Introducing VPN Solutions

Introducing VPN Solutions

Cisco VPN solutions provide an Internet-based WAN infrastructure for connecting branch offices, home offices, business partner sites, and remote telecommuters to all or portions of a company network. With cost-effective, high-bandwidth Internet connectivity that is secured by encrypted VPN tunnels, you can reduce WAN bandwidth costs while increasing connectivity speeds.

By integrating advanced network intelligence and routing, Cisco VPNs reliably transport complex mission-critical traffic, such as voice and client-server applications, without compromising communications quality or security.

VPNs and Their Benefits

A VPN is an encrypted connection between private networks over a public network such as the Internet. The V stands for virtual, and the N stands for network. The information from a private network is securely transported over a public network, the Internet, to form a virtual network. The P stands for private. To remain private, the traffic is encrypted to keep the data confidential. Instead of using a dedicated Layer 2 connection such as a leased line, a VPN uses IPsec to form virtual connections that are routed through the Internet from the private network of the company to the remote site or employee host. Figure 8-1 shows some examples of using VPNs to connect different types of remote sites.

Figure 8-1 VPN Connectivity

Benefits of VPNs include the following:

• Cost savings: VPNs enable organizations to use cost-effective third-party Internet transport to connect remote offices and remote users to the main corporate site, thus eliminating expensive dedicated WAN links and modem banks. Furthermore, with the advent of cost-effective high-bandwidth technologies, such as DSL, organizations can use VPNs to reduce their connectivity costs while simultaneously increasing remote connection bandwidth.
• Security: VPNs provide the highest level of security by using advanced encryption and authentication protocols that protect data from unauthorized access.
• Scalability: VPNs enable corporations to use the Internet infrastructure within ISPs and devices, which makes it easy to add new users. Therefore, corporations are able to add large amounts of capacity without adding significant infrastructure.
• Compatibility with broadband technology: VPNs allow mobile workers, telecommuters, and people who want to extend their work day to take advantage of high-speed, broadband connectivity, such as DSL and cable, to gain access to their corporate networks, providing workers significant flexibility and efficiency. Furthermore, high-speed broadband connections provide a cost-effective solution for connecting remote offices.

Types of VPNs

There are two types of VPN networks:

• Site-to-site
• Remote-access, which includes these two types of VPN solutions:
  • Cisco Easy VPN
  • Cisco IOS IP Security (IPsec)/Secure Socket Layer (SSL) VPN, also known as WebVPN

entire networks to each other. For example, they can connect a branch office network to a company headquarters network. In the past, a leased line or Frame Relay connection was required to connect sites, but because most corporations now have Internet access, these connections can be replaced with site-to-site VPNs. Figure 8-2 shows an example of a site-to-site VPN.

Figure 8-2 Site-to-Site VPN

In a site-to-site VPN, hosts do not have Cisco VPN Client software; they send and receive normal TCP/IP traffic through a VPN “gateway,” which could be a router, firewall, Cisco VPN Concentrator, or Cisco ASA 5500 Series adaptive security appliance. The VPN gateway is responsible for encapsulating and encrypting outbound traffic for all the traffic from a particular site and sending it through a VPN tunnel over the Internet to a peer VPN gateway at the target site. Upon receipt, the peer VPN gateway strips the headers, decrypts the content, and relays the packet toward the target host inside its private network.

Remote access is an evolution of circuit-switching networks, such as plain old telephone service (POTS) or ISDN. Remote-access VPNs can support the needs of telecommuters, mobile users, and extranet consumer-to-business traffic. Remote-access VPNs connect individual hosts that must access their company network securely over the Internet. Figure 8-3 shows an example of a remote-access VPN.

In the past, corporations supported remote users by using dial-in networks and ISDN. With the advent of VPNs, a mobile user simply needs access to the Internet to communicate with the central office. In the case of telecommuters, their Internet connectivity is typically a broadband, DSL, or cable connection.

In a remote-access VPN, each host typically has Cisco VPN Client software. Whenever the host tries to send traffic, the Cisco VPN Client software encapsulates and encrypts that traffic before sending it over the Internet to the VPN gateway at the edge of the target network. Upon receipt, the VPN gateway behaves as it does for site-to-site VPNs.

Figure 8-3 Remote-Access VPN

When you are deploying VPNs for teleworkers and small branch offices, the ease of deployment is increasingly important. Cisco Easy VPN makes it easier than ever to deploy VPNs as part of a small, medium, or large enterprise network that has Cisco products. Cisco Easy VPN is a cost-effective solution that is ideal for remote offices that have little information technology support.

There are two components of Cisco Easy VPN:

• Cisco Easy VPN Server: The server can be a dedicated VPN gateway such as a Cisco VPN Concentrator, a Cisco PIX Firewall, a Cisco ASA adaptive security appliance, or a Cisco IOS router with the firewall feature set. A VPN gateway that uses Cisco Easy VPN Server software can terminate VPN tunnels that are initiated by mobile and remote workers that run Cisco VPN Client software on PCs. A VPN gateway can also terminate VPN tunnels from remote devices that act as Cisco Easy VPN remote nodes in site-to-site VPNs.
• Cisco Easy VPN Remote Clients: Cisco Easy VPN Remote Clients enables Cisco IOS routers, PIX Firewalls, Cisco ASA adaptive security appliances, and Cisco VPN Hardware Clients to receive security policies from a Cisco Easy VPN Server, minimizing VPN configuration requirements at the remote location. Cisco Easy VPN allows the VPN parameters, such as internal IP addresses, internal subnet masks, DHCP server addresses, Microsoft Windows Internet Name Service (WINS) server addresses, and split-tunneling flags (to allow local Internet access while connected to the VPN), to be pushed from the Cisco Easy VPN Server to the remote device.

Figure 8-4 shows how Cisco Easy VPN components provide the framework for VPN connectivity to remote sites.
Figure 8-4 Cisco Easy VPN

Benefits

The following are benefits of Cisco Easy VPN:

• Centrally stored configurations allow dynamic configuration of end-user policy and require less manual configuration.
• The local VPN configuration is independent of the remote peer IP address. This feature allows the provider to change equipment and network configurations as needed, with little or no reconfiguration of the end-user equipment.
• Cisco Easy VPN provides centralized security policy management.
• Cisco Easy VPN enables large-scale deployments with rapid user provisioning.
• Cisco Easy VPN removes the need for end users to install and configure Cisco Easy VPN Remote software on their PCs.

Restrictions

Implementing Cisco Easy VPN might not be appropriate for all networks because of restrictions. The following restrictions apply to Cisco Easy VPN:

• No manual Network Address Translation (NAT) or Port Address Translation (PAT) configuration is allowed.
  • Cisco Easy VPN Remote automatically creates the appropriate NAT or PAT configuration for the VPN tunnel.
• Only one destination peer is supported.
  • Cisco Easy VPN Remote supports the configuration of only one destination peer and tunnel connection.
  • If an application requires the creation of multiple VPN tunnels, you must manually configure the IPsec VPN and NAT and PAT parameters on both the remote client and server.
• Cisco Easy VPN requires destination servers.
  •  Cisco Easy VPN Remote requires that the destination peer be a Cisco Easy VPN remote-access server.
• Digital certificates are not supported.
  • Authentication is supported using pre-shared keys (PSK).
  • Extended Authentication (XAUTH) can also be used in addition to PSKs to provide user-level authentication in addition to device-level authentication.
• Only Internet Security Association and Key Management Protocol (ISAKMP) policy group 2 is supported on IPsec servers.
  • Cisco VPN Client and server support only ISAKMP policies that use group 2 (1024-bit Diffie-Hellman [DH]) Internet Key Exchange (IKE) negotiation.
• Some transform sets are not supported.
  • The Cisco Easy VPN Remote feature does not support transform sets that provide encryption without authentication (ESP-DES and ESP- 3DES) or transform sets that provide authentication without encryption (ESP-NULL, ESP-SHA-HMAC, and ESP-NULL ESP-MD5-HMAC).
  • Cisco VPN Client and server do not support Authentication Header (AH) authentication but do support Encapsulating Security Payload (ESP).

IPsec SSL VPN (WebVPN)

Cisco IOS IPsec/SSL–based VPN, also known as WebVPN, is an emerging technology that provides remote-access connectivity from almost any Internet-enabled location using a web browser and its native SSL encryption. WebVPN provides the flexibility to support secure access for all users, regardless of the endpoint host from which they establish a connection.

If application access requirements are modest, WebVPN does not require a software client to be preinstalled on the endpoint host. This ability enables companies to extend their secure enterprise networks to any authorized user by providing remote-access connectivity to corporate resources from any Internet-enabled location. Figure 8-5 shows how an SSL VPN tunnel can be built through the Internet using a web browser.

Figure 8-5 IPsec SSL VPN (WebVPN)

WebVPN currently delivers two modes of SSL VPN access: clientless and thin client. WebVPNs allow users to access web pages and services, including the ability to access files, send and receive e-mail, and run TCP-based applications, without IPsec VPN Client software. WebVPNs are appropriate for user populations that require per-application or per-server access control, or access from nonenterprise-owned desktops.

In many cases, IPsec and WebVPN are complementary because they solve different problems. This complementary approach allows a single device to address all remoteaccess user requirements.

Benefits

The primary benefit of WebVPN is that it is compatible with Dynamic Multipoint VPNs (DMVPN), Cisco IOS Firewalls, IPsec, intrusion prevention systems (IPS), Cisco Easy VPN, and NAT.

Restrictions

As with other VPN software, some restrictions also exist with IPsec SSL VPN (WebVPN). The primary restriction of WebVPN is that it is currently supported only in software. The router CPU processes the WebVPN connections. The on-board VPN acceleration that is available in integrated services routers accelerates only IPsec connections.

Components of VPNs

Cisco provides a suite of VPN-optimized routers. Cisco IOS Software that is running on Cisco routers combines rich VPN services with industry-leading routing, thereby delivering a comprehensive solution. The Cisco VPN software adds strong security through encryption and authentication. These Cisco VPN–enabled routers provide high performance for site-to-site, intranet, and extranet VPN solutions. Figure 8-6 shows how routers can be used to provide VPN solutions.

Figure 8-6 VPN on Cisco IOS Routers

For VPN services, Cisco ASA 5500 Series adaptive security appliances offer flexible technologies that deliver tailored solutions to suit remote-access and site-to-site connectivity requirements. ASA 5500 Series adaptive security appliances provide easy-tomanage IPsec remote access and network-aware site-to-site VPN connectivity, enabling businesses to create secure connections across public networks to mobile users, remote sites, and business partners. Figure 8-7 shows how Cisco ASAs can be used to provide VPN solutions.

Figure 8-7 VPN on Cisco Adaptive Security Appliances

The ASA 5500 Series offers both IPsec and SSL VPN on a single platform, eliminating the need to provide parallel solutions. In addition to VPN services, the ASA 5500 Series offers application inspection firewall and intrusion prevention services.
Cisco remote-access VPNs are able to use three IPsec clients: the Certicom IPsec client, the Cisco VPN Software Client, and the Cisco VPN 3002 Hardware Client. Details are as follows:

• Certicom client: A wireless client that is loaded onto wireless personal digital assistants (PDA) running the Palm or Microsoft Windows Mobile operating systems. Certicom wireless client software allows companies to extend critical enterprise applications, such as e-mail and customer relationship management (CRM) tools, to mobile professionals by enabling handheld devices to connect to corporate VPN gateways for secure wireless access.
• Cisco VPN 3002 Hardware Client (legacy equipment): A network appliance that is used to connect small office, home office (SOHO) LANs to the VPN. The device comes in either a single-port or eight-port switch version. The VPN 3002 Hardware Client replaces traditional Cisco VPN Client applications on individual SOHO computers.
• Cisco VPN Software Client: Software that is loaded on an individual’s PC or laptop. The Cisco VPN Client allows organizations to establish end-to-end, encrypted VPN tunnels for secure connectivity for mobile employees or teleworkers. The Cisco Easy VPN feature allows the Cisco VPN Client to receive security policies from the central site VPN device (Cisco Easy VPN Server) when a VPN tunnel connection is made, minimizing configuration requirements at the remote location. Figure 8-8 shows an example of the three clients used to connect to a Cisco VPN solution.

Figure 8-8 VPN Clients

Introducing IPsec

IPsec acts at the network layer, protecting and authenticating IP packets between participating IPsec devices (peers). IPsec is not bound to any specific encryption, authentication, or security algorithms or keying technology. IPsec is a framework of open standards. Figure 8-9 shows how IPsec can be used with different customers and devices to connect.

Figure 8-9 IPsec Flexibility

By not binding IPsec to specific algorithms, IPsec allows newer and better algorithms to be implemented without patching the existing IPsec standards. IPsec provides data confidentiality, data integrity, and origin authentication between participating peers at the IP layer. IPsec secures a path between a pair of gateways, a pair of hosts, or a gateway and host. IPsec security services provide the following four critical functions:

• Confidentiality (encryption): The sender can encrypt the packets before transmitting them across a network. By doing so, no one can eavesdrop on the communication. If the communication is intercepted, it cannot be read.
• Data integrity: The receiver can verify that the data was transmitted through the Internet without being changed. IPsec ensures data integrity by using checksums (also known as a hash value or message digest), a simple redundancy check.
• Authentication: Authentication ensures that the connection is made with the desired communication partner. The receiver can authenticate the source of the packet, guaranteeing and certifying the source of the information.
• Antireplay protection: Antireplay protection verifies that each packet is unique and not duplicated. IPsec packets are protected by comparing the sequence number of the received packets with a sliding window on the destination host or security gateway. A packet that has a sequence number that is before the sliding window is considered either late or a duplicate packet. Late and duplicate packets are dropped.

Plain-text data that is transported over the public Internet can be intercepted and read. To keep the data private, you should encrypt the data. By digitally scrambling the data, it is rendered unreadable. Figure 8-10 shows how the data is encrypted as it passes across the public Internet.
Figure 8-10 Data Encryption

For encryption to work, both the sender and the receiver must know the rules that are used to transform the original message into its coded form. Rules are based on an algorithm and a key. An algorithm is a mathematical function that combines a message, text, digits, or all three with a string of digits called a key. The output is an unreadable cipher string. Decryption is extremely difficult or impossible without the correct key.

In Figure 8-10, someone wants to send a financial document across the Internet. At the local end, the document is combined with a key and run through an encryption algorithm. The output is undecipherable cipher text. The cipher text is then sent through the Internet. At the remote end, the message is recombined with a key and sent back through the encryption algorithm. The output is the original financial document.

The degree of security depends on the length of the key of the encryption algorithm. The time that it takes to process all the possibilities is a function of the computing power of the computer. Therefore, the shorter the key, the easier it is to break. Figure 8-11 shows the role of the key in the process.

Figure 8-11 Encryption Key

Encryption algorithms such as DES and 3DES require a symmetric shared secret key to perform encryption and decryption. You can use e-mail, courier, or overnight express to send the shared secret keys to the administrators of the devices. But the easiest key exchange method is a public key exchange method between the encrypting and decrypting devices. The DH key agreement is a public key exchange method that provides a way for two peers to establish a shared secret key, which only they know, even though they are communicating over an insecure channel. Figure 8-12 shows that the shared keys need to be established securely over an open network.

Figure 8-12 Encryption Keys Must Be Established

Some of the encryption algorithms and the length of keys they use are as follows:

• Data Encryption Standard (DES) algorithm: DES was developed by IBM. DES uses a 56-bit key, ensuring high-performance encryption. DES is a symmetric key cryptosystem.
• Triple DES (3DES) algorithm: The 3DES algorithm is a variant of the 56-bit DES. 3DES operates similarly to DES, in that data is broken into 64-bit blocks. 3DES then processes each block three times, each time with an independent 56-bit key. 3DES provides significant encryption strength over 56-bit DES. DES is a symmetric key cryptosystem.
• Advanced Encryption Standard (AES): The National Institute of Standards and Technology (NIST) has recently adopted AES to replace the existing DES encryption in cryptographic devices. AES provides stronger security than DES and is computationally more efficient than 3DES. AES offers three different key lengths: 128-, 192-, and 256-bit keys.
• Rivest, Shamir, and Adleman (RSA): RSA is an asymmetrical key cryptosystem. It uses a key length of 512, 768, 1024, or larger. IPsec does not use RSA for data encryption. IKE only uses RSA encryption during the peer authentication phase. VPN data is transported over the public Internet. Potentially, this data could be intercepted and modified. To guard against this problem, you can use a data integrity algorithm. A data integrity algorithm adds a hash to the message. A hash guarantees the integrity of the original message. If the transmitted hash matches the received hash, the message has not been tampered with. However, if no match exists, the message was altered.

In Figure 8-13, someone is trying to send Terry Smith a check for $100. At the remote end, Alex Jones is trying to cash the check for $1000. As the check progressed through the Internet, it was altered. Both the recipient and dollar amounts were changed. In this case, if a data integrity algorithm were used, the hashes would not match, and the transaction would no longer be valid.

Figure 8-13 Guarding Against Data Modifications

Keyed Hash-based Message Authentication Code (HMAC) is a data integrity algorithm that guarantees the integrity of the message. At the local end, the message and a shared secret key are sent through a hash algorithm, which produces a hash value. The message and hash are sent over the network.

The two common HMAC algorithms are as follows:

• HMAC-message digest algorithm 5 (MD5): Uses a 128-bit shared secret key. The variable-length message and 128-bit shared secret key are combined and run through the HMAC-MD5 hash algorithm. The output is a 128-bit hash. The hash is appended to the original message and forwarded to the remote end.
• HMAC-Secure Hash Algorithm 1 (SHA-1): HMAC-SHA-1 uses a 160-bit secret key. The variable-length message and the 160-bit shared secret key are combined and run through the HMAC-SHA-1 hash algorithm. The output is a 160-bit hash. The hash is appended to the original message and forwarded to the remote end.

When conducting business long distance, it is necessary to know who is at the other end of the phone, e-mail, or fax. The same is true of VPN networks. The device on the other end of the VPN tunnel must be authenticated before the communication path is considered secure. This is illustrated in Figure 8-14.

Figure 8-14 Peer Authentication

The two peer authentication methods are as follows:

• PSKs: A secret key value that is entered into each peer manually and is used to authenticate the peer. At each end, the PSK is combined with other information to form the authentication key.
• RSA signatures: Use the exchange of digital certificates to authenticate the peers. The local device derives a hash and encrypts it with its private key. The encrypted hash (digital signature) is attached to the message and forwarded to the remote end. At the remote end, the encrypted hash is decrypted using the public key of the local end. If the decrypted hash matches the recomputed hash, the signature is genuine.

IPsec Protocol Framework

IPsec is a framework of open standards. IPsec spells out the messaging to secure the communications but relies on existing algorithms. There are two main IPsec framework protocols, Authentication Header (AH) and Encapsulating Security Payload (ESP). Details are as follows:

• AH: AH is the appropriate protocol to use when confidentiality is not required or permitted. It provides data authentication and integrity for IP packets passed between two systems. It is a means of verifying that any message passed from Router A to Router B has not been modified during transit. It verifies that the origin of the data was either Router A or Router B. AH does not provide data confidentiality (encryption) of packets. All text is transported in the clear. Used alone, the AH protocol provides weak protection. Consequently, the AH protocol is used with the ESP protocol to provide data encryption and tamper-aware security features.
• ESP: A security protocol that can be used to provide confidentiality (encryption) and authentication. ESP provides confidentiality by performing encryption on the IP packet. IP packet encryption conceals the data payload and the identities of the ultimate source and destination. ESP provides authentication for the inner IP packet and ESP header. Authentication provides data origin authentication and data integrity. Although both encryption and authentication are optional in ESP, at a minimum, one of them must be selected.

IPsec is a framework of open standards that spells out the rules for secure communications. IPsec, in turn, relies on existing algorithms to implement the encryption, authentication, and key exchange. Figure 8-15 shows how the different components of security fit into the IPsec framework, along with the choices of algorithms. Some of the standard algorithms that IPsec uses are as follows:

• DES: Encrypts and decrypts packet data
• 3DES: Provides significant encryption strength over 56-bit DES
• AES: Provides stronger encryption, depending on the key length used, and faster throughput
• MD5: Authenticates packet data, using a 128-bit shared secret key
• SHA-1: Authenticates packet data, using a 160-bit shared secret key
• DH (Diffie-Helman): Allows two parties to establish a shared secret key used by encryption and hash algorithms, for example, DES and MD5, over an insecure communications channel

Figure 8-15 IPsec Framework Components

In Figure 8-15, four IPsec framework squares are to be filled in. When you configure an IPsec gateway to provide security services, you must first choose an IPsec protocol. The choices are ESP or ESP with AH. The second square is an encryption algorithm. Choose the encryption algorithm that is appropriate for the desired level of security: DES, 3DES, or AES. The third square is authentication. Choose an authentication algorithm to provide data integrity: MD5 or SHA. The last square is the DH algorithm group. Choose which group to use: DH1, DH2, or DH5. IPsec provides the framework, and the administrator chooses the algorithms that are used to implement the security services within that framework.

More Resources

• Interconnecting Cisco Network Devices (ICND2)
• CCNP Switch Exam Certification Guide