What is HIP? A brief introduction to the Host Identity Protocol. 5. Aug Holger.Zuleger@hnet.de
|
|
|
- Julie Palmer
- 8 years ago
- Views:
Transcription
1 What is HIP? A brief introduction to the Host Identity Protocol 5. Aug 2010 Holger.Zuleger@hnet.de 2001:10:2010:0729:07:02:10:18 Holger Zuleger 2001:db8::13:1 > c
2 Host Identity Protocol (RFC 5201) Yet another locater/identifier split mechanism PIP, ILNP, IPNL, TRRP, APT, GSE/8+8, Shim6, LISP(+ALT), MOBIKE, GLI-Split Host based approach Some others are networ k based (like LISP) Enables multihoming Mobility IPv4 and IPv6 Uses public key as identifier Or a hash of it Adds a new namespace Domain Name (User), HIT (Identifier), { IPv4 address IPv6 address } (Locator) Simple key exchange protocol for IPsec 2001:10:2010:0729:07:02:10:21 Holger Zuleger 2001:db8::13:2
3 Locater / Identifier IP address is used as Identifier and Locater Identifier OS nedds a way to bind incoming ip packets to application Both ends use 5-tuple as endpoint identifier On IP address change the connection go stale Locator Prefix aggregation needed on AS boundary Just a handful prefixes in IPv6 per AS Size of default free zone (DFZ) (IPv4: ; IPv6: 3500) Tier-1 ISP-A 2001:db8:A::/32 ISP-B 2001:db8:B::/ :10:2010:0729:07:02:10:24 Holger Zuleger 2001:db8::13:3
4 Locater / Identifier IP address is used as Identifier and Locater Identifier OS nedds a way to bind incoming ip packets to application Both ends use 5-tuple as endpoint identifier On IP address change the connection go stale Locator Prefix aggregation needed on AS boundary Just a handful prefixes in IPv6 per AS Size of default free zone (DFZ) (IPv4: ; IPv6: 3500) Tier-1 ISP-A 2001:db8:A::/32 ISP-B 2001:db8:B::/32 Mobile Host 2001:10:2010:0729:07:02:10:24 Holger Zuleger 2001:db8::13:3
5 Locater / Identifier IP address is used as Identifier and Locater Identifier OS nedds a way to bind incoming ip packets to application Both ends use 5-tuple as endpoint identifier On IP address change the connection go stale Locator Prefix aggregation needed on AS boundary Just a handful prefixes in IPv6 per AS Size of default free zone (DFZ) (IPv4: ; IPv6: 3500) Tier-1 ISP-A 2001:db8:A::/32 ISP-B 2001:db8:B::/32 Mobile Host 2001:db8:A:d::4 2001:db8:B:f3::4 Multi Homed Host 2001:10:2010:0729:07:02:10:24 Holger Zuleger 2001:db8::13:3
6 Host Identifier and HIT A host identifier is the public part of an asymetr ic key (RSA or DSA) Size of identifier depends on key length / algorithm Representation depends on key algor ithm A more generalized presentation would be more handy The host identity tag (HIT) is the hash of the host identifier AHIT is the 128 bit representation of a host identifier Constant length Same size as an IPv6 address Fits in a socket data structure used by the ker nel Could be represented as an (reserved) IPv6 address Over lay Routable Cryptographic Hash Identifier (ORCHID) The ORCHID prefix used is 2001:0010::/28 (RFC4843) Legacy applications can use the HIT instead of an IPv6 address 2001:10:2010:0729:07:02:10:27 Holger Zuleger 2001:db8::13:4
7 HIP Session Setup Base exchange Just 4 packets to initiate a HIP session Initator (Client) i1 r1 i2 r2 Responder (Ser ver) Makes HIP DoS resilient puzzle question/answer in r1/i2 message Diffie-Hellman Key Exchange In r1, i2 packets Authentication In i2, r2 packets Protocol number 139 has been assigned to HIP Extended Exchange for IP address registration/update For mobile/multihomed hosts Diet Exchange (DEX) under discussion (draft-moskowitz-hip-rg-dex-02)) good to be used by sensor devices or for mac layer secur ity 2001:10:2010:0729:07:02:10:30 Holger Zuleger 2001:db8::13:5
8 HIP and DNS HIP can use DNS to map hostnames (FQDN) to a HIP identity Client queries for HIP record in addition to an A and/or AAAA record HIP RR provides three types of infor mation a. The HIP identity, which is the public part of an asymetr ic key b. The HIT (host identity tag), which is a hash of the Hi c. Optional a rendezvous server (for mobile hosts) Example RR (Mobile Host) xt5.hznet.de. IN HIP ( AE2B2BC542EEEE53CAB AwEAAb1SN58eG29jZcY8HO2HPQXh6UIfSMvFF+4BM8n S/Za6s2yRU0+wvSMXOHGShe6E3RD2t7uKF9cbsSz4JU 5J8YP2/DpJREEGR3AWBXVVcLUq06xS3XmePOvck/oQZ HtNzjRjy11ey5KiH7O6jDwJBXfGuUcpsiI7qHTzu8tJ Va8n max.hznet.de. ) DNSSEC is necessary for secure binding between FQDN and HIT 2001:10:2010:0729:07:02:10:33 Holger Zuleger 2001:db8::13:6
9 And now to something completely different... The Root Zone is signed since 15. July :50 UTC 2001:10:2010:0729:07:02:10:36 Holger Zuleger 2001:db8::13:7
10 HIP Test Server HIP and DNS (2) crossroads.infrahip.net. HIP ( BA9BEC6A634E58361C07FA990 AwEAAcp2OIA68skk+yPtU+UBtvScsntTvknaaXMPmJi 4OG2N+yszHOm/DWN7GyYZDPPsUURYWu6r3u7pzIub7J rwxdpyeliczmr++d0enki9nus1bpdfgeqtgcu0obf1k +wrtaxaqaf64rmsp/l666bezwftvwygfiqzrjncrfwn hvt5 ) crossroads.infrahip.net. AAAA 2001:708:140:220::7 crossroads.infrahip.net. A Mobile Host xt5.hznet.de. IN HIP ( AE2B2BC542EEEE53CAB AwEAAb1SN58eG29jZcY8HO2HPQXh6UIfSMvFF+4BM8n S/Za6s2yRU0+wvSMXOHGShe6E3RD2t7uKF9cbsSz4JU 5J8YP2/DpJREEGR3AWBXVVcLUq06xS3XmePOvck/oQZ HtNzjRjy11ey5KiH7O6jDwJBXfGuUcpsiI7qHTzu8tJ Va8n max.hznet.de. ) max.hznet.de. IN A max.hznet.de. IN AAAA 2001:6f8:900:2af::2 2001:10:2010:0729:07:02:10:39 Holger Zuleger 2001:db8::13:8
11 HIP Mobility Mobile host needs rendezvous server (RVS) for initial reachability Mobile host register his current locator (ip address) at RVS Rendezvous server name is (optional) part of HIP DNS record Locator hint HIP initiator (client) sends first packet of HIP base exchange to RVS RVS forwards the packet to the host (if host is actually registered) client i1 r1 i2 r2 RVS i1 Mobile Host register Mobile host uses HIP base exchange to register his address at RVS Mobile Host send update packet to client if IP address is changing RVS has to be infor med as well (Proposal to send UPDATE/CLOSE via RVS) 2001:10:2010:0729:07:02:10:42 Holger Zuleger 2001:db8::13:9
12 HIP as a key exchange protocol Similar to ISAKMP/IKE Disadvantages (Limitations) Only transpor t mode available Because HIP is for end to end communication this is intended Only one SA per host More than one SA possible (e.g. one HI per application) but unusual Not the same granular ity like ISAKMP No AH, just ESP mode (but with null encryption) Advantages Just 4 packets needed to authenticate peer and exchange key mater ial Same as IKEv2 No certificates needed HIP uses key as identifier No binding between key and identifier (ip address) necessary 2001:10:2010:0729:07:02:10:45 Holger Zuleger 2001:db8::13:10
13 HIP and IPsec ESP HIP uses IPsec ESP to carry the data traffic (RFC5202) Pair of SA is bound to Host Identifier; SPI is used as index into SA table No need to transfer the host identifier within each packet Both endpoints have a local database for mapping of SPI to host identifier Other mechanism possible but not yet defined Only 2 transfor ms mandator y AES with SHA-1 and Null encryption IP addresses could be changed in between a session HIP UPDATE message to infor m peer Rekeying allowed dur ing ip address change Protocol change possible (IPv4 IPv6) but not defined yet Good for mobility MIPv6 no longer needed Session persistence because ip address is no longer used as identifier 2001:10:2010:0729:07:02:10:48 Holger Zuleger 2001:db8::13:11
14 Applications of HIP Host Mobility Even on different transpor t protocols (IPv4/IPv6) Multihoming Ser ver load balancing / High Availability Shared HI on clustered servers End-to-end Security Firewall rules based on Host identifier Firewall for mobile users Long term session persistence SSH, IMAP Continuous media streaming (Voice/Video) over different L3 networ ks mobile / fixed convergence Apples Back tomymac Kerberos, TSIG, TLS, IPsec, DDNS, DNS-SD, DNS Push, NAT Traversal IPv6 ULA used as Identifer, :10:2010:0729:07:02:10:51 Holger Zuleger 2001:db8::13:12
15 RFC References 4423 Host Identity Protocol Architecture (May 2006) 5201 Host Identity Protocol (April 2008) 5202 Using the Encapsulating Security Payload Transpor t Format with HIP 5205 Host Identity Protocol (HIP) Domain Name System (DNS) Extension 5206 End-Host Mobility and Multihoming with the Host Identity Protocol 4843 Over lay Routable Cryptographic Hash Identifier (ORCHID) Implementations InfraHIP / HIPL Ubunto, Fedora, CentOS, Android, Maemo, OpenWRT ( OpenHIP Linux / Windows / Mac ( HIP for FreeBSD ( Compar ison /Interoperability :10:2010:0729:07:02:10:54 Holger Zuleger 2001:db8::13:13
16 Questions? DNSsec, VoIPsec, IPsec, XMPPsec, SMTPsec, WLANsec DKIM, Kerberos, IMAP, LDAP, ENUM, SIP, NTP, DNS, DHCP, IPv6, Routing, Switching 2001:10:2010:0729:07:02:10:57 Holger Zuleger 2001:db8::13:14
17 CONTENTS... 1 Host Identity Protocol (RFC 5201)... 2 Locater / Identifier... 3 Host Identifier and HIT... 4 HIP Session Setup... 5 HIP and DNS HIP and DNS (2)... 8 HIP Mobility... 9 HIP as a key exchange protocol HIP and IPsec ESP Applications of HIP References <
IPv6-Only. Now? Sites. Deutscher IPv6 Kongress 2013. June 6/7, 2013 Fr ankfur t /Ger many. Holger.Zuleger@hznet.de
IPv6-Only Sites Now? Deutscher IPv6 Kongress 2013 June 6/7, 2013 Fr ankfur t /Ger many Holger.Zuleger@hznet.de 2013:6:6:15:4::14:1 Holger Zuleger HZNET > c IPv6 Transition: Dual Stack or IPv6-only Many
STRESS TESTING OF HOST IDENTITY PROTOCOL (HIP) IMPLEMENTATIONS
STRESS TESTING OF HOST IDENTITY PROTOCOL (HIP) IMPLEMENTATIONS Oleg Ponomarev Andrei Gurtov Helsinki Institute for Information Technology HIIT, Finland Helsinki University of Technology TKK oleg.ponomarev@hiit.fi,
CS 356 Lecture 27 Internet Security Protocols. Spring 2013
CS 356 Lecture 27 Internet Security Protocols Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
Security in IPv6. Basic Security Requirements and Techniques. Confidentiality. Integrity
Basic Security Requirements and Techniques Confidentiality The property that stored or transmitted information cannot be read or altered by an unauthorized party Integrity The property that any alteration
Security Protocols HTTPS/ DNSSEC TLS. Internet (IPSEC) Network (802.1x) Application (HTTP,DNS) Transport (TCP/UDP) Transport (TCP/UDP) Internet (IP)
Security Protocols Security Protocols Necessary to communicate securely across untrusted network Provide integrity, confidentiality, authenticity of communications Based on previously discussed cryptographic
Network Security. Lecture 3
Network Security Lecture 3 Design and Analysis of Communication Networks (DACS) University of Twente The Netherlands Security protocols application transport network datalink physical Contents IPSec overview
Protocol Security Where?
IPsec: AH and ESP 1 Protocol Security Where? Application layer: (+) easy access to user credentials, extend without waiting for OS vendor, understand data; (-) design again and again; e.g., PGP, ssh, Kerberos
Integrating Security, Mobility, and Multi-Homing in a HIP way
Integrating Security, Mobility, and Multi-Homing in a way Pekka Nikander Ericsson Research Nomadiclab & Helsinki Institute for Information Technology Outline The problem: TCP/IP is getting old Locators
Securing IP Networks with Implementation of IPv6
Securing IP Networks with Implementation of IPv6 R.M.Agarwal DDG(SA), TEC Security Threats in IP Networks Packet sniffing IP Spoofing Connection Hijacking Denial of Service (DoS) Attacks Man in the Middle
APNIC elearning: IPSec Basics. Contact: training@apnic.net. esec03_v1.0
APNIC elearning: IPSec Basics Contact: training@apnic.net esec03_v1.0 Overview Virtual Private Networks What is IPsec? Benefits of IPsec Tunnel and Transport Mode IPsec Architecture Security Associations
Introduction to Security and PIX Firewall
Introduction to Security and PIX Firewall Agenda Dag 28 Föreläsning LAB PIX Firewall VPN A Virtual Private Network (VPN) is a service offering secure, reliable connectivity over a shared, public network
Fireware How To VPN. Introduction. Is there anything I need to know before I start? Configuring a BOVPN Gateway
Fireware How To VPN How do I set up a manual branch office VPN tunnel? Introduction You use Branch Office VPN (BOVPN) with manual IPSec to make encrypted tunnels between a Firebox and a second IPSec-compliant
Network Security Part II: Standards
Network Security Part II: Standards Raj Jain Washington University Saint Louis, MO 63131 Jain@cse.wustl.edu These slides are available on-line at: http://www.cse.wustl.edu/~jain/cse473-05/ 18-1 Overview
Príprava štúdia matematiky a informatiky na FMFI UK v anglickom jazyku
Univerzita Komenského v Bratislave Fakulta matematiky, fyziky a informatiky Príprava štúdia matematiky a informatiky na FMFI UK v anglickom jazyku ITMS: 26140230008 dopytovo orientovaný projekt Moderné
APPLYING HOST IDENTITY PROTOCOL TO TACTICAL NETWORKS
APPLYING HOST IDENTITY PROTOCOL TO TACTICAL NETWORKS Mikko Sarela Pekka Nikander Theoretical Computer Science Nomadiclab Helsinki University of Technology and Ericsson Research IP Networks Espoo, Finland
Mobile Internet Protocol v6 MIPv6
Mobile Internet Protocol v6 MIPv6 A brief introduction Holger.Zuleger@hznet.de 13-dec-2005 Holger Zuleger 1/15 > c Defined by MIPv6 RFC3775: Mobility Support in IPv6 (June 2004) RFC3776: Using IPsec to
Building scalable IPSec infrastructure with MikroTik. IPSec, L2TP/IPSec, OSPF
Building scalable IPSec infrastructure with MikroTik IPSec, L2TP/IPSec, OSPF Presenter information Tomas Kirnak Network design Security, wireless Servers Virtualization MikroTik Certified Trainer Atris,
Understanding the Cisco VPN Client
Understanding the Cisco VPN Client The Cisco VPN Client for Windows (referred to in this user guide as VPN Client) is a software program that runs on a Microsoft Windows -based PC. The VPN Client on a
APNIC elearning: Network Security Fundamentals. 20 March 2013 10:30 pm Brisbane Time (GMT+10)
APNIC elearning: Network Security Fundamentals 20 March 2013 10:30 pm Brisbane Time (GMT+10) Introduction Presenter/s Nurul Islam Roman Senior Training Specialist nurul@apnic.net Specialties: Routing &
IPv6 Security: How is the Client Secured?
IPv6 Security: How is the Client Secured? Jeffrey L Carrell Network Conversions Network Security Consultant 1 IPv6 Security: How is the Client Secured? IPv6/IPsec IPsec Challenges IPsec Monitoring/Management
This chapter describes how to set up and manage VPN service in Mac OS X Server.
6 Working with VPN Service 6 This chapter describes how to set up and manage VPN service in Mac OS X Server. By configuring a Virtual Private Network (VPN) on your server you can give users a more secure
DirectAccess in Windows 7 and Windows Server 2008 R2. Aydin Aslaner Senior Support Escalation Engineer Microsoft MEA Networking Team
DirectAccess in Windows 7 and Windows Server 2008 R2 Aydin Aslaner Senior Support Escalation Engineer Microsoft MEA Networking Team 0 Introduction to DirectAccess Increasingly, people envision a world
Security Engineering Part III Network Security. Security Protocols (II): IPsec
Security Engineering Part III Network Security Security Protocols (II): IPsec Juan E. Tapiador jestevez@inf.uc3m.es Department of Computer Science, UC3M Security Engineering 4th year BSc in Computer Science,
Security. Contents. S-72.3240 Wireless Personal, Local, Metropolitan, and Wide Area Networks 1
Contents Security requirements Public key cryptography Key agreement/transport schemes Man-in-the-middle attack vulnerability Encryption. digital signature, hash, certification Complete security solutions
Network Security Fundamentals
APNIC elearning: Network Security Fundamentals 27 November 2013 04:30 pm Brisbane Time (GMT+10) Introduction Presenter Sheryl Hermoso Training Officer sheryl@apnic.net Specialties: Network Security IPv6
ETSF10 Part 3 Lect 2
ETSF10 Part 3 Lect 2 DHCP, DNS, Security Jens A Andersson Electrical and Information Technology DHCP Dynamic Host Configuration Protocol bootp is predecessor Alternative: manual configuration IP address
Internet Protocol Security IPSec
Internet Protocol Security IPSec Summer Semester 2011 Integrated Communication Systems Group Ilmenau University of Technology Outline Introduction Authentication Header (AH) Encapsulating Security Payload
VPN. VPN For BIPAC 741/743GE
VPN For BIPAC 741/743GE August, 2003 1 The router supports VPN to establish secure, end-to-end private network connections over a public networking infrastructure. There are two types of VPN connections,
Virtual Private Networks
Virtual Private Networks ECE 4886 Internetwork Security Dr. Henry Owen Definition Virtual Private Network VPN! Virtual separation in protocol provides a virtual network using no new hardware! Private communication
Internetwork Security
Internetwork Security Why Network Security Layers? Fundamentals of Encryption Network Security Layer Overview PGP Security on Internet Layer IPSec IPv6-GCAs SSL/TLS Lower Layers 1 Prof. Dr. Thomas Schmidt
Cisco TelePresence Video Communication Server Basic Configuration (Control with Expressway)
Cisco TelePresence Video Communication Server Basic Configuration (Control with Expressway) Deployment Guide Cisco VCS X8.1 D14651.08 August 2014 Contents Introduction 4 Example network deployment 5 Network
Lecture 17 - Network Security
Lecture 17 - Network Security CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ Idea Why donʼt we just integrate some of these neat
IP Security. Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49
IP Security Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49 1 Internetworking and Internet Protocols (Appendix 6A) IP Security Overview IP Security
Secure Remote Monitoring of the Critical System Infrastructure. An Application Note from the Experts in Business-Critical Continuity
Secure Remote Monitoring of the Critical System Infrastructure An Application Note from the Experts in Business-Critical Continuity TABLE OF CONTENTS Introduction................................................2
Use Domain Name System and IP Version 6
Use Domain Name System and IP Version 6 What You Will Learn The introduction of IP Version 6 (IPv6) into an enterprise environment requires some changes both in the provisioned Domain Name System (DNS)
Configuration Guide. How to establish IPsec VPN Tunnel between D-Link DSR Router and iphone ios. Overview
Configuration Guide How to establish IPsec VPN Tunnel between D-Link DSR Router and iphone ios Overview The iphone is a line of smartphones designed and marketed by Apple Inc. It runs Apple s IOS mobile
(d-5273) CCIE Security v3.0 Written Exam Topics
(d-5273) CCIE Security v3.0 Written Exam Topics CCIE Security v3.0 Written Exam Topics The topic areas listed are general guidelines for the type of content that is likely to appear on the exam. Please
Release Notes. NCP Secure Entry Mac Client. 1. New Features and Enhancements. 2. Improvements / Problems Resolved. 3. Known Issues
NCP Secure Entry Mac Client Service Release 2.05 Build 14711 December 2013 Prerequisites Apple OS X Operating System: The following Apple OS X operating system versions are supported with this release:
Corporate VPN Using Mikrotik Cloud Feature. By SOUMIL GUPTA BHAYA Mikortik Certified Trainer
Corporate VPN Using Mikrotik Cloud Feature By SOUMIL GUPTA BHAYA Mikortik Certified Trainer What is a VPN? A virtual private network (VPN) is a method for the extension of a private network across a public
Viewing VPN Status, page 335. Configuring a Site-to-Site VPN, page 340. Configuring IPsec Remote Access, page 355
VPN This chapter describes how to configure Virtual Private Networks (VPNs) that allow other sites and remote workers to access your network resources. It includes the following sections: About VPNs, page
Using IKEv2 on Juniper Networks Junos Pulse Secure Access Appliance
Using IKEv2 on Juniper Networks Junos Pulse Secure Access Appliance Juniper Networks, Inc. 1 Table of Contents Before we begin... 3 Configuring IKEv2 on IVE... 3 IKEv2 Client Side Configuration on Windows
Implementing Trust to Trust Using Customer Edge Switching. Raimo Kantola Aalto University Finland
Implementing Trust to Trust Using Customer Edge Switching Raimo Kantola Aalto University Finland 1 Agenda Big picture Identities Customer edge switching in operation Deployment and Challenges Conclusions
Configure IPSec VPN Tunnels With the Wizard
Configure IPSec VPN Tunnels With the Wizard This quick start guide provides basic configuration information about setting up IPSec VPN tunnels by using the VPN Wizard on the ProSafe Wireless-N 8-Port Gigabit
IETF IPv6 Request for Comments (RFCs) Updated 2008-12-01
IETF IPv6 Request for Comments (RFCs) Updated 2008-12-01 RFC Title 5380 Hierarchical Mobile IPv6 (HMIPv6) Mobility Management 5350 IANA Considerations for the IPv4 and IPv6 Router Alert Options 5340 OSPF
FortiOS Handbook IPsec VPN for FortiOS 5.0
FortiOS Handbook IPsec VPN for FortiOS 5.0 IPsec VPN for FortiOS 5.0 26 August 2015 01-504-112804-20150826 Copyright 2015 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, and FortiGuard, are registered
IPsec VPN Security between Aruba Remote Access Points and Mobility Controllers
IPsec VPN Security between Aruba Remote Access Points and Mobility Controllers Application Note Revision 1.0 10 February 2011 Copyright 2011. Aruba Networks, Inc. All rights reserved. IPsec VPN Security
INF3510 Information Security University of Oslo Spring 2011. Lecture 9 Communication Security. Audun Jøsang
INF3510 Information Security University of Oslo Spring 2011 Lecture 9 Communication Security Audun Jøsang Outline Network security concepts Communication security Perimeter security Protocol architecture
7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?
7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. risk
Application Note: Onsight Device VPN Configuration V1.1
Application Note: Onsight Device VPN Configuration V1.1 Table of Contents OVERVIEW 2 1 SUPPORTED VPN TYPES 2 1.1 OD VPN CLIENT 2 1.2 SUPPORTED PROTOCOLS AND CONFIGURATION 2 2 OD VPN CONFIGURATION 2 2.1
Joe Davies Principal Writer Windows Server Documentation
Joe Davies Principal Writer Windows Server Documentation Presented at Seattle Windows Networking User Group monthly meeting September 1, 2010 Agenda Brief VPN technology overview VPN features in Windows
21.4 Network Address Translation (NAT) 21.4.1 NAT concept
21.4 Network Address Translation (NAT) This section explains Network Address Translation (NAT). NAT is also known as IP masquerading. It provides a mapping between internal IP addresses and officially
VPNs. Palo Alto Networks. PAN-OS Administrator s Guide Version 6.0. Copyright 2007-2015 Palo Alto Networks
VPNs Palo Alto Networks PAN-OS Administrator s Guide Version 6.0 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-us
Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide
![Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide](/thumbs/24/4351346.jpg "Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide")
Network Security [2] Public Key Encryption Also used in message authentication & key distribution Based on mathematical algorithms, not only on operations over bit patterns (as conventional) => much overhead
Ericsson Research Nomadic Lab May 2006
Network Working Group Request for Comments: 4423 Category: Informational R. Moskowitz ICSA Labs, a division of Cybertrust, Inc. P. Nikander Ericsson Research Nomadic Lab May 2006 Host Identity Protocol
Funkwerk UTM Release Notes (english)
Funkwerk UTM Release Notes (english) General Hints Please create a backup of your UTM system's configuration (Maintenance > Configuration > Manual Backup) before you start to install the software update.
Outline. INF3510 Information Security. Lecture 10: Communications Security. Communication Security Analogy. Network Security Concepts
Outline INF3510 Information Security Lecture 10: Communications Security Network security concepts Communication security Perimeter security Protocol architecture and security services Example security
Hosting more than one FortiOS instance on. VLANs. 1. Network topology
Hosting more than one FortiOS instance on a single FortiGate unit using VDOMs and VLANs 1. Network topology Use Virtual domains (VDOMs) to divide the FortiGate unit into two or more virtual instances of
Lecture 10: Communications Security
INF3510 Information Security Lecture 10: Communications Security Audun Jøsang University of Oslo Spring 2015 Outline Network security concepts Communication security Perimeter security Protocol architecture
Part III-b. Universität Klagenfurt - IWAS Multimedia Kommunikation (VK) M. Euchner; Mai 2001. Siemens AG 2001, ICN M NT
Part III-b Contents Part III-b Secure Applications and Security Protocols Practical Security Measures Internet Security IPSEC, IKE SSL/TLS Virtual Private Networks Firewall Kerberos SET Security Measures
Branch Office VPN Tunnels and Mobile VPN
WatchGuard Certified Training Branch Office VPN Tunnels and Mobile VPN Fireware XTM and WatchGuard System Manager v11.7 Revised: January 2013 Updated for: Fireware XTM v11.7 Notice to Users Information
Security of IPv6 and DNSSEC for penetration testers
Security of IPv6 and DNSSEC for penetration testers Vesselin Hadjitodorov Master education System and Network Engineering June 30, 2011 Agenda Introduction DNSSEC security IPv6 security Conclusion Questions
Security Considerations for Intrinsic Monitoring within IPv6 Networks: Work in Progress
Security Considerations for Intrinsic Monitoring within IPv6 Networks: Work in Progress Alan Davy and Lei Shi Telecommunication Software&Systems Group, Waterford Institute of Technology, Ireland adavy,lshi@tssg.org
Configuring IPSec VPN Tunnel between NetScreen Remote Client and RN300
Configuring IPSec VPN Tunnel between NetScreen Remote Client and RN300 This example explains how to configure pre-shared key based simple IPSec tunnel between NetScreen Remote Client and RN300 VPN Gateway.
Telepresence in an IPv6 World. Simplify the Transition
Telepresence in an IPv6 World Simplify the Transition IPV6 has the potential to transform communications, collaboration, learning, entertainment, physical security and more. What You Will Learn If you
IPsec Details 1 / 43. IPsec Details
Header (AH) AH Layout Other AH Fields Mutable Parts of the IP Header What is an SPI? What s an SA? Encapsulating Security Payload (ESP) ESP Layout Padding Using ESP IPsec and Firewalls IPsec and the DNS
Use Shrew Soft VPN Client to connect with IPSec VPN Server on RV130 and RV130W
Article ID: 5037 Use Shrew Soft VPN Client to connect with IPSec VPN Server on RV130 and RV130W Objective IPSec VPN (Virtual Private Network) enables you to securely obtain remote resources by establishing
Chapter 4 Virtual Private Networking
Chapter 4 Virtual Private Networking This chapter describes how to use the virtual private networking (VPN) features of the FVL328 Firewall. VPN tunnels provide secure, encrypted communications between
Using IPSec in Windows 2000 and XP, Part 2
Page 1 of 8 Using IPSec in Windows 2000 and XP, Part 2 Chris Weber 2001-12-20 This is the second part of a three-part series devoted to discussing the technical details of using Internet Protocol Security
This section provides a summary of using network location profiles to identify network connection types. Details include:
Module 7 Network Access and Security In Module 7 students will learn several strategies for controlling network access and enhancing network security. These will include: controlling network location profiles,
13 Virtual Private Networks 13.1 Point-to-Point Protocol (PPP) 13.2 Layer 2/3/4 VPNs 13.3 Multi-Protocol Label Switching 13.4 IPsec Transport Mode
13 Virtual Private Networks 13.1 Point-to-Point Protocol (PPP) PPP-based remote access using dial-in PPP encryption control protocol (ECP) PPP extensible authentication protocol (EAP) 13.2 Layer 2/3/4
Release Notes. NCP Secure Entry Mac Client. Major Release 2.01 Build 47 May 2011. 1. New Features and Enhancements. Tip of the Day
NCP Secure Entry Mac Client Major Release 2.01 Build 47 May 2011 1. New Features and Enhancements Tip of the Day A Tip of the Day field for configuration tips and application examples is incorporated in
Virtual Private Network VPN IPSec Testing: Functionality Interoperability and Performance
Virtual Private Network VPN IPSec Testing: Functionality Interoperability and Performance Johnnie Chen Project Manager of Network Security Group Network Benchmarking Lab Network Benchmarking Laboratory
The VPNaaS Plugin for Fuel Documentation
The VPNaaS Plugin for Fuel Documentation Release 1.2-1.2.0-1 Mirantis Inc. January 14, 2016 CONTENTS 1 Document purpose 1 1.1 Key terms, acronyms and abbreviations................................. 1 1.2
LECTURE 4 NETWORK INFRASTRUCTURE
SYSTEM ADMINISTRATION MTAT.08.021 LECTURE 4 NETWORK INFRASTRUCTURE Prepared By: Amnir Hadachi and Artjom Lind University of Tartu, Institute of Computer Science amnir.hadachi@ut.ee / artjom.lind@ut.ee
Cisco Expressway Basic Configuration
Cisco Expressway Basic Configuration Deployment Guide Cisco Expressway X8.1 D15060.03 August 2014 Contents Introduction 4 Example network deployment 5 Network elements 6 Internal network elements 6 DMZ
BorderWare Firewall Server 7.1. Release Notes
BorderWare Firewall Server 7.1 Release Notes BorderWare Technologies is pleased to announce the release of version 7.1 of the BorderWare Firewall Server. This release includes following new features and
Configuring GTA Firewalls for Remote Access
GB-OS Version 5.4 Configuring GTA Firewalls for Remote Access IPSec Mobile Client, PPTP and L2TP RA201010-01 Global Technology Associates 3505 Lake Lynda Drive Suite 109 Orlando, FL 32817 Tel: +1.407.380.0220
Home As You Go: An Engineering Approach to Mobility-Capable Extended Home Networking
Home As You Go: An Engineering Approach to Mobility-Capable Extended Home Networking Zhenkai Zhu UCLA zhenkai@cs.ucla.edu Ryuji Wakikawa Toyota Infotechnology Center ryuji@us.toyota-itc.com Lixia Zhang
VoIP Security. Seminar: Cryptography and Security. 07.06.2006 Michael Muncan
VoIP Security Seminar: Cryptography and Security Michael Muncan Overview Introduction Secure SIP/RTP Zfone Skype Conclusion 1 Introduction (1) Internet changed to a mass media in the middle of the 1990s
CCNA Security 1.1 Instructional Resource
CCNA Security 1.1 Instructional Resource Chapter 8 Implementing Virtual Private Networks 2012 Cisco and/or its affiliates. All rights reserved. 1 Describe the purpose and types of VPNs and define where
FortiOS Handbook - IPsec VPN VERSION 5.2.4
FortiOS Handbook - IPsec VPN VERSION 5.2.4 FORTINET DOCUMENT LIBRARY http://docs.fortinet.com FORTINET VIDEO GUIDE http://video.fortinet.com FORTINET BLOG https://blog.fortinet.com CUSTOMER SERVICE & SUPPORT
CS 4803 Computer and Network Security
Network layers CS 4803 Computer and Network Security Application Transport Network Lower level Alexandra (Sasha) Boldyreva IPsec 1 2 Roughly Application layer: the communicating processes themselves and
What s New in Fireware XTM v11.5.1
What s New in Fireware XTM v11.5.1 New Features in Fireware XTM v11.5.1 Major Changes IPv6 Network Configuration and Routing FIPS 140-2 Dynamic Routing Enhancements Clientless SSO Log and Report Manager
Advanced IPSec with GET VPN. Nadhem J. AlFardan Consulting System Engineer Cisco Systems nalfarda@cisco.com
Advanced IPSec with GET VPN Nadhem J. AlFardan Consulting System Engineer Cisco Systems nalfarda@cisco.com 1 Agenda Motivations for GET-enabled IPVPN GET-enabled IPVPN Overview GET Deployment Properties
Cisco EXAM - 300-075. Implementing Cisco IP Telephony and Video, Part 2 (CIPTV2) Buy Full Product. http://www.examskey.com/300-075.
Cisco EXAM - 300-075 Implementing Cisco IP Telephony and Video, Part 2 (CIPTV2) Buy Full Product http://www.examskey.com/300-075.html Examskey Cisco 300-075 exam demo product is here for you to test the
TABLE OF CONTENTS NETWORK SECURITY 2...1
Network Security 2 This document is the exclusive property of Cisco Systems, Inc. Permission is granted to print and copy this document for non-commercial distribution and exclusive use by instructors
Virtual Private Networks
Virtual Private Networks The Ohio State University Columbus, OH 43210 Jain@cse.ohio-State.Edu http://www.cse.ohio-state.edu/~jain/ 1 Overview Types of VPNs When and why VPN? VPN Design Issues Security
The BANDIT Products in Virtual Private Networks
encor! enetworks TM Version A.1, March 2010 2010 Encore Networks, Inc. All rights reserved. The BANDIT Products in Virtual Private Networks One of the principal features of the BANDIT products is their
Chapter 10. Network Security
Chapter 10 Network Security 10.1. Chapter 10: Outline 10.1 INTRODUCTION 10.2 CONFIDENTIALITY 10.3 OTHER ASPECTS OF SECURITY 10.4 INTERNET SECURITY 10.5 FIREWALLS 10.2 Chapter 10: Objective We introduce
Internet Security Architecture
accepted for publication in Computer Networks and ISDN Systems Journal Internet Security Architecture Refik Molva Institut Eurécom 2229, route des Crêtes F-06904 Sophia-Antipolis molva@eurecom.fr Abstract
Firewalls und IPv6 worauf Sie achten müssen!
Firewalls und IPv6 worauf Sie achten müssen! Pascal Raemy CTO Asecus AG pascal.raemy@asecus.ch Asecus AG Asecus AG Security (Firewall, Web-Gateway, Mail-Gateway) Application Delivery (F5 Neworks with BIGIP)
Firewall Troubleshooting
Firewall Troubleshooting (Checkpoint Specific) For typical connectivity issues where a firewall is in question follow these steps to eliminate any issues relating to the firewall. Firewall 1. From the
Chapter 8 Virtual Private Networking
Chapter 8 Virtual Private Networking This chapter describes how to use the virtual private networking (VPN) features of the FWG114P v2 Wireless Firewall/Print Server. VPN tunnels provide secure, encrypted
19531 - Telematics. 9th Tutorial - IP Model, IPv6, Routing
19531 - Telematics 9th Tutorial - IP Model, IPv6, Routing Bastian Blywis Department of Mathematics and Computer Science Institute of Computer Science 06. January, 2011 Institute of Computer Science Telematics
Implementing Cisco IOS Network Security
Implementing Cisco IOS Network Security IINS v3.0; 5 Days, Instructor-led Course Description Implementing Cisco Network Security (IINS) v3.0 is a 5-day instructor-led course focusing on security principles
Site to Site Virtual Private Networks (VPNs):
Site to Site Virtual Private Networks Programme NPFIT DOCUMENT RECORD ID KEY Sub-Prog / Project Information Governance NPFIT-FNT-TO-IG-GPG-0002.01 Prog. Director Mark Ferrar Owner Tim Davis Version 1.0
Configuring L2TP over IPsec
CHAPTER 65 This chapter describes how to configure L2TP over IPsec/IKEv1 on the ASA. This chapter includes the following topics: Information About L2TP over IPsec/IKEv1, page 65-1 Licensing Requirements
1. Introduction to DirectAccess. 2. Technical Introduction. 3. Technical Details within Demo. 4. Summary
1. Introduction to DirectAccess 2. Technical Introduction 3. Technical Details within Demo 4. Summary Section 2: Technical Introduction Solution Overview Compliant Client Compliant Client Internet
Basic IPv6 WAN and LAN Configuration
Basic IPv6 WAN and LAN Configuration This quick start guide provides basic IPv6 WAN and LAN configuration information for the ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N. For complete IPv6 configuration
SonicOS Enhanced 3.2 IKE Version 2 Support
SonicOS Enhanced 3.2 IKE Version 2 Support Document Scope This document describes the integration of SonicOS Enhanced 3.2 with Internet Key Exchange protocol version 2 (IKEv2). This document contains the