-bit hash. HMAC-Secure Hash Algorithm 1 uses a 160-bit secret key. The variable-length message and the 160-bit shared secret key are combined and run through the HMAC-SHA-1 hash algorithm. The output is a 160-bit hash. Rivest, Shamir, and Adleman (RSA) algorithm Diffie-Hellman key agreement is a public key exchange method that provides a way for two peers to establish a shared secret key that only they know, even though they are communicating over an insecure channel. ESP tunnel mode is used between a host and a security gateway or between two security gateways. ESP transport mode is used between hosts. Transport mode works well with GRE, because GRE hides the addresses of the end devices by adding its own IP. Security Associations 2012 Cisco and/or its affiliates. All rights reserved. 9

10 IKE ISAKMP Oakley and Skeme IKE Phase 1 IKE Phase 2 Internet Key Exchange protocol (RFC 2409) is used by IPsec to establish the initial key exchange. IKE uses UDP port 500 to exchange IKE information between the security gateways. IKE is a hybrid protocol, combining ISAKMP and the Oakley and Skeme key exchange methods. Internet Security Association and Key Management Protocol defines the message format, the mechanics of a keyexchange protocol, and the negotiation process to build an SA for IPsec. ISAKMP does not define how keys are managed or shared between the two IPsec peers. Key exchange methods that have five defined key groups. Of these groups, Cisco routers support Group 1 (768-bit key), Group 2 (1024-bit key), and Group 5 (1536-bit key). Two IPsec peers perform the initial negotiation of SAs. The basic purpose of Phase 1 is to negotiate IKE policy sets, authenticate the peers, and set up a secure channel between the peers. It can be implemented in main mode or agressive mode. SAs are negotiated by the IKE process ISAKMP on behalf of IPsec and is referred to as quick mode Cisco and/or its affiliates. All rights reserved. 10

11 Main mode Aggressive mode Quick mode QM_IDLE RRI IKE Phase 1 SA negotiation that requires three exchanges using six packets. IKE Phase 1 SA negotiation that requires one exchange using three packets. IKE Phase 2 SA negotiation that negotiate IPsec security parameters, establishes IPsec SAs, and periodically renegotiates IPsec SAs. Displayed in the output of the show crypto isakmp sa command and indicates an active IKE SA. Reverse Route Injection ensures that a static route is created on the Cisco Easy VPN Server for the internal IP address of each VPN client Cisco and/or its affiliates. All rights reserved. 11

12 SDM has been replaced by CCP Cisco and/or its affiliates. All rights reserved. 12

13 To explain GRE use the concept of three protocols: Passenger protocol (i.e., IPv4 or IPv6) that needs to be encapsulated. Carrier protocol (i.e., GRE) that is used to encapsulate the passenger protocol. Transport protocol (i.e., IPv4 or IPv6) that is used to carry the encapsulated carrier protocol. GRE is popular to use to support routing protocols (that require broadcasts) over an IPsec VPN Cisco and/or its affiliates. All rights reserved. 13

14 Example GRE configuration 2012 Cisco and/or its affiliates. All rights reserved. 14

15 To configure IPsec VPNs, the IOS must support crypto parameters. Usually indicated by k9 in the image name. ( k8 indicates limited crypto commands available) 2012 Cisco and/or its affiliates. All rights reserved. 15

16 Use the show crypto isakmp sa command to verify if the IKE Phase 1 negotiation was successful. QM_IDLE indicates success. Use the debug crypto isakmp command to display Phase 1 and 2 negotiations Cisco and/or its affiliates. All rights reserved. 16

17 To verify IPsec VPN tunnel functionality, use the sequence: 1. clear crypto sa 2. Generate interesting traffic to trigger VPN link 3. show crypto ipsec sa NOTE: The output of the show crypto ipsec sa command should reveal encrypted / decrypted packets. Use extended pings to generate traffic between LANs ping {destination-ip-address} source {source-ip-address} NOTE: The first ping attempt should fail as it negotiates the initial SA. Use the debug crypto ipsec command to display Main mode negotiations Cisco and/or its affiliates. All rights reserved. 17

18 Common problems encountered when troubleshooting VPNs include: Incorrect ISAKMP policies configured. Incorrect crypto keys or peer address configured. Crypto map parameters not configured accurately. Crypto map not applied to the correct interface (should usually be the outside interface). Invalid ACL statements. If pings from the router do not enable the VPN: Make sure you are using extended pings or better yet, use an actual host on the inside network Cisco and/or its affiliates. All rights reserved. 18

19 CCP provides various VPN wizards by choosing Configure > Security > VPN. The wizards vary depending on the type of VPN being configured. You can also test to confirm the correct tunnel configuration by clicking the Test VPN button. Verify the VPN status by choosing Monitor > Security > VPN Status > IPsec Tunnels Cisco and/or its affiliates. All rights reserved. 19

20 Remote access VPNs can be deployed using either IPsec or SSL VPNs. IPsec remote access VPNs are more secure and supports most applications but requires a client to be pre-installed on a host such as the Cisco VPN client or Cisco AnyConnect. SSL remote access VPNs is more flexible as it is accessed using a web browser but can only access web enabled applications Cisco and/or its affiliates. All rights reserved. 20

21 Mobile User Requirements SSL-Based VPN Anywhere Access Any Application IPsec Remote Access VPN Categories SSL IPsec Application support Web-enabled applications, file sharing, All IP-based applications Encryption Authentication Moderate Key lengths from 40 bits to 128 bits Moderate One-way or two-way authentication Stronger Key lengths from 56 bits to 256 bits Strong Two-way authentication using shared secrets or digital certificates Ease of Use Very easy Moderately easy Overall Security Moderate Any device can connect Strong Only specific devices with specific configurations can connect 2012 Cisco and/or its affiliates. All rights reserved. 21

22 You will need to download the Cisco VPN client from cisco.com and provide it to students. Cisco VPN client is available for free Cisco and/or its affiliates. All rights reserved. 22

23 Explain to students that this chapter now applies the cryptology topics discussed in Chapter 7. To contrast between the function of a firewall (Chapter 4) and that of a VPN, explain that a firewall inside the network and a VPN protects the data traversing the outside network (Internet) Cisco and/or its affiliates. All rights reserved. 23

24 Use the analogy of a ocean for the network and each LAN is an island. Without VPN tunnels, you must travel using a ferry between islands which means there is no privacy. With VPN tunnels, you have your own private submarine to go from island to island. Leased lines can be compared to building bridges between nearby islands Cisco and/or its affiliates. All rights reserved. 24

25 Another analogy is that of two lovers sending mushy letters to each other. They know that letters will pass through many hands, including the postal service, organization, and perhaps even parents at either end. By setting up a secret code in advance, they can send letters without someone knowing what they re sending Cisco and/or its affiliates. All rights reserved. 25

26 Refer back in history to how encryption has been used: The Spartans with the Scytale Julius Caesar for military dispatches. Enigma machine during WWII. Contrast that with how freely information now flows. Encourage discussion on how important VPNs are becoming. Ask Should we be encrypting everything we send?. Consider the overhead (and increased latency) if we did. When should we be using VPNs? 2012 Cisco and/or its affiliates. All rights reserved. 26

27 This chapter is best learned by applying the concepts as much as possible. Student must get their own battle scars. Encourage students to come up with their own VPN topology scenarios Cisco and/or its affiliates. All rights reserved. 27

28 Cisco VPN Main page Cisco IOS Software Releases 12.4 Mainline ome.html The Cisco IOS Command Reference html VPN client Cisco and/or its affiliates. All rights reserved. 28

29 2011 Cisco and/or its affiliates. All rights reserved. 29

Lab 4.4.8a Configure a Cisco GRE over IPSec Tunnel using SDM

Lab 4.4.8a Configure a Cisco GRE over IPSec Tunnel using SDM Lab 4.4.8a Configure a Cisco GRE over IPSec Tunnel using SDM Objective Scenario Topology In this lab, the students will complete the following tasks: Prepare to configure Virtual Private Network (VPN)

More information

Introduction to Security and PIX Firewall

Introduction to Security and PIX Firewall Introduction to Security and PIX Firewall Agenda Dag 28 Föreläsning LAB PIX Firewall VPN A Virtual Private Network (VPN) is a service offering secure, reliable connectivity over a shared, public network

More information

Cisco Site-to-Site VPN Lab 3 / GRE over IPSec VPNs by Michael T. Durham

Cisco Site-to-Site VPN Lab 3 / GRE over IPSec VPNs by Michael T. Durham Cisco Site-to-Site VPN Lab 3 / GRE over IPSec VPNs by Michael T. Durham In part two of NetCertLabs Cisco CCNA Security VPN lab series, we explored setting up a site-to-site VPN connection where one side

More information

Licenses are not interchangeable between the ISRs and NGX Series ISRs.

Licenses are not interchangeable between the ISRs and NGX Series ISRs. Q&A Cisco IOS SSL VPN Q. What is Cisco IOS SSL VPN or SSL VPN? A. Secure Sockets Layer (SSL)-based VPN is an emerging technology that provides remote-access connectivity from almost any Internet-enabled

More information

APNIC elearning: IPSec Basics. Contact: training@apnic.net. esec03_v1.0

APNIC elearning: IPSec Basics. Contact: training@apnic.net. esec03_v1.0 APNIC elearning: IPSec Basics Contact: training@apnic.net esec03_v1.0 Overview Virtual Private Networks What is IPsec? Benefits of IPsec Tunnel and Transport Mode IPsec Architecture Security Associations

More information

Cisco 3745. Cisco 3845 X X X X X X X X X X X X X X X X X X

Cisco 3745. Cisco 3845 X X X X X X X X X X X X X X X X X X Data Sheet Virtual Private Network (VPN) Advanced Integration Module (AIM) for the 1841 Integrated Services Router and 2800 and 3800 Series Integrated Services Routers The VPN Advanced Integration Module

More information

Objectives. Remote Connection Options. Teleworking. Connecting Teleworkers to the Corporate WAN. Providing Teleworker Services

Objectives. Remote Connection Options. Teleworking. Connecting Teleworkers to the Corporate WAN. Providing Teleworker Services ITE I Chapter 6 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Objectives Providing Teleworker Services Describe the enterprise requirements for providing teleworker services Explain how

More information

Integrated Services Router with the "AIM-VPN/SSL" Module

Integrated Services Router with the AIM-VPN/SSL Module Virtual Private Network (VPN) Advanced Integration Module (AIM) for the 1841 Integrated Services Router and 2800 and 3800 Series Integrated Services Routers The VPN Advanced Integration Module (AIM) for

More information

Integrated Services Router with the "AIM-VPN/SSL" Module

Integrated Services Router with the AIM-VPN/SSL Module Virtual Private Network (VPN) Advanced Integration Module (AIM) for the 1841 Integrated Services Router and 2800 and 3800 Series Integrated Services Routers The VPN Advanced Integration Module (AIM) for

More information

BUY ONLINE AT: http://www.itgovernance.co.uk/products/730

BUY ONLINE AT: http://www.itgovernance.co.uk/products/730 IPSEC VPN DESIGN Introduction Chapter 1: Introduction to VPNs Motivations for Deploying a VPN VPN Technologies Layer 2 VPNs Layer 3 VPNs Remote Access VPNs Chapter 2: IPSec Overview Encryption Terminology

More information

IP Security. Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49

IP Security. Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49 IP Security Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49 1 Internetworking and Internet Protocols (Appendix 6A) IP Security Overview IP Security

More information

Lab14.8.1 Configure a PIX Firewall VPN

Lab14.8.1 Configure a PIX Firewall VPN Lab14.8.1 Configure a PIX Firewall VPN Complete the following lab exercise to practice what you learned in this chapter. Objectives In this lab exercise you will complete the following tasks: Visual Objective

More information

Branch Office VPN Tunnels and Mobile VPN

Branch Office VPN Tunnels and Mobile VPN WatchGuard Certified Training Branch Office VPN Tunnels and Mobile VPN Fireware XTM and WatchGuard System Manager v11.7 Revised: January 2013 Updated for: Fireware XTM v11.7 Notice to Users Information

More information

Cisco Dynamic Multipoint VPN: Simple and Secure Branch-to-Branch Communications

Cisco Dynamic Multipoint VPN: Simple and Secure Branch-to-Branch Communications Cisco Dynamic Multipoint VPN: Simple and Secure Branch-to-Branch Communications Product Overview Cisco Dynamic Multipoint VPN (DMVPN) is a Cisco IOS Software-based security solution for building scalable

More information

Virtual Private Network VPN IPSec Testing: Functionality Interoperability and Performance

Virtual Private Network VPN IPSec Testing: Functionality Interoperability and Performance Virtual Private Network VPN IPSec Testing: Functionality Interoperability and Performance Johnnie Chen Project Manager of Network Security Group Network Benchmarking Lab Network Benchmarking Laboratory

More information

ACADEMIA LOCAL CISCO UCV-MARACAY CONTENIDO DE CURSO CURRICULUM CCNA. SEGURIDAD CCNA SECURITY. VERSION 1.0

ACADEMIA LOCAL CISCO UCV-MARACAY CONTENIDO DE CURSO CURRICULUM CCNA. SEGURIDAD CCNA SECURITY. VERSION 1.0 ACADEMIA LOCAL CISCO UCV-MARACAY CONTENIDO DE CURSO CURRICULUM CCNA. SEGURIDAD CCNA SECURITY. VERSION 1.0 Module 1: Vulnerabilities, Threats, and Attacks 1.1 Fundamental Principles of a Secure Network

More information

TABLE OF CONTENTS NETWORK SECURITY 2...1

TABLE OF CONTENTS NETWORK SECURITY 2...1 Network Security 2 This document is the exclusive property of Cisco Systems, Inc. Permission is granted to print and copy this document for non-commercial distribution and exclusive use by instructors

More information

VPN Modules for Cisco 1841 and Cisco 2800 and 3800 Series Integrated Services Routers

VPN Modules for Cisco 1841 and Cisco 2800 and 3800 Series Integrated Services Routers Q&A VPN Modules for Cisco 1841 and Cisco 2800 and 3800 Series Integrated Services Routers OVERVIEW Q. What is a VPN? A. A VPN, or virtual private network, delivers the benefits of private network security,

More information

640-816: Interconnecting Cisco Networking Devices Part 2 v1.1

640-816: Interconnecting Cisco Networking Devices Part 2 v1.1 640-816: Interconnecting Cisco Networking Devices Part 2 v1.1 Course Introduction Course Introduction Chapter 01 - Small Network Implementation Introducing the Review Lab Cisco IOS User Interface Functions

More information

Lecture 17 - Network Security

Lecture 17 - Network Security Lecture 17 - Network Security CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ Idea Why donʼt we just integrate some of these neat

More information

The BANDIT Products in Virtual Private Networks

The BANDIT Products in Virtual Private Networks encor! enetworks TM Version A.1, March 2010 2010 Encore Networks, Inc. All rights reserved. The BANDIT Products in Virtual Private Networks One of the principal features of the BANDIT products is their

More information

(d-5273) CCIE Security v3.0 Written Exam Topics

(d-5273) CCIE Security v3.0 Written Exam Topics (d-5273) CCIE Security v3.0 Written Exam Topics CCIE Security v3.0 Written Exam Topics The topic areas listed are general guidelines for the type of content that is likely to appear on the exam. Please

More information

Configuring a Site-to-Site VPN Tunnel Between Cisco RV320 Gigabit Dual WAN VPN Router and Cisco (1900/2900/3900) Series Integrated Services Router

Configuring a Site-to-Site VPN Tunnel Between Cisco RV320 Gigabit Dual WAN VPN Router and Cisco (1900/2900/3900) Series Integrated Services Router print email Article ID: 4938 Configuring a Site-to-Site VPN Tunnel Between Cisco RV320 Gigabit Dual WAN VPN Router and Cisco (1900/2900/3900) Series Integrated Services Router Objective Virtual Private

More information

Configuration Guide. How to set up the IPSec site-to-site Tunnel between the D-Link DSR Router and the Cisco Firewall. Overview

Configuration Guide. How to set up the IPSec site-to-site Tunnel between the D-Link DSR Router and the Cisco Firewall. Overview Configuration Guide How to set up the IPSec site-to-site Tunnel between the D-Link DSR Router and the Cisco Firewall Overview This document describes how to implement IPSec with pre-shared secrets establishing

More information

Implementing Secured Converged Wide Area Networks (ISCW) Version 1.0

Implementing Secured Converged Wide Area Networks (ISCW) Version 1.0 COURSE OVERVIEW Implementing Secure Converged Wide Area Networks (ISCW) v1.0 is an advanced instructor-led course that introduces techniques and features that enable or enhance WAN and remote access solutions.

More information

Cisco Easy VPN on Cisco IOS Software-Based Routers

Cisco Easy VPN on Cisco IOS Software-Based Routers Cisco Easy VPN on Cisco IOS Software-Based Routers Cisco Easy VPN Solution Overview The Cisco Easy VPN solution (Figure 1) offers flexibility, scalability, and ease of use for site-to-site and remoteaccess

More information

Other VPNs TLS/SSL, PPTP, L2TP. Advanced Computer Networks SS2005 Jürgen Häuselhofer

Other VPNs TLS/SSL, PPTP, L2TP. Advanced Computer Networks SS2005 Jürgen Häuselhofer Other VPNs TLS/SSL, PPTP, L2TP Advanced Computer Networks SS2005 Jürgen Häuselhofer Overview Introduction to VPNs Why using VPNs What are VPNs VPN technologies... TLS/SSL Layer 2 VPNs (PPTP, L2TP, L2TP/IPSec)

More information

Configuration Professional: Site to Site IPsec VPN Between Two IOS Routers Configuration Example

Configuration Professional: Site to Site IPsec VPN Between Two IOS Routers Configuration Example Configuration Professional: Site to Site IPsec VPN Between Two IOS Routers Configuration Example Document ID: 113337 Contents Introduction Prerequisites Requirements Components Used Conventions Configuration

More information

Netopia 3346. TheGreenBow IPSec VPN Client. Configuration Guide. http://www.thegreenbow.com. support@thegreenbow.com

Netopia 3346. TheGreenBow IPSec VPN Client. Configuration Guide. http://www.thegreenbow.com. support@thegreenbow.com TheGreenBow IPSec VPN Client Configuration Guide Netopia 3346 WebSite: Contact: http://www.thegreenbow.com support@thegreenbow.com IPSec VPN Router Configuration Property of TheGreenBow Sistech SA - Sistech

More information

Use Shrew Soft VPN Client to connect with IPSec VPN Server on RV130 and RV130W

Use Shrew Soft VPN Client to connect with IPSec VPN Server on RV130 and RV130W Article ID: 5037 Use Shrew Soft VPN Client to connect with IPSec VPN Server on RV130 and RV130W Objective IPSec VPN (Virtual Private Network) enables you to securely obtain remote resources by establishing

More information

Viewing VPN Status, page 335. Configuring a Site-to-Site VPN, page 340. Configuring IPsec Remote Access, page 355

Viewing VPN Status, page 335. Configuring a Site-to-Site VPN, page 340. Configuring IPsec Remote Access, page 355 VPN This chapter describes how to configure Virtual Private Networks (VPNs) that allow other sites and remote workers to access your network resources. It includes the following sections: About VPNs, page

More information

Asheville-Buncombe Technical Community College Department of Networking Technology. Course Outline

Asheville-Buncombe Technical Community College Department of Networking Technology. Course Outline Course Number: SEC 150 Course Title: Security Concepts Hours: 2 Lab Hours: 2 Credit Hours: 3 Course Description: This course provides an overview of current technologies used to provide secure transport

More information

Interconnecting Cisco Networking Devices: Accelerated Course CCNAX v2.0; 5 Days, Instructor-led

Interconnecting Cisco Networking Devices: Accelerated Course CCNAX v2.0; 5 Days, Instructor-led Interconnecting Cisco Networking Devices: Accelerated Course CCNAX v2.0; 5 Days, Instructor-led Course Description Interconnecting Cisco Networking Devices: Accelerated (CCNAX) v2.0 is a 60-hour instructor-led

More information

VPN. VPN For BIPAC 741/743GE

VPN. VPN For BIPAC 741/743GE VPN For BIPAC 741/743GE August, 2003 1 The router supports VPN to establish secure, end-to-end private network connections over a public networking infrastructure. There are two types of VPN connections,

More information

Using IPSec in Windows 2000 and XP, Part 2

Using IPSec in Windows 2000 and XP, Part 2 Page 1 of 8 Using IPSec in Windows 2000 and XP, Part 2 Chris Weber 2001-12-20 This is the second part of a three-part series devoted to discussing the technical details of using Internet Protocol Security

More information

Understanding the Cisco VPN Client

Understanding the Cisco VPN Client Understanding the Cisco VPN Client The Cisco VPN Client for Windows (referred to in this user guide as VPN Client) is a software program that runs on a Microsoft Windows -based PC. The VPN Client on a

More information

Virtual Private Networks

Virtual Private Networks 10 Virtual Private Networks Contents Overview..................................................... 10-4 VPN Tunnels.............................................. 10-4 IP Security (IPSec).........................................

More information

"Charting the Course...

Charting the Course... Description "Charting the Course... Course Summary Interconnecting Cisco Networking Devices: Accelerated (CCNAX), is a course consisting of ICND1 and ICND2 content in its entirety, but with the content

More information

INF3510 Information Security University of Oslo Spring 2011. Lecture 9 Communication Security. Audun Jøsang

INF3510 Information Security University of Oslo Spring 2011. Lecture 9 Communication Security. Audun Jøsang INF3510 Information Security University of Oslo Spring 2011 Lecture 9 Communication Security Audun Jøsang Outline Network security concepts Communication security Perimeter security Protocol architecture

More information

Case Study for Layer 3 Authentication and Encryption

Case Study for Layer 3 Authentication and Encryption CHAPTER 2 Case Study for Layer 3 Authentication and Encryption This chapter explains the basic tasks for configuring a multi-service, extranet Virtual Private Network (VPN) between a Cisco Secure VPN Client

More information

Virtual Private Networks

Virtual Private Networks Virtual Private Networks Petr Grygárek rek Agenda: VPN Taxonomy VPN Principles and Usage Cryptography Basics IPSec 1 Basic Terminology and Mechanisms of Network Security and Cryptography 2 Confidentality

More information

VPN SECURITY. February 2008. The Government of the Hong Kong Special Administrative Region

VPN SECURITY. February 2008. The Government of the Hong Kong Special Administrative Region VPN SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without the

More information

Securing Networks with Cisco Routers and Switches 1.0 (SECURE)

Securing Networks with Cisco Routers and Switches 1.0 (SECURE) Securing Networks with Cisco Routers and Switches 1.0 (SECURE) Course Overview: The Securing Networks with Cisco Routers and Switches (SECURE) 1.0 course is a five-day course that aims at providing network

More information

Cisco Which VPN Solution is Right for You?

Cisco Which VPN Solution is Right for You? Table of Contents Which VPN Solution is Right for You?...1 Introduction...1 Before You Begin...1 Conventions...1 Prerequisites...1 Components Used...1 NAT...2 Generic Routing Encapsulation Tunneling...2

More information

Remote Connectivity for mysap.com Solutions over the Internet Technical Specification

Remote Connectivity for mysap.com Solutions over the Internet Technical Specification Remote Connectivity for mysap.com Solutions over the Technical Specification June 2009 Remote Connectivity for mysap.com Solutions over the page 2 1 Introduction SAP has embarked on a project to enable

More information

Application Note: Onsight Device VPN Configuration V1.1

Application Note: Onsight Device VPN Configuration V1.1 Application Note: Onsight Device VPN Configuration V1.1 Table of Contents OVERVIEW 2 1 SUPPORTED VPN TYPES 2 1.1 OD VPN CLIENT 2 1.2 SUPPORTED PROTOCOLS AND CONFIGURATION 2 2 OD VPN CONFIGURATION 2 2.1

More information

VNS3 to Cisco ASA Instructions. ASDM 9.2 IPsec Configuration Guide

VNS3 to Cisco ASA Instructions. ASDM 9.2 IPsec Configuration Guide VNS3 to Cisco ASA Instructions ASDM 9.2 IPsec Configuration Guide 2016 Site-to-Site IPsec Tunnel IPsec protocol allows you to securely connect two sites together over the public internet using cryptographically

More information

Network Security. Lecture 3

Network Security. Lecture 3 Network Security Lecture 3 Design and Analysis of Communication Networks (DACS) University of Twente The Netherlands Security protocols application transport network datalink physical Contents IPSec overview

More information

Implementing and Managing Security for Network Communications

Implementing and Managing Security for Network Communications 3 Implementing and Managing Security for Network Communications............................................... Terms you ll need to understand: Internet Protocol Security (IPSec) Authentication Authentication

More information

Scenario: IPsec Remote-Access VPN Configuration

Scenario: IPsec Remote-Access VPN Configuration CHAPTER 3 Scenario: IPsec Remote-Access VPN Configuration This chapter describes how to use the security appliance to accept remote-access IPsec VPN connections. A remote-access VPN enables you to create

More information

Cisco EXAM - 300-209. Implementing Cisco Secure Mobility Solutions (SIMOS) Buy Full Product. http://www.examskey.com/300-209.html

Cisco EXAM - 300-209. Implementing Cisco Secure Mobility Solutions (SIMOS) Buy Full Product. http://www.examskey.com/300-209.html Cisco EXAM - 300-209 Implementing Cisco Secure Mobility Solutions (SIMOS) Buy Full Product http://www.examskey.com/300-209.html Examskey Cisco 300-209 exam demo product is here for you to test the quality

More information

GPRS / 3G Services: VPN solutions supported

GPRS / 3G Services: VPN solutions supported GPRS / 3G Services: VPN solutions supported GPRS / 3G VPN soluti An O2 White Paper An O2 White Paper Contents Page No. 3 4-6 4 5 6 6 7-10 7-8 9 9 9 10 11-14 11-12 13 13 13 14 15 16 Chapter No. 1. Executive

More information

Configuring IPSec VPN Tunnel between NetScreen Remote Client and RN300

Configuring IPSec VPN Tunnel between NetScreen Remote Client and RN300 Configuring IPSec VPN Tunnel between NetScreen Remote Client and RN300 This example explains how to configure pre-shared key based simple IPSec tunnel between NetScreen Remote Client and RN300 VPN Gateway.

More information

Security Protocols HTTPS/ DNSSEC TLS. Internet (IPSEC) Network (802.1x) Application (HTTP,DNS) Transport (TCP/UDP) Transport (TCP/UDP) Internet (IP)

Security Protocols HTTPS/ DNSSEC TLS. Internet (IPSEC) Network (802.1x) Application (HTTP,DNS) Transport (TCP/UDP) Transport (TCP/UDP) Internet (IP) Security Protocols Security Protocols Necessary to communicate securely across untrusted network Provide integrity, confidentiality, authenticity of communications Based on previously discussed cryptographic

More information

VPNs. Palo Alto Networks. PAN-OS Administrator s Guide Version 6.0. Copyright 2007-2015 Palo Alto Networks

VPNs. Palo Alto Networks. PAN-OS Administrator s Guide Version 6.0. Copyright 2007-2015 Palo Alto Networks VPNs Palo Alto Networks PAN-OS Administrator s Guide Version 6.0 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-us

More information

Table of Contents. Introduction

Table of Contents. Introduction viii Table of Contents Introduction xvii Chapter 1 All About the Cisco Certified Security Professional 3 How This Book Can Help You Pass the CCSP Cisco Secure VPN Exam 5 Overview of CCSP Certification

More information

Interconnecting Cisco Networking Devices Part 2

Interconnecting Cisco Networking Devices Part 2 Interconnecting Cisco Networking Devices Part 2 Course Number: ICND2 Length: 5 Day(s) Certification Exam This course will help you prepare for the following exam: 640 816: ICND2 Course Overview This course

More information

Configuring a Site-to-Site VPN Tunnel Between RV Series Routers and ASA 5500 Series Adaptive Security Appliances

Configuring a Site-to-Site VPN Tunnel Between RV Series Routers and ASA 5500 Series Adaptive Security Appliances print email Article ID: 4936 Configuring a Site-to-Site VPN Tunnel Between RV Series Routers and ASA 5500 Series Adaptive Security Appliances Objective Security is essential to protect the intellectual

More information

Virtual Private Networks

Virtual Private Networks Virtual Private Networks ECE 4886 Internetwork Security Dr. Henry Owen Definition Virtual Private Network VPN! Virtual separation in protocol provides a virtual network using no new hardware! Private communication

More information

Firewall Troubleshooting

Firewall Troubleshooting Firewall Troubleshooting (Checkpoint Specific) For typical connectivity issues where a firewall is in question follow these steps to eliminate any issues relating to the firewall. Firewall 1. From the

More information

Scenario: Remote-Access VPN Configuration

Scenario: Remote-Access VPN Configuration CHAPTER 7 Scenario: Remote-Access VPN Configuration A remote-access Virtual Private Network (VPN) enables you to provide secure access to off-site users. ASDM enables you to configure the adaptive security

More information

Security in IPv6. Basic Security Requirements and Techniques. Confidentiality. Integrity

Security in IPv6. Basic Security Requirements and Techniques. Confidentiality. Integrity Basic Security Requirements and Techniques Confidentiality The property that stored or transmitted information cannot be read or altered by an unauthorized party Integrity The property that any alteration

More information

LinkProof And VPN Load Balancing

LinkProof And VPN Load Balancing LinkProof And Load Balancing Technical Application Note May 2008 North America Radware Inc. 575 Corporate Dr. Suite 205 Mahwah, NJ 07430 Tel 888 234 5763 International Radware Ltd. 22 Raoul Wallenberg

More information

FortiOS Handbook IPsec VPN for FortiOS 5.0

FortiOS Handbook IPsec VPN for FortiOS 5.0 FortiOS Handbook IPsec VPN for FortiOS 5.0 IPsec VPN for FortiOS 5.0 26 August 2015 01-504-112804-20150826 Copyright 2015 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, and FortiGuard, are registered

More information

Lab 6.2.12a Configure Remote Access Using Cisco Easy VPN

Lab 6.2.12a Configure Remote Access Using Cisco Easy VPN Lab 6.2.12a Configure Remote Access Using Cisco Easy VPN Objective Scenario Topology In this lab, the students will complete the following tasks: Enable policy lookup via authentication, authorization,

More information

Workflow Guide. Establish Site-to-Site VPN Connection using RSA Keys. For Customers with Sophos Firewall Document Date: November 2015

Workflow Guide. Establish Site-to-Site VPN Connection using RSA Keys. For Customers with Sophos Firewall Document Date: November 2015 Workflow Guide Establish Site-to-Site VPN Connection using RSA Keys For Customers with Sophos Firewall Document Date: November 2015 November 2015 Page 1 of 10 Establish Site-to-Site VPN Connection using

More information

Configure ISDN Backup and VPN Connection

Configure ISDN Backup and VPN Connection Case Study 2 Configure ISDN Backup and VPN Connection Cisco Networking Academy Program CCNP 2: Remote Access v3.1 Objectives In this case study, the following concepts are covered: AAA authentication Multipoint

More information

This topic discusses Cisco Easy VPN, its two components, and its modes of operation. Cisco VPN Client > 3.x

This topic discusses Cisco Easy VPN, its two components, and its modes of operation. Cisco VPN Client > 3.x Configuring Remote-Access VPNs via ASDM Created by Bob Eckhoff This white paper discusses the Cisco Easy Virtual Private Network (VPN) components, modes of operation, and how it works. This document also

More information

Vodafone MachineLink 3G. IPSec VPN Configuration Guide

Vodafone MachineLink 3G. IPSec VPN Configuration Guide Vodafone MachineLink 3G IPSec VPN Configuration Guide Copyright Copyright 2013 NetComm Wireless Limited. All rights reserved. Copyright 2013 Vodafone Group Plc. All rights reserved. The information contained

More information

TheGreenBow IPsec VPN Client. Configuration Guide Cisco RV325 v1. Website: www.thegreenbow.com Contact: support@thegreenbow.com

TheGreenBow IPsec VPN Client. Configuration Guide Cisco RV325 v1. Website: www.thegreenbow.com Contact: support@thegreenbow.com TheGreenBow IPsec VPN Client Configuration Guide Cisco RV325 v1 Website: www.thegreenbow.com Contact: support@thegreenbow.com Table of Contents 1 Introduction... 3 1.1 Goal of this document... 3 1.2 VPN

More information

Connecting Remote Offices by Setting Up VPN Tunnels

Connecting Remote Offices by Setting Up VPN Tunnels Connecting Remote Offices by Setting Up VPN Tunnels Cisco RV0xx Series Routers Overview As your business expands to additional sites, you need to ensure that all employees have access to the network resources

More information

Configuring Internet Key Exchange Security Protocol

Configuring Internet Key Exchange Security Protocol Configuring Internet Key Exchange Security Protocol This chapter describes how to configure the Internet Key Exchange (IKE) protocol. IKE is a key management protocol standard that is used in conjunction

More information

Fireware How To VPN. Introduction. Is there anything I need to know before I start? Configuring a BOVPN Gateway

Fireware How To VPN. Introduction. Is there anything I need to know before I start? Configuring a BOVPN Gateway Fireware How To VPN How do I set up a manual branch office VPN tunnel? Introduction You use Branch Office VPN (BOVPN) with manual IPSec to make encrypted tunnels between a Firebox and a second IPSec-compliant

More information

This chapter describes how to set up and manage VPN service in Mac OS X Server.

This chapter describes how to set up and manage VPN service in Mac OS X Server. 6 Working with VPN Service 6 This chapter describes how to set up and manage VPN service in Mac OS X Server. By configuring a Virtual Private Network (VPN) on your server you can give users a more secure

More information

Cisco Group Encrypted Transport VPN: Tunnel-less VPN Delivering Encryption and Authentication for the WAN

Cisco Group Encrypted Transport VPN: Tunnel-less VPN Delivering Encryption and Authentication for the WAN Cisco Group Encrypted Transport VPN: Tunnel-less VPN Delivering Encryption and Authentication for the WAN Product Overview Today s networked applications such as voice and video are accelerating the need

More information

SNRS. Securing Networks with Cisco Routers and Switches. Length 5 days. Format Lecture/lab

SNRS. Securing Networks with Cisco Routers and Switches. Length 5 days. Format Lecture/lab Length 5 days Format Lecture/lab Version 3.0 SNRS Course Description SNRS 1.0 is a 5-day, lab-intensive course that provides the knowledge and skills needed to secure Cisco IOS router and switch networks.

More information

Secure Remote Monitoring of the Critical System Infrastructure. An Application Note from the Experts in Business-Critical Continuity

Secure Remote Monitoring of the Critical System Infrastructure. An Application Note from the Experts in Business-Critical Continuity Secure Remote Monitoring of the Critical System Infrastructure An Application Note from the Experts in Business-Critical Continuity TABLE OF CONTENTS Introduction................................................2

More information

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with

More information

Configuring IPsec VPN with a FortiGate and a Cisco ASA

Configuring IPsec VPN with a FortiGate and a Cisco ASA Configuring IPsec VPN with a FortiGate and a Cisco ASA The following recipe describes how to configure a site-to-site IPsec VPN tunnel. In this example, one site is behind a FortiGate and another site

More information

Lecture 10: Virtual LANs (VLAN) and Virtual Private Networks (VPN)

Lecture 10: Virtual LANs (VLAN) and Virtual Private Networks (VPN) Lecture 10: Virtual LANs (VLAN) and Virtual Private Networks (VPN) Prof. Shervin Shirmohammadi SITE, University of Ottawa Prof. Shervin Shirmohammadi CEG 4185 10-1 Virtual LANs Description: Group of devices

More information

IPsec VPN Security between Aruba Remote Access Points and Mobility Controllers

IPsec VPN Security between Aruba Remote Access Points and Mobility Controllers IPsec VPN Security between Aruba Remote Access Points and Mobility Controllers Application Note Revision 1.0 10 February 2011 Copyright 2011. Aruba Networks, Inc. All rights reserved. IPsec VPN Security

More information

Configuring a VPN between a Sidewinder G2 and a NetScreen

Configuring a VPN between a Sidewinder G2 and a NetScreen A PPLICATION N O T E Configuring a VPN between a Sidewinder G2 and a NetScreen This document explains how to create a basic gateway to gateway VPN between a Sidewinder G 2 Security Appliance and a Juniper

More information

13 Virtual Private Networks 13.1 Point-to-Point Protocol (PPP) 13.2 Layer 2/3/4 VPNs 13.3 Multi-Protocol Label Switching 13.4 IPsec Transport Mode

13 Virtual Private Networks 13.1 Point-to-Point Protocol (PPP) 13.2 Layer 2/3/4 VPNs 13.3 Multi-Protocol Label Switching 13.4 IPsec Transport Mode 13 Virtual Private Networks 13.1 Point-to-Point Protocol (PPP) PPP-based remote access using dial-in PPP encryption control protocol (ECP) PPP extensible authentication protocol (EAP) 13.2 Layer 2/3/4

More information

FortiOS Handbook - IPsec VPN VERSION 5.2.2

FortiOS Handbook - IPsec VPN VERSION 5.2.2 FortiOS Handbook - IPsec VPN VERSION 5.2.2 FORTINET DOCUMENT LIBRARY http://docs.fortinet.com FORTINET VIDEO GUIDE http://video.fortinet.com FORTINET BLOG https://blog.fortinet.com CUSTOMER SERVICE & SUPPORT

More information

Chapter 4 Virtual Private Networking

Chapter 4 Virtual Private Networking Chapter 4 Virtual Private Networking This chapter describes how to use the virtual private networking (VPN) features of the FVL328 Firewall. VPN tunnels provide secure, encrypted communications between

More information

ISG50 Application Note Version 1.0 June, 2011

ISG50 Application Note Version 1.0 June, 2011 ISG50 Application Note Version 1.0 June, 2011 Scenario 1 - ISG50 is placed behind an existing ZyWALL 1.1 Application Scenario For companies with existing network infrastructures and demanding VoIP requirements,

More information

Security. Contents. S-72.3240 Wireless Personal, Local, Metropolitan, and Wide Area Networks 1

Security. Contents. S-72.3240 Wireless Personal, Local, Metropolitan, and Wide Area Networks 1 Contents Security requirements Public key cryptography Key agreement/transport schemes Man-in-the-middle attack vulnerability Encryption. digital signature, hash, certification Complete security solutions

More information

Point-to-Point GRE over IPsec Design and Implementation

Point-to-Point GRE over IPsec Design and Implementation CHAPTER 2 Point-to-Point GRE over IPsec Design and Implementation In designing a VPN deployment for a customer, it is essential to integrate broader design considerations such as high availability, resiliency,

More information

Configure an IPSec Tunnel between a Firebox Vclass & a Check Point FireWall-1

Configure an IPSec Tunnel between a Firebox Vclass & a Check Point FireWall-1 Configure an IPSec Tunnel between a Firebox Vclass & a Check Point FireWall-1 This document describes how to configure an IPSec tunnel between a WatchGuard Firebox Vclass appliance (Vcontroller version

More information

IP Security. IPSec, PPTP, OpenVPN. Pawel Cieplinski, AkademiaWIFI.pl. MUM Wroclaw

IP Security. IPSec, PPTP, OpenVPN. Pawel Cieplinski, AkademiaWIFI.pl. MUM Wroclaw IP Security IPSec, PPTP, OpenVPN Pawel Cieplinski, AkademiaWIFI.pl MUM Wroclaw Introduction www.akademiawifi.pl WCNG - Wireless Network Consulting Group We are group of experienced professionals. Our company

More information

Creating IPSec Site-to-Site VPN Tunnel between a Organization vdc vshield Edge and Remote Network

Creating IPSec Site-to-Site VPN Tunnel between a Organization vdc vshield Edge and Remote Network Creating IPSec Site-to-Site VPN Tunnel between a Organization vdc vshield Edge and Remote Network In this document you will find the manual for configuring the Network, creating firewall rules and test

More information

FortiOS Handbook - IPsec VPN VERSION 5.2.4

FortiOS Handbook - IPsec VPN VERSION 5.2.4 FortiOS Handbook - IPsec VPN VERSION 5.2.4 FORTINET DOCUMENT LIBRARY http://docs.fortinet.com FORTINET VIDEO GUIDE http://video.fortinet.com FORTINET BLOG https://blog.fortinet.com CUSTOMER SERVICE & SUPPORT

More information

Virtual Private Network (VPN)

Virtual Private Network (VPN) Configuration Guide 5991-2120 April 2005 Virtual Private Network (VPN) VPN Using Preset Keys, Mode Config, and Manual Keys This Configuration Guide is designed to provide you with a basic understanding

More information

Network Security Part II: Standards

Network Security Part II: Standards Network Security Part II: Standards Raj Jain Washington University Saint Louis, MO 63131 Jain@cse.wustl.edu These slides are available on-line at: http://www.cse.wustl.edu/~jain/cse473-05/ 18-1 Overview

More information

Security Engineering Part III Network Security. Security Protocols (II): IPsec

Security Engineering Part III Network Security. Security Protocols (II): IPsec Security Engineering Part III Network Security Security Protocols (II): IPsec Juan E. Tapiador jestevez@inf.uc3m.es Department of Computer Science, UC3M Security Engineering 4th year BSc in Computer Science,

More information

Deploying IPsec Virtual Private Networks

Deploying IPsec Virtual Private Networks Solutions Guide Deploying IPsec Virtual Private Networks Introduction Corporate networks connected to the Internet can enable flexible and secure VPN access with IPsec. Connecting remote sites over the

More information

Configuring an IPSec Tunnel between a Firebox & a Check Point FireWall-1

Configuring an IPSec Tunnel between a Firebox & a Check Point FireWall-1 Configuring an IPSec Tunnel between a Firebox & a Check Point FireWall-1 This document describes how to configure an IPSec tunnel with a WatchGuard Firebox II or Firebox III (software version 4.5 or later)

More information

Most Common DMVPN Troubleshooting Solutions

Most Common DMVPN Troubleshooting Solutions Most Common DMVPN Troubleshooting s Document ID: 111976 Contents Introduction Prerequisites Requirements Components Used Conventions DMVPN Configuration does not work s Common Issues Verify if ISAKMP packets

More information

UTM - VPN: Configuring a Site to Site VPN Policy using Main Mode (Static IP address on both sites) i...

UTM - VPN: Configuring a Site to Site VPN Policy using Main Mode (Static IP address on both sites) i... Page 1 of 10 Question/Topic UTM - VPN: Configuring a Site to Site VPN Policy using Main Mode (Static IP address on both sites) in SonicOS Enhanced Answer/Article Article Applies To: SonicWALL Security

More information

ZyWALL 5. Internet Security Appliance. Quick Start Guide Version 3.62 (XD.0) May 2004

ZyWALL 5. Internet Security Appliance. Quick Start Guide Version 3.62 (XD.0) May 2004 ZyWALL 5 Internet Security Appliance Quick Start Guide Version 3.62 (XD.0) May 2004 Introducing the ZyWALL The ZyWALL 5 is the ideal secure gateway for all data passing between the Internet and the LAN.

More information