hp education services education.hp.com 10 Virtual Private Networks Version B.00 H7076S Module 2 Slides

© 2001 Hewlett-Packard Company H7076S B The Security Problem with IP Today Users in San Francisco K-CLASS Server in Chicago It is trivial to snoop on Internet traffic, including passwords sent over the network. It is fairly easy to forge IP packets and impersonate another user or machine. Malicious people exist who actually do these things. Bad Guy

© 2001 Hewlett-Packard Company H7076S B What Is a Virtual Private Network? VPN Server for Site A VPN Server for Site B Non-Encrypted Link Encrypted Link Legend Internet Site A Intranet Site B Intranet This mobile client uses encrypted links when communicating w/ systems in site A and B. The nodes in site A and B use non- encrypted links when performing Intranet communications. The nodes use encrypted links when communicating across the Internet.

© 2001 Hewlett-Packard Company H7076S B Types of VPNs HP Solution Network-to-Network –Replace expensive dedicated leased line WAN charges for site-to-site data connectivity Network-to-Host (Remote Access) –Replace expensive modem pools, ISDN per-minute charges Host-to-Host –End-to-End security to protect sensitive data for intra- or inter-network communications IPSec/9000 Types of Virtual Private Networks Extranet e-Firewall

© 2001 Hewlett-Packard Company H7076S B Extranet VPN e-Firewall with Mobile client option K- CLASS The Global Internet Firewall and Encryption Devices Corporate HQ Site Business Partner Branch Host Encrypted “tunnels” Laptop computer e-Firewall HP-UX IPSec/9000 HP Solutions for VPNs

© 2001 Hewlett-Packard Company H7076S B Value Prop: Low Cost, Quick Setup of WAN Connectivity K- CLASS Firewall and Encryption Devices Corporate Headquarters Business Partner Field Office Overseas Site Multiple Encrypted “tunnels” Network-to-Network VPNs The Global Internet

© 2001 Hewlett-Packard Company H7076S B Mobile Laptop User K- CLAS S VPN Gateway Device Corporate HQ Site Dialup Line ISDN or DSL Connections All connections initiated by remote user Encryption occurs on Software Client Remote Access VPNs The Global Internet

© 2001 Hewlett-Packard Company H7076S B DMZ The Global Internet Corporate HQ Site Business Partner End-to-End Security – Within the Enterprise – Through the Internet Host-to-Host VPNs

© 2001 Hewlett-Packard Company H7076S B Product Advantages Disadvantages Application Level Security Public Domain S/W(socks) hp Extraet VPN Close integration with the application Network Level Security hp IPFilter/9000 hp IPSec/9000 hp e-Firewall No need to modify applications May need to modify firewall configuration Link Level Security PPTP, L2TP Easy to implementNot scalable VPN Software Products May need to modify the application

© 2001 Hewlett-Packard Company H7076S B K- CLAS S VPN Gateway Device Corporate HQ Site ISDN or DSL or Dial up Connections Hacker If I can get into their host, maybe I can go through their VPN. I wonder which ports are open? They probably have no firewall. The Global Internet System Firewall needed!! Why a System Firewall?

© 2001 Hewlett-Packard Company H7076S B HP IPFilter/9000 – B9901AA Features supported by Hewlett-Packard: Full-fledged statefull inspection firewall Free product Workstations and servers HP-UX 11.0 and 11i Features not supported by Hewlett-Packard (features supported in public domain): Perimeter firewall Network address translation Hewlett-Packard’s Solution

© 2001 Hewlett-Packard Company H7076S B Intranet Packets destined for our machine not part of a VPN connection that we initiated. IPFilter rules pass or block depending upon the rules. System Firewall Installed Matched pass rules Matched block rules Bit Bucket How a System Firewall Works

© 2001 Hewlett-Packard Company H7076S B Hardware and Software Requirements Hewlett-Packard 9000 series 800 or 700 HP-UX 11.0 or 11i operating system Dynamically loadable kernel module support Commands to verify: #uname –a #kmsystem –q dlkm

© 2001 Hewlett-Packard Company H7076S B Patches Required PHNE_22397 (or newer replacement for 32-bit or 64 bit 11.0) PHCO_22899 (or newer replacement for 32-bit 11.0) PHCO_22989 (or newer replacement for 32-bit 11i) Command to verify: #swlist –l product patch_name

© 2001 Hewlett-Packard Company H7076S B Installation Use SD-UX to install product number B9901AA Available on application CD AP0301 Command to use: #swinstall Configuration file and start-up scripts installed: /etc/rc.config.d/ipfconf /sbin/init.d/pfilboot /sbin/init.d/ipfboot

© 2001 Hewlett-Packard Company H7076S B Verification of Installation To verify the product was installed correctly after reboot: #kmadmin –s #ps –ef | grep ipmon Logs to look at if installation unsuccessful: /etc/rc.log /var/adm/sw/swagent.log /var/adm/sw/swinstall.log

© 2001 Hewlett-Packard Company H7076S B Filter Rules Rules are processed from top to bottom Last match takes effect Installing and Administering IPFilter/9000 or the Public Domain HOWTO document for detailed explanations. Rule File: /etc/opt/ipf/ipf.conf Default file is empty, implied contents: pass in all pass out all