1 / 52

IPsec VPNs

IPsec VPNs. IPsec Components and IPsec VPN Features. VPN 分类. VPN ：虚拟个人网络。 ---- 远程访问、把各个 site 虚拟的连在一起，虚拟的 组成一个网络。 1 。 GRE ：最简单，连通性。（ tunnel 口，没有任何 安全性） 2 。 VPDN ： PPPoE 3 。 MPLS/VPN ： 4 。 IPsec ：免费的，在互联网上建立起一个安全的 加密的通道。 是一种远程技术（远程 VPN ）

hedwig
Download Presentation

IPsec VPNs

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. IPsec VPNs IPsec Components and IPsec VPN Features

  2. VPN 分类 • VPN：虚拟个人网络。 • ----远程访问、把各个site虚拟的连在一起，虚拟的 组成一个网络。 • 1。GRE：最简单，连通性。（tunnel口，没有任何 安全性） • 2。VPDN：PPPoE • 3。MPLS/VPN： • 4。IPsec：免费的，在互联网上建立起一个安全的 加密的通道。 • 是一种远程技术（远程VPN） • Lan 2 Lan（Site to Site）

  3. IPsec Overview

  4. What Is IPsec? • IPsec is an IETF standard that employs cryptographic mechanisms on the network layer: • Authentication of every IP packet • Verification of data integrity for each packet • Confidentiality of packet payload • Consists of open standards for securing private communications • Scales from small to very large networks • Is available in Cisco IOS software version 11.3(T) and later • Is included in PIX Firewall version 5.0 and later

  5. IPsec Security Features • IPsec is the only standard Layer 3 （IPv6）technology that provides: • Confidentiality 私密性（加密） • Data integrity 数据完整性 • Authentication 源认证（他没有不可否认性） • Replay detection 重放侦测

  6. IPsec Protocols • IPsec uses three main protocols to create a security framework: • Internet Key Exchange (IKE): • Provides framework for negotiation of security parameters • Establishment of authenticated keys • Encapsulating Security Payload (ESP): • Provides framework for encrypting, authenticating, and securing of data • Authentication Header (AH): • Provides framework for authenticating and securing of data IPsecVPN由三个部分组成：ESP、AH是两种封装方法 IKE：为后续加密封装提供密钥源

  7. 密钥交换: IKE • 加密算法: DES • 3DES • AES • RSA • DH • 保护数据完整性: HMAC-MD5 • HMAC-SHA-1

  8. 对等体认证的办法: • 预共享密钥 • RSA签名 • IPSec框架协议: • AH:提供数据认证和完整性检查. • ESP:提供机密性,起源认证和数据完整性. • 当ESP认证和加密都被选择的时候,数据先进行加密,然后再进行认证

  9. IPsec Headers • IPsec ESP provides the following: • Authentication and data integrity (MD5 or SHA-1 HMAC) with AH and ESP • Confidentiality (DES, 3DES, or AES) only with ESP

  10. Peer Authentication • Peer authentication methods: • Username and password • OTP (Pin/Tan) • Biometric • Preshared keys • Digital certificates

  11. Internet Key Exchange

  12. Internet Key Exchange • IKE solves the problems of manual and unscalable implementation of IPsec by automating the entire key exchange process: • Negotiation of SA characteristics • Automatic key generation • Automatic key refresh • Manageable manual configuration • 协商协议参数 • 交换公共密钥 • 对双方进行认证 • 在交换后，对密钥进行管理 IKE：在两个peer间，动态的，随机的，周期的产生密钥（每隔一小时）。

  13. IKE由三个部分组成 • 定义了如何交换包？几个包 交换？用什么封装？这些消息如何交换的体系结构。 • 定义了密钥交换方式 • 为了做认证，对DH提供如何交换密钥的机制 • 提供了对新技术的支持 • 支持多模式，不管将来出什么新的技术，IKE都可以支持

  14. IKEPhases 1 • Phase 1:阶段1：Authenticate the peers （你到底是谁） • Main mode 主模式（一般都是主模式） • 6个包交换 • aggressive mode 主动模式（为远程VPN服务的） • 3个包交换 • 只有远程拨号VPN，而且是预共享密钥做认证的情况下，才使用主动模式 • 目的是降低PC的利用率，降低CPU的消耗（当时认为ＰＣ的性能比较差）

  15. IKEPhases 2 • Phase 2:阶段2：真正对数据进行加密和处理 • ３个包交换 • Quick mode 快速模式 （我们到底用什么方法加密） 可以为不同的流量用不同的加密方式 • 　阶段１＋阶段２，以主模式为例，一共９个包

  16. IKE Modes

  17. IKE Phase I Messages Types • IKE Phase I Messages Types：1,2 • 交换了IP地址和策略 • 看传过来的源IP地址是否为我set peer指的IP地址 • 协商策略 • 用什么认证方式、加密算法、hash、DH-group、时间 • IKE的某些数据包也需要加密（主模式的5，6个包和整个快速模式的3个包）加密的目的是使IKE的交换和认证是安全的

  18. IPSec的五个步骤 • 1,确定感兴趣的流量 • 2,IKE阶段1: (协商IKE策略设置,认证对等体,在对等体之间),互相协商并同意一套基本的安全服务.IKE阶段1在对等体之间建立起一个安全的通信信道. • 3,IKE阶段2:IKE协商IPSec SA的参数,(包括:协商IPSec参数,IPSec变换集,建立IPSec SA,定时的重新协商IPSec SA以确保安全,当使用完全向前保密PFS时,可选的执行附加的DH交换).并在对等体间建立起匹配的IPSec SA.最终在对等体之间建立安全的IPSec会话 • 4,数据传输 • 5,IPSec隧道终止.

  19. IKE: Other Functions

  20. IKE: Other Functions • Dead peer detection (DPD): • Bidirectional • Sent on periodic intervals • Sender must receive a reply or disconnect • IKE keepalives are unidirectional and are sent every 10 seconds. • NAT traversal: • Defined in RFC 3947 • Encapsulates IPsec packet in UDP packet • Mode config (Push Config) and Xauth (User Authentication)

  21. IPsec and NAT: The Problem

  22. IPsec NAT Traversal • Need NAT traversal with IPsec over TCP/UDP: • NAT traversal detection • NAT traversal decision • UDP encapsulation of IPsec packets • UDP encapsulated process for software engines

  23. Mode Configuration • Mechanism used to push attributes to IPsec VPN clients

  24. Easy VPN • Dynamically updated: • Central services and security policy • Offload VPN function from local devices • Client and network extension mode • Centralized control: • Configuration and security policy pushed at the time of the VPN tunnel establishment

  25. Xauth • Mechanism used for user authentication for VPN clients

  26. ESP and AH

  27. ESPand AH • IPsec protocols: • ESP or AH • ESP uses IP protocol number 50 • AH uses IP protocol number 51 • IPsec modes: • Tunnel or transport mode • Tunnel mode creates a new additional IP header • The Message is concatenated with a symmetric key

  28. ESP and AH Header • ESP allows encryption and authenticates the original packet. • AH authenticates the whole packet (including the header) and does not allow encryption.

  29. AH Authentication and Integrity

  30. ESP Protocol • Provides confidentiality with encryption • Provides integrity with authentication

  31. Tunnel and Transport Mode

  32. Message Authentication and Integrity Check

  33. Message Authentication andIntegrity Check Using Hash • A MAC is used for message authentication and integrity check. • Hashes are widely used for this purpose (HMAC).

  34. Commonly Used Hash Functions • MD5 provides 128-bit output. • SHA-1 provides 160-bit output (only first 96 bits used in IPsec). • SHA-1 is computationally slower than MD5, but more secure.

  35. Symmetric vs. Asymmetric Encryption Algorithms

  36. Symmetric vs. AsymmetricEncryption Algorithms • Symmetric algorithm: • Secretkey cryptography • Encryption and decryption use the same key • Typically used to encrypt the content of a message • Examples: DES, 3DES, AES • Asymmetric algorithm: • Publickey cryptography • Encryption and decryption use different keys • Typically used in digitalcertification and key management • Example: RSA

  37. Key Lengths of Symmetric vs.AsymmetricEncryption Algorithms • Comparable key lengths required for asymmetric keys compared to symmetric keys

  38. Security Level of CryptographicAlgorithms

  39. Symmetric Encryption: DES • Symmetric key encryption algorithm • Block cipher: Works on 64-bit data block, uses 56-bit key (last bit of each byte used for parity) • Mode of operation: Apply DES to encrypt blocks of data

  40. Symmetric Encryption: 3DES • 168-bit total key length • Mode of operation decides how to process DES three times • Normally: encrypt, decrypt, encrypt • 3DES requires more processing than DES

  41. Symmetric Encryption: AES • Formerly known as ‘Rijndael’ • Successor to DES and 3DES • Symmetric key block cipher • Strong encryption with long expected life • AES can support 128-, 192-, and 256-bit keys; 128-bit key is considered safe

  42. Asymmetric Encryption: RSA • Based on Diffie-Hellman key exchange (IKE) principles • Public key to encrypt data, and to verify digital signatures • Private key to decrypt data, and to sign with a digital signature • Perfect for insecure communication channels

  43. Diffie-Hellman Key Exchange

  44. Diffie-Hellman Key Exchange (Cont.)

  45. PKI Environment

  46. PKI Environment

  47. Certificate Authority • The trust basis of a PKI system • Verifies user identity, issues certificates by binding identity of a user to a public key with a digital certificate • Revokes certificates and publishes CRL • In-house implementation or outsourcing

  48. X.509 v3 Certificate

  49. PKI Message Exchange

  50. PKI Credentials • How to store PKI credentials: • RSA keys and certificates • NVRAM • eToken: • Cisco 871, 1800, 2800, 3800 Series router • Cisco IOS Release 12.3(14)T image • Cisco USB eToken • A k9 image

More Related