CCNA 5.0 Planning Guide Chapter 7: Securing Site-to-Site Connectivity Connecting Networks

Chapter 7: Objectives After completing this chapter, students will be able to: Describe benefits of VPN technology. Describe site-to-site and remote access VPNs. Describe the purpose and benefits of GRE tunnels. Configure a site-to-site GRE tunnel. Describe the characteristics of IPsec. Explain how IPsec is implemented using the IPsec protocol framework. Explain how the Anyconnect client and clientless SSL remote access VPN implementations support business requirements. Compare IPsec and SSL remote access VPNs. 2

Chapter 7: Overview This chapter: Explains the concepts and processes related to VPNs Explains the benefits of VPN implementations and the underlying protocols required to configure VPNs 3

Chapter 7: Activities What activities are associated with this chapter? 7.0.1.2 Class Activity – VPNs at a Glance 7.1.1.3 Activity – Identifying the Benefits of VPNs 7.1.2.3 Activity – Compare Types of VPNs 7.1.2.4 Packet Tracer – Configuring VPNs (Optional) 7.2.1.3 Activity – Identifying GRE Characteristics 7.2.2.2 Syntax Checker – Configure and Verify GRE 7.2.2.3 Packet Tracer – Configuring GRE 7.2.2.4 Packet Tracer – Troubleshooting GRE 7.2.2.5 Lab – Configuring a Point-to-Point GRE VPN Tunnel 4

Chapter 7: Activities (cont.) What activities are associated with this chapter? 7.3.2.7 Activity – Identifying IPsec Terminology and Concepts 7.3.2.8 Packet Tracer – Configuring GRE over IPsec (Optional) 7.4.1.4 Activity – Compare Cisco SSL VPN Solutions 7.4.2.5 Activity – Identify Remote-Access Characteristics 7.5.1.1 Class Activity – VPN Planning Design 7.5.1.2 Packet Tracer – Skills Integration Challenge 5

Chapter 7: Packet Tracer Activity Password The password for all the Packet Tracer activities in this chapter is: PT_ccna5 6

Chapter 7: Assessment Students should complete Chapter 7 Exam after completing Chapter 7. Worksheets, labs and quizzes can be used to informally assess student progress. 7

Chapter 7: New Terms and Commands What terms and commands are introduced in this chapter? 7.1.1.1 VPNs Tunnel Generic Routing Encapsulation (GRE) Cisco Adaptive Security Appliance (ASA) 7.1.2.1 Site-to-site VPNs VPN Gateway 7.1.2.2 Remote Access VPNs Cisco AnyConnect Secure Mobility Client 7.2.2.1 interface tunnel number command tunnel source command tunnel destination command 7.2.2.2 show interface tunnel command IP Multicast Tunneling 7.3.1.1 IPsec 7.3.1.2 Anti-replay Protection 7.3.2.1 Encryption Decryption 8

Chapter 7: New Terms and Commands (cont.) What terms are introduced in this chapter? 7.3.2.2 Symmetric Encryption Asymmetric Encryption Public Key Encryption 7.3.2.3 Diffie-Hellman Key Exchange OAKLEY IKE protocol 7.3.2.4 Hash Hash-based Message Authentication Code (HMAC) MD5 SHA 7.3.2.5 Pre-shared Key (PSK) RSA Signature Certificate Authority (CA) Digital Signature Algorithm (DSA) 7.3.2.6 Authentication Header (AH) Encapsulating Security Payload (ESP) 9

Chapter 7: New Terms and Commands (cont.) What terms are introduced in this chapter? 7.4.1.1 Secure Sockets Layer (SSL) VPN IP Security (IPsec) VPN 7.4.1.2 Cisco AnyConnect Secure Mobility Client with SSL  Cisco Secure Mobility Clientless SSL VPN 7.4.2.1 Cisco Easy VPN Server Cisco Easy VPN Remote Cisco VPN Client 10

Chapter 7: Best Practices For best practices, the instructor should: Use this chapter as an introduction to CCNA Security. Make this chapter as hands-on as possible. Encourage students to complete chapter activities, labs, and to use the Syntax Checker. Refer to the CCNA Security curriculum for more labs and reference materials. Use http://www.cisco.com for additional VPN materials. 11

Chapter 7: Additional Help For additional help with teaching strategies, including lesson plans, analogies for difficult concepts, and discussion topics, visit the CCNA Community at http://community.netacad.net/web/ccna/files. If you have lesson plans or resources that you would like to share, upload them to the CCNA Community to help other instructors. 12

Chapter 7: Topics Not in ICND2 200-101 This section lists topics covered by this chapter that are NOT listed in the ICND2 200-101 Blueprint. Those topics are posted at http://www.cisco.com/web/learning/exams/list/icnd1b.html. Instructors could skip these sections; however, they should provide additional information and fundamental concepts to assist the student with the topic. 13

Chapter 7: Topics Not in 200-101 ICND2 What sections of this chapter are NOT in the 200-101 ICND2 certification blueprint? 7.0.1 Topic - Introduction 7.1 Section - VPNs 7.2 Section – Site-to-Site GRE Tunnels 7.3 Section – Introducing IPsec 7.4 Section – Remote Access 7.5 Summary 14