CIT 384: Network AdministrationSlide #1 CIT 384: Network Administration VPNs

CIT 384: Network AdministrationSlide #2 Topics 1.VPNs 2.Tunneling 3.ssh 4.SSL 5.IPsec 6.L2TP

CIT 384: Network AdministrationSlide #3 VPNs VPNs try to provide leased line features Privacy: preventing unauthorized people from being able to read VPN traffic. Authentication: verifying that sender of VPN is an authorized device. Integrity: verifying data is not changed in transit. using a public network at lower cost.

CIT 384: Network AdministrationSlide #4 VPN Example 1.PC1 sends IP packet to S1 2.Router encapsulates IP in VPN+IP headers 3.No one can read packet in the middle 4.ASA-1 checks security and de-encapsulates. 5.S1 receives IP packet from PC1.

CIT 384: Network AdministrationSlide #5 VPN Types Remote Access: individual user to network. Intranet: connect networks of two sites. Extranet: connect networks of two partnering organizations.

CIT 384: Network AdministrationSlide #6 Tunneling Tunneling: Encapsulation of one network protocol in another protocol –Carrier Protocol: protocol used by network through which the information is travelling –Encapsulating Protocol: protocol (GRE, IPsec, L2TP) that is wrapped around original data –Passenger Protocol: protocol carries original data

CIT 384: Network AdministrationSlide #7 Tunneling Protocols by Layer Application Transport Network Data Link ssh, SSL IPsec L2TP, MPLS

CIT 384: Network AdministrationSlide #8 ssh Secure Shell Replaces telnet ftp rlogin rsh rcp

CIT 384: Network AdministrationSlide #9 SSH Security Features

CIT 384: Network AdministrationSlide #10 ssh tunneling.Use ssh tunneling to encrypt TCP connections ssh –L lport:rhost:rport rhost –Carrier Protocol: IP –Encapsulating Protocol: ssh –Passenger Protocol: TCP on a specific port

CIT 384: Network AdministrationSlide #11 SSL/TLS Secure Sockets Layer –Commonly used to encrypt web connections. –Also used for IMAP, LDAP, POP, etc. –Transport Layer Security supersedes SSLv3 Can be used to create tunnels –Configure similarly to ssh tunnels. –Stunnel is open source SSL tunnel software.

CIT 384: Network AdministrationSlide #12 IPsec IPsec includes three major protocols –Internet Key Exchange (IKE) Provides a framework for negotiating security parameters. –Encapsulating Security Payload (ESP) Provides a framework for encrypting, authenticating, and securing data. –Authentication Header (AH) provides a framework for authenticating and securing data.

CIT 384: Network AdministrationSlide #13 IPsec General Operation To communicate with IPsec, devices must –Agree on a set of security protocols. –Agree on an encryption algorithm. –Exchange cryptographic keys. –Use above to encode and decode data.

CIT 384: Network AdministrationSlide #14 IPsec Packet Encapsulation Transport Mode –Original IP header of packet that is being encrypted is used to transport the packet. –ESP or AH header inserted btw IP header and payload. Tunnel Mode –New IP header is added in front of ESP/AH header. This header contains IP addresses of the two IP peers as source + destination.

CIT 384: Network AdministrationSlide #15 IKE IKE handles –Negotiating protocol parameters –Exchanging public keys –Authenticating both sides –Managing keys after exchange IKE is a UDP-based protocol.

CIT 384: Network AdministrationSlide #16 ESP Encapsulates IP packet to provide –Authentication –Encryption –Integrity validation –Anti-replay IP protocol 50, described in RFC 2406

CIT 384: Network AdministrationSlide #17 AH Authentication Header provides auth + integrity –Uses keyed hash algorithm as checksum. –Unlike CRC, cannot be reproduced w/o key. –Also protects against replay attacks. –Does not encrypt packet contents.

CIT 384: Network AdministrationSlide #18 NAT Transparency PAT can’t change encrypted transport header. Solution: add an extra UDP header.

CIT 384: Network AdministrationSlide #19 GRE Generic Routing Encapsulating –Cisco IP tunneling protocol. –Allows use of multicast protocols. –Combine with IPsec to allow routing information to be passed btw networks. IP protocol 47

CIT 384: Network AdministrationSlide #20 L2TP Open successor to –L2F (Cisco) –PPTP (MS) Layer 2 tunnel so it supports any layer 3 protocols. –Encapsulates in UDP datagram to port 1701 Does not provide encryption or authentication. Use with IPsec

CIT 384: Network AdministrationSlide #21 Key Points Tunneling –Carrier Protocol –Encapsulating Protocol –Passenger Protocol VPNs –layer 4: ssh, SSL –layer 3: IPsec –layer 2: L2TP IPsec –ESP –AH –IKE –Tunnel mode vs transport mode

CIT 384: Network AdministrationSlide #22 References 1.Daniel J. Barrett, Robert G. Byrnes, Richard E. Silverman, SSH, The Secure Shell, 2 nd edition, O’Reilly, Vijay Bollapragda, IPsec VPN Design, Cisco Press, James Boney, Cisco IOS in a Nutshell, 2 nd edition, O’Reilly, Cisco, Cisco Connection Documentation, Cisco, Internetworking Basics, m m 6.Saadat Malik, Network Security Principles and Practices, Cisco Press, Wendell Odom, CCNA Official Exam Certification Library, 3 rd edition, Cisco Press, 2007.