IPSec VPN Design By Vijay Bollapragada, Mohamed Khalid, Scott Wainner Publisher : Cisco Press Pub Date : April 07, 2005 ISBN : 1-58705-111-7 Pages : 384 Master IPSec-based Virtual Private Networks with guidance from the Cisco Systems® VPN Solutions group Understand how IPSec VPNs are designed, built, and administered Improve VPN performance through enabling of modern VPN services such as performance, scalability, QoS, packet processing, multicast, and security Table of • Contents • Index Integrate IPSec VPNs with MPLS, Frame Relay, and ATM technologies As the number of remote branches and work-from-home employees grows throughout corporate America, VPNs are becoming essential to both enterprise networks and service providers IPSec is one of the more popular technologies for deploying IP-based VPNs IPSec VPN Design provides a solid understanding of the design and architectural issues of IPSec VPNs Some books cover IPSec protocols, but they do not address overall design issues This book fills that void IPSec VPN Design consists of three main sections The first section provides a comprehensive introduction to the IPSec protocol, including IPSec Peer Models This section also includes an introduction to site-to-site, network-based, and remote access VPNs The second section is dedicated to an analysis of IPSec VPN architecture and proper design methodologies Peer relationships and fault tolerance models and architectures are examined in detail Part three addresses enabling VPN services, such as performance, scalability, packet processing, QoS, multicast, and security This book also covers the integration of IPSec VPNs with other Layer 3 (MPLS VPN) and Layer 2 (Frame Relay, ATM) technologies; and discusses management, provisioning, and troubleshooting techniques Case studies highlight design, implementation, and management advice to be applied in both service provider and enterprise environments IPSec VPN Design By Vijay Bollapragada, Mohamed Khalid, Scott Wainner Publisher : Cisco Press Pub Date : April 07, 2005 Table of • ISBN : 1-58705-111-7 Contents Pages : 384 • Index Copyright About the Authors About the Technical Editors Acknowledgments This Book Is Safari Enabled Icons Used in This Book Command Syntax Conventions Introduction Chapter 1 Introduction to VPNs Motivations for Deploying a VPN VPN Technologies Summary Chapter 2 IPSec Overview Encryption Terminology IPSec Security Protocols Key Management and Security Associations Summary Chapter 3 Enhanced IPSec Features IKE Keepalives Dead Peer Detection Idle Timeout Reverse Route Injection Stateful Failover IPSec and Fragmentation GRE and IPSec IPSec and NAT Summary Chapter 4 IPSec Authentication and Authorization Models Extended Authentication (XAUTH) and Mode Configuration (MODE-CFG) Mode-Configuration (MODECFG) Easy VPN (EzVPN) Digital Certificates for IPSec VPNs Summary Chapter 5 IPSec VPN Architectures IPSec VPN Connection Models Hub-and-Spoke Architecture Full-Mesh Architectures Summary Chapter 6 Designing Fault-Tolerant IPSec VPNs Link Fault Tolerance IPSec Peer Redundancy Using SLB Intra-Chassis IPSec VPN Services Redundancy Summary Chapter 7 Auto-Configuration Architectures for Site-to-Site IPSec VPNs IPSec Tunnel Endpoint Discovery Dynamic Multipoint VPN Summary Chapter 8 IPSec and Application Interoperability QoS-Enabled IPSec VPNs VoIP Application Requirements for IPSec VPN Networks IPSec VPN Architectural Considerations for VoIP Multicast over IPSec VPNs Summary Chapter 9 Network-Based IPSec VPNs Fundamentals of Network-Based VPNs The Network-Based IPSec Solution: IOS Features Operation of Network-Based IPSec VPNs Network-Based VPN Deployment Scenarios Summary Index Copyright IPSec VPN Design Vijay Bollapragada, Mohamed Khalid, Scott Wainner Copyright© 2005 Cisco Systems, Inc Cisco Press logo is a trademark of Cisco Systems, Inc Published by: Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA All rights reserved No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without written permission from the publisher, except for the inclusion of brief quotations in a review Printed in the United States of America 1 2 3 4 5 6 7 8 9 0 First Printing April 2005 Library of Congress Cataloging-in-Publication Number: 2002106378 ISBN: 1-58705-111-7 Warning and Disclaimer This book is designed to provide information about IPSec VPN design Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is implied The information is provided on an "as is" basis The authors, Cisco Press, and Cisco Systems, Inc shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book or from the use of the discs or programs that may accompany it The opinions expressed in this book belong to the author and are not necessarily those of Cisco Systems, Inc Corporate and Government Sales Cisco Press offers excellent discounts on this book when ordered in quantity for bulk purchases or special sales For more information, please contact U.S Corporate and Government Sales, 1-800-382-3419, corpsales@pearsontechgroup.com For sales outside the U.S., please contact International Sales at international@pearsoned.com Trademark Acknowledgments All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized Cisco Press or Cisco Systems, Inc cannot attest to the accuracy of this information Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark Feedback Information At Cisco Press, our goal is to create in-depth technical books of the highest quality and value Each book is crafted with care and precision, undergoing rigorous development that involves the unique expertise of members from the professional technical community Readers' feedback is a natural continuation of this process If you have any comments regarding how we could improve the quality of this book, or otherwise alter it to better suit your needs, you can contact us through email at feedback@ciscopress.com Please make sure to include the book title and ISBN in your message We greatly appreciate your assistance Publisher John Wait Editor-in-Chief John Kane Cisco Representative Anthony Wolfenden Cisco Press Program Manager Jeff Brady Executive Editor Brett Bartow Production Manager Patrick Kanouse Development Editor Grant Munroe Project Editor Sheila Schroeder Copy Editor Michelle Grandin Technical Editors Anthony Kwan, Suresh Subbarao, Michael Sullenberger Team Coordinator Tammi Barnett Cover Designer Louisa Adair Composition Mark Shirar Indexer Tim Wright Corporate Headquarters Cisco Systems, Inc 170 West Tasman Drive San Jose, CA 95134 - 1706 USA www.cisco.com Tel: 408 526-4000 800 553-NETS(6387) Fax: 408 526-4100 European Headquarters Cisco Systems International BV Haarlerbergpark Haarlerbergweg 13-19 1101 CH Amsterdam The Netherlands www.europe.cisco.com Tel: 31 0 20 357 1000 Fax: 31 0 20 357 1100 Americas Headquarters Cisco Systems, Inc 170 West Tasman Drive San Jose, CA 95134-1706 USA www.cisco.com Tel: 408 526-7660 Fax: 408 527-0883 Asia Pacific Headquarters Cisco Systems, Inc Capital Tower 168 Robinson Road #22-01 to #29-01 Singapore 068912 www.cisco.com Tel: +65 6317 7777 Fax: +65 6317 7799 Cisco Systems has more than 200 offices in the following countries and regions Addresses, phone numbers, and fax numbers are listed on the Cisco.com Web site at www.cisco.com/go/offices Argentina • Australia • Austria • Belgium • Brazil • Bulgaria • Canada • Chile • China PRC • Colombia • Costa Rica • Croatia • Czech Republic • Denmark • Dubai, UAE • Finland • France • Germany • Greece • Hong Kong SAR • Hungary • India • Indonesia • Ireland • Israel • Italy • Japan • Korea • Luxembourg • Malaysia • Mexico • The Netherlands • New Zealand • Norway • Peru • Philippines • Poland • Portugal • Puerto Rico • Romania • Russia • Saudi Arabia • Scotland • Singapore • Slovakia • Slovenia • South Africa • Spain • Sweden • Switzerland • Taiwan • Thailand • Turkey • Ukraine • United Kingdom United States Venezuela Vietnam Zimbabwe Copyright â 2003 Cisco Systems, Inc All rights reserved CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, the Cisco Systems Verified logo, Cisco Unity, Follow Me Browsing, FormShare, iQ Net Readiness Scorecard, Networking Academy, and ScriptShare are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, The Fastest Way to Increase Your Internet Quotient and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient IOS, IP/TV, iQ Expertise, the iQ logo, LightStream, MGX, MICA, the Networkers logo, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, SlideCast, SMARTnet, Strata View Plus, Stratm, SwitchProbe, TeleRouter, TransPath, and VCO are registered trademarks of Cisco Systems, Inc and/or its affiliates in the U.S and certain other countries All other trademarks mentioned in this document or Web site are the property of their respective owners The use of the word partner does not imply a partnership relationship between Cisco and any other company (0303R) Printed in the USA Dedications Vijay Bollapragada: To my best friend and wife, Leena, for her love and encouragement and for allowing me to take precious family time away to write this book To my two lovely children, Amita and Abhishek, to my parents for instilling the right values in me, and all my wonderful friends Thanks to my coauthors, Mo and Scott, for bearing with me during the trials and tribulations of book writing and teaching me things along the way And thanks to the awesome folks I work with at Cisco that constantly keep me challenged and remind me that there is something new to learn everyday Mohamed Khalid: First and foremost, I would like to acknowledge my parentstheir dedication, sacrifice, and encouragement have been instrumental in all my achievements Index [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [P] [Q] [R] [S] [T] [V] [X] MAC (message authentication code) main mode (IKE) message digests messages IKE IKE keepalives XAUTH mGRE interfaces MLPPP (multi-link PPP), fault tolerance on access links MODECFG (mode-configuration) MPLS VPNs multicast over IPSec VPNs DMVPN, configuring full-mesh IP tunnels, configuring group security association group security key management IPSec-protected GRE, configuring multipoint VPNs, establishing 2nd Index [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [P] [Q] [R] [S] [T] [V] [X] NAT (Network Address Translation) effect on AH effect on ESP effect on IKE IPSec pass-through NAT-T native IPSec connectivity model Internet access spoke configuration 2nd Network Extension Mode (EzVPN) client configuration pushing attributes network-based VPNs deployment models FVRF IPSec to L2 VPNs IPSec to MPLS VPN over GRE IVRF PE-PE encryption single IP address on PE enabling with Cisco IOS features crypto keyrings ISAKMP profiles IPSec termination on unique IP address per VRF 2nd limitations of mapping IPSec tunnel into IVRF mapping IPSec tunnels from telecommuter into IVRF MPLS VPN configuration on PE NHRP on hub-and-spoke topologies non-repudiation Index [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [P] [Q] [R] [S] [T] [V] [X] packet classification applying to IPSec transport mode to IPSec tunnel mode attribute preservation of GRE tunnels internal attribute preservation transitive QoS applied to IPSec packet flow for single IP address on PE network-based VPN deployment model packet size distribution effect on queue bandwidth assignments effect on queue structures packets fragmentation 2nd GRE keepalives IPSec processing on Cisco routers SADB SPD padding PAT (Port Address Translation) configuring to allow ESP payload data field PE-based VPNs deployment models FVRF IPSec to L2 VPNs IPSec to MPLS VPN over GRE IVRF PE-PE encryption single IP address on PE enabling with Cisco IOS features crypto keyrings ISAKMP profiles IPSec termination on unique IP address per VRF 2nd limitations of mapping IPSec tunnel from telecommuter into IVRF mapping IPSec tunnel into IVRF MPLS VPN configuration on PE peer redundancy IPSec stateful failover simple peer redundancy model asymmetric routing problem with Cisco VPN 3000 clustering with GRE with HSRP with SLB PKI (Public Key Infrastructure) PMTUD pre-shared key authentication (IKE) private networks, NAT effect on AH IPSec pass-through NAT-T processing packets on Cisco routers SADB SPD public key algorithms public key encryption, digital signatures public networks PVCs (permanent virtual circuits) Index [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [P] [Q] [R] [S] [T] [V] [X] QoS packet classification applying to IPSec transport mode applying to IPSec tunnel mode attribute preservation of GRE tunnels internal attribute preservation transitive QoS applied to IPSec packet size distribution effect on queue bandwidth assignments effect on queue structures Quick Mode (IKE phase 2) Index [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [P] [Q] [R] [S] [T] [V] [X] redundancy stateful stateless TED peer recovery remote access client connection model hub-and-spoke architecture EzVPN client mode EzVPN Network Extension mode remote access VPNs restricted ESP passing through PAT revocation of digital certificates RFC 2401, packet processing RRI (Reverse Route Injection) and HSRP configuring Index [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [P] [Q] [R] [S] [T] [V] [X] SADB (Security Association Database) 2nd SAs IKE IPSec synchronization SADB transfer SAs (security associations) idle timeout, configuring IKE phase 1 operation Aggressive mode authentication methods digital signature authentication main mode pre-shared key authentication IKE phase 2 operation, Quick Mode IPSec scalability of client connectivity model of GRE hub-and-spoke model of IPSec VPN hub-spoke model security authentication digital certificates MODECFG XAUTH 2nd group security associations group security key management sequence numbers serialization delay simple peer redundancy model asymmetric routing problem site-to-site architectures, VoIP over IPSec protected GRE site-to-site VPNs GRE connection model IPSec connection model remote access client connection model SLB (Server Load Balancing), peer redundancy SPD (Security Policy Database) SPI (security parameter index) split tunneling spoke configuration for GRE model 2nd for GRE with spoke default routing for native IPSec connectivity model 2nd for spoke-to-spoke connectivity GRE model with dynamic routing spoke sites, configuring SSO (Stateful Switch Over), configuring SSP (State Synchronization Protocol) standby track command stateful failover 2nd configuring with SSO configuring with SSP SADB synchronization SADB transfer stateful IPSec redundancy stateless IPSec redundancy SVCs (switched virtual circuit) symmetric cryptographic algorithms Index [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [P] [Q] [R] [S] [T] [V] [X] TED (Tunnel Endpoint Discovery) auto-configuring site-to-site IPSec VPNs configuring limitations of redundant peer recovery transit site-to-site connectivity on GRE connection model with Internet access transit spoke-to-spoke connectivity crypto map files, designing hub configuration spoke configuration transport mode AH tunnel mode two factor authentication Index [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [P] [Q] [R] [S] [T] [V] [X] virtual circuits virtual IPSec peer model VoIP application requirements for IPSec VPN networks delay jitter loss decoupled VoIP and data architectures engineering best practices hub-and-spoke architectures over DMVPN architecture over IPSec remote access over IPSec-protected GRE architectures VPNs network-based deployment models 2nd enabling with Cisco IOS features IPSec termination on unique IP address per VRF 2nd limitations of mapping IPSec tunnel from telecommuter into IVRFF mapping IPSec tunnel into IVRF MPLS VPN configuration on PE Index [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [P] [Q] [R] [S] [T] [V] [X] XAUTH (extended authentication) 2nd ... Copyright IPSec VPN Design Vijay Bollapragada, Mohamed Khalid, Scott Wainner Copyright© 2005 Cisco Systems, Inc Cisco Press logo is a trademark of Cisco Systems, Inc Published by: Cisco Press 800 East 96th Street... Digital Certificates for IPSec VPNs Summary Chapter 5 IPSec VPN Architectures IPSec VPN Connection Models Hub-and-Spoke Architecture Full-Mesh Architectures Summary Chapter 6 Designing Fault-Tolerant IPSec VPNs... Multicast over IPSec VPNs Summary Chapter 9 Network-Based IPSec VPNs Fundamentals of Network-Based VPNs The Network-Based IPSec Solution: IOS Features Operation of Network-Based IPSec VPNs Network-Based VPN Deployment Scenarios