Virtual Private Networks (VPNs)

Dominik Herkel

agenda 1 / 3

1. important informations

2.general

3. history

4.benefits for business

agenda 2 / 3

5.implementation

• GRE

• Ipsec

• GRE over Ipsec

• SSL/TLS

6.Cisco VPN solutions

agenda 3 / 3

7. access network resources

8. live configuration

important informations

• always refer to the OSI model, not TCP/IP

• complex topic listen carefully

general

• end-to-end private network connection

• security as a big concern

• access to internal network resources

history

• mostly no need to lease dedicated lines

• small companies are no longer left out

• use already existing infrastructure

• paved the way for telecommuting

benefits for business

• cost efficiency

• security

• scalability

• compatibility

implementation

• GRE

• IPsec VPNs

• GRE over IPsec

• SSL/TLS VPNs

Generic Routing Encapsulation (GRE)

general

• originally developed by cisco

• GRE tunnels are stateless

• still widely in use

process

• original IP packet encapsulated again

• additional overhead of 24 bytes

advantages

• multiprotocol support

• routing protocol support

• multicast and broadcast support

disadvantages

• no security measurements

• big overhead

Internet Protocol Security (IPsec)

general

• isn’t bound to any specific security technologies

• framework of open standards

• in theory operates over all data link layer (OSI model) protocols

modes

• tunnel mode

• transport mode

protocols

• Authentication Header (AH):

• appropriate when confidentiality not required

• only authentication and integrity provided

• Encapsulating Security Payload (ESP):

• different to AH, also supports encryption

confidentiality

• symmetric algorithms are used

• ensures bulk encryption

• examples:

• Data Encryptions Standard (DES)

• Triple Data Encryption Standard (3DES)

• Advanced Encryption Standard (AES)

integrity

• Keyed-Hash Message Authentication Code (HMAC)

• additional shared secret added to plaintext data

• hash value calculated from key-data combination

• examples of hash calculation operations:

• Message-Digest Algorithm 5 (MD5), Secure Hash Algorithm (SHA-1, SHA-2, SHA-3)

authentication

• parties authenticate each other

• either pre-shared secrets or signatures used

• examples:

• pre-shared secret

• Rivest-Shamir-Adleman (RSA) signature

secure key exchange

• Diffie-Hellman (DH)

• asymmetric algorithm

• defines several groups

• allows generation of identical shared secret

• shared-secret never exchanged between parties

• examples:

• ranges from group 1 – 24

• differ relating to encryption strength

process

1. Host A (behind R1) sends interesting traffic to Host B (behind R2).

2. R1 and R2 negotiate an IKE phase one session secure channel is set up.

3. Router R1 and R2 negotiate an IKE phase two session matching parameter

needed.

4. Securely transmit data.

5. IPsec tunnel is terminated.

advantages

• security

• based on existing algorithms

disadvantages

• solely IP support

• only unicasts

• no routing protocol support

Decision

GRE over IPsec

• often no need to decide between IPsec or GRE

• combines the benefits of both solutions into one

• flexibility provided by GRE and security ensured by IPsec

Secure Sockets Layer (SSL) / Transport Layer Security (TLS)

general

• SSL is predecessor of TLS

• both work at presentation layer of OSI model

• several security measurements

process

(http://www.youtube.com/watch?v=SJJmoDZ3il8)

advantages

• security

• almost everywhere available

• third party regulation

disadvantages

• faked SSL/TLS certificates

• DoS attacks

Cisco VPN solutions

• Cisco Integrated Services Router (ISR) with enabled VPN

• Cisco Private Internet eXchange (PIX) – end of life (EOL), end of sale (EOS)

• Cisco Adaptive Security Appliance (ASA) 5500 Series

• Cisco VPN 3000 Series Conentrator – end of life (EOL), end of sale (EOS)

• Small and Home Office (SOHO) Routers

access network resources

• Site to Site configuration

• Cisco VPN Client

• Cisco AnyConnect VPN Client

bibliography 1 / 5

• AnexGATE. (n.d.). AnexGATE. Retrieved from http://www.anexgate.com/downloads/whitepapers/vpnprimer.pdf

• AnexGATE. (n.d.). AnexGATE. Retrieved from http://www.anexgate.com/downloads/whitepapers/vpnprimer.pdf

• Cisco. (n.d.). Cisco. Retrieved from http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008009438e.shtml

• Cisco. (n.d.). Cisco Netacademy. Retrieved from http://www.cisco.com/web/learning/netacad/index.html

bibliography 2 / 5

• Cisco. (n.d.). Cisco Netacademy. Retrieved from http://www.cisco.com/web/learning/netacad/index.html

• Covenant. (n.d.). DSLreports. Retrieved from http://www.dslreports.com/faq/8228

• Edwards, J. (n.d.). ITsecurity. Retrieved from http://www.itsecurity.com/features/vpn-popularity-021108/

• Itif. (n.d.). Itif. Retrieved from http://www.itif.org/files/Telecommuting.pdf

• Kilpatrick, I. (n.d.). IT Pro Portal. Retrieved from http://www.itproportal.com/2007/05/18/benefits-and-disadvantages-of-ssl-vpns/

bibliography 3 / 5

• Mason, A. (n.d.). CiscoPress. Retrieved from http://www.ciscopress.com/articles/article.asp?p=25474&seqNum=7

• Pearson. (n.d.). Pearsoncmg. Retrieved from http://ptgmedia.pearsoncmg.com/images/9781587201509/samplechapter/158720150X_CH14.pdf

• Rager, A. T. (n.d.). SourceForge. Retrieved from http://ikecrack.sourceforge.net/

• SANS Institute. (n.d.). GoogleDocs. Retrieved from https://docs.google.com/viewer?a=v&q=cache:LcJ_BIRpFl4J:www.sans.org/reading_room/whitepapers/vpns/vulnerabilitys-ipsec-discussion-weaknesses-ipsec-implementation-pro_760+ipsec+vulnerabilities&hl=de&gl=at&pid=bl&srcid=ADGEESjc5VtF9axW6pM9jnZscnGxhS2U9roAq

bibliography 4 / 5

• Suida, D. (n.d.). WordPress. Retrieved from http://waynetwork.wordpress.com/2011/07/02/video-tutorial-ipsec-over-a-gre-tunnel/

• Unknown. (n.d.). ETutorials. Retrieved from http://etutorials.org/Networking/network+security+assessment/Chapter+11.+Assessing+IP+VPN+Services/11.2+Attacking+IPsec+VPNs/

• Unknown. (n.d.). Journey2CCIE. Retrieved from http://journey2ccie.blogspot.co.at

bibliography 5 / 5

• Unknown. (n.d.). Teleworkers Research Network. Retrieved from http://www.teleworkresearchnetwork.com/telecommuting-statistics

• Unknown. (n.d.). The Hackers Choice. Retrieved from http://thehackerschoice.wordpress.com/2011/10/24/thc-ssl-dos/

• Wikipedia. (n.d.). Wikipedia. Retrieved from http://en.wikipedia.org/wiki/Telecommuting#Telecommuting_and_telework_statistics

• Wikipedia. (n.d.). Wikipedia. Retrieved from http://en.wikipedia.org/wiki/Transport_Layer_Security

• Zandi, S. (n.d.). Cisco LearningNetwork. Retrieved from https://learningnetwork.cisco.com/docs/DOC-2457

• dtommy1979 (n.d.). YouTube. Retrieved from http://www.youtube.com/watch?v=SJJmoDZ3il8