ISCW10S04L06EzVPN.ppt

IPsecVPNs,ConfiguringCiscoEasyVPNandEasyVPNServerUsingSDM,IntroducingCiscoEasyVPN,IntroducingCiscoEasyVPN,CiscoEasyVPNhastwomainfunctions:SimplifyclientconfigurationCentralizeclientconfigurationanddynamicallypushtheconfigurationtoclientsHowarethesetwogoalsachieved?IKEModeConfigfunctionalityisusedtodownloadsomeconfigurationparameterstoclients.ClientsarepreconfiguredwithasetofIKEpoliciesandIPsectransformsets.,CiscoEasyVPNComponents,EasyVPNServer:EnablesCiscoIOSrouters,CiscoPIXFirewalls,andCiscoVPNConcentratorstoactasVPNhead-enddevicesinsite-to-siteorremote-accessVPNs,inwhichtheremoteofficedevicesareusingtheCiscoEasyVPNRemotefeatureEasyVPNRemote:EnablesCiscoIOSrouters,CiscoPIXFirewalls,andCiscoVPNHardwareClientsorSoftwareClientstoactasremoteVPNclients,RemoteAccessUsingCiscoEasyVPN,DescribeEasyVPNServerandEasyVPNRemote,CiscoEasyVPNRemoteConnectionProcess,TheVPNclientinitiatestheIKEPhase1process.TheVPNclientestablishesanISAKMPSA.TheEasyVPNServeracceptstheSAproposal.TheEasyVPNServerinitiatesausernameandpasswordchallenge.Themodeconfigurationprocessisinitiated.TheRRIprocessisinitiated.IPsecquickmodecompletestheconnection.,Step1:TheVPNClientInitiatestheIKEPhase1Process,Usingpre-sharedkeys?Initiateaggressivemode.Usingdigitalcertificates?Initiatemainmode.,Step2:TheVPNClientEstablishesanISAKMPSA,TheVPNclientattemptstoestablishanSAbetweenpeerIPaddressesbysendingmultipleISAKMPproposalstotheEasyVPNServer.ToreducemanualconfigurationontheVPNclient,theseISAKMPproposalsincludeseveralcombinationsofthefollowing:EncryptionandhashalgorithmsAuthenticationmethodsDiffie-Hellmangroupsizes,Step3:TheCiscoEasyVPNServerAcceptstheSAProposal,TheEasyVPNServersearchesforamatch:Thefirstproposaltomatchtheserverlistisaccepted(highest-prioritymatch).ThemostsecureproposalsarealwayslistedatthetopoftheEasyVPNServerproposallist(highestpriority).TheISAKMPSAissuccessfullyestablished.Deviceauthenticationendsanduserauthenticationbegins.,Step4:TheCiscoEasyVPNServerInitiatesaUsernameandPasswordChallenge,IftheEasyVPNServerisconfiguredforXauth,theVPNclientwaitsforausername/passwordchallenge:Theuserentersausername/passwordcombination.Theusername/passwordinformationischeckedagainstauthenticationentitiesusingAAA.AllEasyVPNServersshouldbeconfiguredtoenforceuserauthentication.,Step5:TheModeConfigurationProcessIsInitiated,IftheEasyVPNServerindicatessuccessfulauthentication,theVPNclientrequeststheremainingconfigurationparametersfromtheEasyVPNServer:Modeconfigurationstarts.Theremainingsystemparameters(IPaddress,DNS,splittunnelinginformation,andsoon)aredownloadedtotheVPNclient.RememberthattheIPaddressistheonlyrequiredparameterinagroupprofile;allotherparametersareoptional.,Step6:TheRRIProcessIsInitiated,RRIshouldbeusedwhenthefollowingconditionsoccur:MorethanoneVPNserverisusedPer-clientstaticIPaddressesareusedwithsomeclients(insteadofusingper-VPN-serverIPpools)RRIensuresthecreationofstaticroutes.RedistributingstaticroutesintoanIGPallowstheserverssiterouterstofindtheappropriateEasyVPNServerforreturntraffictoclients.,Step7:IPsecQuickModeCompletestheConnection,AftertheconfigurationparametershavebeensuccessfullyreceivedbytheVPNclient,IPsecquickmodeisinitiatedtonegotiateIPsecSAestablishment.AfterIPsecSAestablishment,theVPNconnectioniscomplete.,CiscoEasyVPNServerConfigurationTasks,CiscoEasyVPNServerConfigurationTasksUsingSDM,ConfiguringtheEasyVPNServerrequiresthesetasks:ConfiguringaprivilegeduserConfiguringenablesecretEnablingAAAusingthelocaldatabaseConfiguringtheEasyVPNServerusingaconfigurationwizard,CiscoEasyVPNServerConfigurationTasksfortheEasyVPNServerWizard,TheEasyVPNserverwizardincludesthesetasks:SelectingtheinterfaceonwhichtoterminateIPsecIKEpoliciesGrouppolicylookupmethodUserauthenticationLocalgrouppoliciesIPsectransformset,ConfiguringEasyVPNServer,ConfiguringEasyVPNServer,UseabrowsertoconnecttotheEasyVPNServerrouter.ClickonthelinktotheSDM.PrepareadesignbeforeimplementingtheVPNserver:IKEauthenticationmethodUserauthenticationmethodIPaddressingandroutingforclientsInstallallprerequisiteservices(dependingonthechosendesign),forexample:RADIUS/TACACS+serverCAandenrollmentwiththeCADNSresolutionfortheVPNserveraddresses,VPNWizards,1.,2.,3.,EnablingAAA,1.,2.,LocalUserManagement,1.,2.,3.,CreatingUsers,1.,2.,3.,4.,5.,6.,8.,7.,EnablingAAA,1.,2.,StartingtheEasyVPNServerWizard,SelectInterfaceforTerminatingIPsec,1.,2.,IKEProposals,IKEProposals,1.,2.,3.,TransformSet,TransformSet,3.,2.,1.,4.,GroupPolicyConfigurationLocation,Option1:LocalRouterConfiguration,1.,2.,Option2:ExternalLocationviaRADIUS,1.,2.,Option2:ExternalLocationviaRADIUS(Cont.),3.,1.,2.,4.,UserAuthentication,Option1:LocalUserDatabase,2.,3.,1.,LocalUserDatabaseAddingUsers,1.,2.,3.,4.,5.,6.,Option2:ExternalUserDatabaseviaRADIUS,2.,3.,1.,LocalGroupPolicies,LocalGroupPolicies,GeneralParameters,1.,2.,3A.,3B.,DomainNameSystem,1.,2.,SplitTunneling,1.,3.,4.,2.,5.,AdvancedOptions,1.,2.,3.,4.,XauthOptions,1.,2.,3.,4.,CompletingtheConfiguration,ReviewtheGeneratedConfiguration,ReviewtheGeneratedConfiguration(Cont.),VerifytheEasyVPNServerConfiguration,1.,3.,2.,VerifytheEasyVPNServerConfiguration(Cont.),MonitoringEasyVPNServer,1.,2.,3.,5.,4.,AdvancedMonitoring,AdvancedmonitoringcanbeperformedusingthedefaultCiscoIOSHTTPserverinterface.RequiresknowledgeofCiscoIOSCLIcommands.,showcryptoisakmpsa,ListsactiveIKEsessions,showcryptoipsecsa,ListsactiveIPsecsecurityassociations,router#,router#,Troubleshooting,AdvancedtroubleshootingcanbeperformedusingtheCiscoIOSCLI.RequiresknowledgeofCiscoIOSCLIcommands.,debugcryptoisakmp,router#,DebugsIKEcommunication,debugaaaauthentication,router#