Lecture CCNA security partner - Chapter 14: Site-to-Site IPsec VPNs with Cisco IOS Routers

Chapter 14. Site-to-Site IPsec VPNs with Cisco IOS Routers © 2012 Cisco and/or its affiliates. All rights reserved. 1 Contents This chapter teaches you how to configure a site-to-site IPsec VPN with preshared keys, using Cisco Configuration Professional. This ability includes being able to meet these objectives: • Evaluate the requirements and configuration of site-to-site IPsec VPNs • Use Cisco Configuration Professional to configure site-to-site IPsec VPNs • Use CLI commands and Cisco Configuration Professional monitoring options to validate the VPN configuration • Use CLI commands and Cisco Configuration Professional monitoring options to monitor and troubleshoot the VPN configuration © 2012 Cisco and/or its affiliates. All rights reserved. 2 Site-to-Site IPsec VPN Operations IPsec VPN negotiation can be broken down into five steps,including Phase 1 and Phase 2 of Internet Key Exchange (IKE): Step 1. An IPsec tunnel is initiated when HostA sends “interesting” traffic to Host B. Traffic is considered interesting when it travels between the IPsec peers and meets the criteria that is defined in the crypto access control list (ACL). Step 2. In IKE Phase 1, the IPsec peers (routersAand B) negotiate the established IKE SApolicy. Once the peers are authenticated, a secure tunnel is created using ISAKMP. Step 3. In IKE Phase 2, the IPsec peers use the authenticated and secure tunnel to negotiate IPsec SA transforms. The negotiation of the shared policy determines how the IPsec tunnel is established. Step 4. The IPsec tunnel is created and data is transferred between the IPsec peers based on the IPsec parameters configured in the IPsec transform sets. Step 5. The IPsec tunnel terminates when the IPsec SAs are deleted or © 2012 Cisco and/or its affiliates. All rights reserved.e expires. 3 Site-to-Site IPsec VPN © 2012 Cisco and/or its affiliates. All rights reserved. 4 Planning and Preparation Checklist • Verify connectivity between peers • Define interesting traffic • Determine the cipher suite requirements • Manage monitoring, troubleshooting, and change © 2012 Cisco and/or its affiliates. All rights reserved. 5 ... - tailieumienphi.vn