Building VPNs. Nam-Kee Tan. With IPSec and MPLS. McGraw-Hill CCIE #4307 S&

Transcription

1 Building VPNs With IPSec and MPLS Nam-Kee Tan CCIE #4307 S& -.jr."..- i McGraw-Hill New York Chicago San Francisco Lisbon London Madrid Mexico City Milan New Delhi San Juan Seoul Singapore Sydney Toronto

2 Figures xv Tables xix Code Listings xxi Preface xxxi Acknowledgments xxxv About the Author xxxvii Part 1: The VPN Overview Chapter 1: VPN-in-Brief VPN Overview VPN Types and Solutions Remote Access Site-to-Site Firewall-based VPN Terminology VPN Models Overlay Model Layer 1 Implementation Layer 2 Implementation Layer 3 Implementation Peer-to-Peer Model Shared PE Router Model Dedicated PE Router Model MPLS VPN Model Comparison between Various VPN Implementations IPSec versus MPLS VPNs Summary 15 Part 2: Implementing IPSEC VPN in Enterprises Chapter 2: IPSec and IKE Overview Introduction IPSec Overview 19 vii

3 viii Contents IPSec VPN Services Encryption Concepts and Algorithms Symmetric Algorithms Asymmetric Algorithms Hashing Concepts and Algorithms Key Exchanges Diffie-Hellman Key Exchange Authentication Mechanisms Digital Signatures Digital Certificates Digital Envelopes 2.8 IPSec Protocol Framework IPSec Authentication Header Encapsulating Security Payload IPSec Modes IPSec Key Management Manual Keying Internet Key Exchange 2.9 IPSec Operation Step 1 Interesting Traffic Step 2 IKE Phase IKE Policy Sets Peer Authentication Step 3 IKE Phase IPSec Transform Sets Security Associations SA Lifetime Step 4 Data Transfer Step 5 Tunnel Termination 2.10 Summary Chapter 3: Site-to-Site IPSec VPN Using Pre-shared Keys Chapter Overview IKE Peer Authentication Overview Pre-shared Keys Overview and Types Preparing for IKE (ISAKMP) and IPSec IKE (ISAKMP) Policy IPSec Policy Activating IKE (ISAKMP) and IPSec Case Study 3.1: Pre-shared Keys Example Case Overview and Network Topology ISAKMP Pre-shared Keys and IPSec Configurations ' IPSec Configuration Caveats Monitoring IP Routes between the IPSec Routers Monitoring and Verifying IKE (ISAKMP) and IPSec Operations Verifying IKE (ISAKMP) and IPSec Policies Monitoring IKE (ISAKMP) and IPSec Debug Trace Verifying IKE (ISAKMP) and IPSec Security Associations Case Study 3.2: Dynamic Crypto Map Deployment Dynamic Crypto Map Primer Dynamic Crypto Map Configurations Verifying Dynamic Crypto Map Operations 68

4 ix 3.7 Tunnel Endpoint Discovery Summary 72 Chapter 4: Site-to-Site IPSec VPN Using RSA Encrypted Nonces and RSA Signatures Chapter Overview RSA Keys Overview IKE Using RSA Encrypted Nonces Case Study 4.1: RSA Encrypted Nonces Example Generating RSA Key Pairs Specifying and Verifying RSA Public Keys ISAKMP RSA Encrypted Nonces and IPSec Configurations Verifying IKE (ISAKMP) and IPSec Policies Monitoring IKE (ISAKMP) and IPSec Debug Trace Verifying IKE (ISAKMP) and IPSec Security Associations Scalability Issues Digital Certificates Certificate Authority Registration Authority Implementing IPSec with CA Certificate Generation File-based Enrollment Network-based Enrollment CA Distribution/RA Certificate Certificate Enrollment Certificate Revocation Certificate Access CRL Distribution Certificate Validation Signature Validation Validity Period Certificate Revocation List IKE Using RSA Signature Case Study 4.2: RSA Signatures Example Setting Up the CA Server Retrieving Certificates for End-Entities Verifying IKE (ISAKMP) and IPSec Policies Monitoring IKE (ISAKMP) and IPSec Debug Trace Verifying IKE (ISAKMP) and IPSec Security Associations Summary 135 Chapter 5: Deploying IPSec VPN in the Enterprise Chapter Overview Meshed versus Hub-and-Spoke Networks Case Study 5.1: IPSec VPN in a Hub and Spoke Topology Case Overview and Network Topology Hub and Spoke IPSec Configurations Verifying Crypto Access Lists Monitoring and Verifying Hub and Spoke IPSec Operations 145

5 5.4 Scaling IPSec VPNs Meshed Networks and Tunnel Endpoint Discovery Hub and Spoke Networks and Multi-hop Crypto Summary 167 Chapter 6: Advanced IPSec VPN Deployment Chapter Overview Network Address Translation Overview NAT Background NAT Terminologies NAT Concepts Static versus Dynamic Translations NAT versus PAT Inside versus Outside Source Translations NAT and IPSec Case Study 6.1: IPSec with NAT Case Overview Scenario 1 IPSec with Plain NAT Configurations Verification Test Results Proposed Solution Scenario 2 IPSec and NAT with Internal Server Configurations Verification Test Results Proposed Solution HSRP Overview Case Study 6.2: IPSec with HSRP Case Overview Scenario 1 IPSec Dual Peers with HSRP Configurations Verification Before HSRP Failover Verification After HSRP Failover Scenario 2 IPSec Backup Peers with HSRP Configurations Verification Before HSRP Failover Verification After HSRP Failover GRE Tunnel Overview Tunneling Preliminaries IPSec VPN Resiliency with GRE Tunnels Scenario 3 IPSec and GRE Tunnels with HSRP Configurations Verification Before HSRP Failover Verification After HSRP Failover IPSec VPN Performance Optimization Fragmentation IKE SA Lifetimes IKE Keepalives Summary 232

6 xi Part 3: Deployment of MPLS VPN for Service Providers Chapter 7: MPLS Concepts Introduction Terminologies Conventional IP Forwarding Versus MPLS Forwarding MPLS Architecture Frame-Mode MPLS Label Switch Routers Upstream and Downstream LSRs Architecture of LSRs MPLS Frame-Mode Forwarding Operation MPLS Labels MPLS Label Stack MPLS TTL Processing MPLS Label Assignment, Distribution, and Retention Label Space Label Distribution Label Distribution Control Label Retention Label Distribution Protocol Label Switch Paths Penultimate Hop Popping MPLS Applications Summary 254 Chapter 8: MPLS VPN Architecture Introduction MPLS VPN Terminologies MPLS VPN Functional Components Customer Edge Routers Provider Edge Routers Provider Routers MPLS Architectural Components Route Distinguisher Route Target MPLS VPN Connectivity Model MPLS VPN Routing Model CE Routing P Routing PE Routing MP-BGP Update VPNv4 Addresses BGP Extended Communities MPLS VPN Routing Example MPLS VPN Packet Forwarding MPLS VPN Label Stack and Label Propagation MPLS VPN Label Forwarding MPLS VPN Penultimate Hop Popping MPLS VPN Packet Forwarding Operation Caveats of MPLS VPN Packet Forwarding Summary 273

7 xii Contents Chapter 9: Building MPLS VPN Introduction Design and Implementation Preliminaries VPN-Aware PE-CE Routing Protocols VRF Tables Design Considerations VPN Topology Selecting the Backbone Interior Gateway Protocol Integrated IS-IS Overview IS-IS Addressing IS-IS Levels IS-IS Routing Metrics IS-IS Routing Algorithms IS-IS IP Routing Simple IS-IS Design Autonomous System Numbering Selecting a Route Distinguisher Selecting a Route Target Selecting a Site-of-Origin PE-CE Addressing Scheme Selecting the PE-CE Routing Protocol Static Routing RIP Version 2 Routing EBGP Routing MPLS VPN Configuration Checklist Case Study 9.1: EBGP as PE-CE Routing Protocol Case Overview Network Design VPN Topology Backbone IGP Autonomous System Numbering Selecting the RD and RT PE-CE Addressing Scheme PE-CE Routing Protocol Configuring the CE Routers Configuring the PE Routers Monitoring MPLS VPN Operation Verifying the IP Connectivity between the PE Routers Verifying VRFs Configured in the PE Routers Per-VRF Label Forwarding Information Base of Brussels-PE Per-VRF Label Forwarding Information Base of London-PE Per-VRF Label Forwarding Information Base of Paris-PE Monitoring the PE Routers for VRF vpn Monitoring the CE Routers in vpn Monitoring the PE Routers for VRF vpn Monitoring the CE Routers in vpn Verifying the Coexistent of Overlapping Address Spaces Case Study 9.2: Static Routes and RIPv2 as PE-CE Routing Protocol Case Overview and Network Topology CE Configurations Configuring RIPv2 as PE-CE Routing Protocol Configuring Per-VRF Static Routes Verifying the Inter-Site Connectivity for vpn Verifying the Inter-Site Connectivity for vpn

8 xiii 9.7 Case Study 9.3: Site-of-Origin Application Case Overview AS-Override CE Configurations PE Configurations Before Implementing AS-Override After Implementing AS-Override After Setting SOO 9.8 Summary Chapter 10: MPLS VPN Topologies 10.1 Introduction 10.2 Case Study 10.1: Overlapping VPN Topology Case Overview Overlapping VPN Topology CE Configurations PE Configurations Verifying VRFs Configured in the PE Routers Monitoring BGP VPNv4 Tables of the PE Routers Verifying the Inter-Site Connectivity 10.3 Case Study 10.2: Central Services VPN Topology Case Overview Central Services VPN Topology CE Configurations PE Configurations Verifying VRFs Configured in the PE Routers Monitoring BGP VPNv4 Tables of the PE Routers Verifying the Inter-Site Connectivity 10.4 Case Study 10.3: Hybrid VPN Topology Case Overview Hybrid VPN Topology CE Configurations PE Configurations Verifying VRFs Configured in the PE Routers Monitoring BGP VPNv4 Tables of the PE Routers Verifying the Inter-Site Connectivity 10.5 Case Study 10.4: Hub-and-Spoke VPN Topology Case Overview Hub and Spoke VPN Topology Allowas-in CE Configurations PE Configurations Verifying VRFs Configured in the PE Routers Monitoring BGP VPNv4 Tables of the PE Routers Verifying the Inter-Site Connectivity 10.6 Case Study 10.5: Single ASN Deployment For All Customer Sites Case Overview CE Configurations PE Configurations Monitoring BGP VPNv4 Tables of the PE Routers Monitoring BGP Tables of the CE Routers 10.7 Internet Access and MPLS VPN Internet Access with a Separate VPN Internet Access with Global Routing

9 xiv Contents 10.8 MPLS VPN Performance Optimization BGP Route Advertisement BGP Scanner Process BGP Import Process VRF Route Limit Summary 420 Chapter 11: Scaling MPLS VPN with Route Reflectors MPLS VPN Scaling Overview MPLS VPN RR Partitioning Dedicated VPN Route Reflectors Partitioned VPN Route Reflectors Case Study 11.1: Partitioned VPN Route Reflectors with Standard BGP Communities Case Overview and Network Topology Inbound versus Outbound Filters BGP and Partitioned VPN RR Configurations Monitoring IGP Routes between the PE Routers Monitoring and Verifying Partitioned VPN RR Operations Propagating network /8 from VPN 102 at Brussels-CE2 to London-CE Propagating subnet /16 from VPN 102 at London-CE2 to Brussels-CE Propagating subnet /24 from VPN 101 at Brussels-CE1 to London-CE Propagating host route /32 from VPN 101 at London-CE1 to Brussels-CE Propagating Internet host route from Brussels-PE to London-PE Route Reflector Performance Tuning and Optimization BGP Peer Groups Input Queue Size Path MTU Summary 467 Appendix A: Acronyms and Abbreviations 469 Appendix B: Bibliography 475 Index 479