Secured

Connectivity

Introducing IPsec

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—4-1

 IPsec Overview

 RFC 2401
 Combines three protocols into a cohesive security framework

Provides a framework for the

IKE negotiation of security
parameters and establishment
of authenticated keys

Provides a framework for the

AH authenticating and securing of
data

Provides a framework for

ESP encrypting, authenticating,
and securing of data

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—4-2

 IPsec Modes

Transport Mode

Original IP ESP ESP ESP

Header TCP Data Trailer
Header Authentication

Encrypted

Authenticated

Tunnel Mode

New IP ESP Original IP ESP ESP

Header Header TCP Data Trailer
Header Authentication

Encrypted
Authenticated

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—4-3

 Authentication Header

 RFC 2402
 IP protocol 51
 Mechanism for providing strong integrity and authentication for IP
datagrams
 Can also provide nonrepudiation

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—4-4

 Encapsulating Security Payload

 RFC 2406
 IP protocol 50
 May provide the following:
– Confidentiality (encryption)
– Connectionless integrity
– Data origin authentication
– An antireplay service

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—4-5

 Internet Key Exchange

 RFC 2409
 A hybrid protocol consisting of:
– SKEME
 A mechanism for using public key encryption for
authentication
– Oakley
 A modes-based mechanism for arriving at an encryption
key between two peers
– ISAKMP
 An architecture for message exchange, including packet
formats and state transitions between two peers
 Phase-based

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—4-6

 How IKE Works
IKE is a two-phase protocol.

IKE Phase 1 SA IKE Phase 2 SA

(ISAKMP SA) (IPsec SA)
Main mode

Secure Data
six messages
OR Quick Mode
Aggressive mode
three messages

Peers negotiate a secure, Security associations are

authenticated negotiated on behalf of
communications channel. IPsec services.

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—4-7

 Internet Security Association and Key
Management Protocol

 RFC 2408
 UDP 500
 Defines procedures for:
– Authenticating a peer
– Creation and management of SAs
– Key generation techniques
– Threat mitigation

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—4-8

 Other Protocols and Terminology

 HMAC
AES
 MD5
CA
 PFS
Certificate
 RSA
CRL
 SHA
Crypto map
 Transform
DES
 Transport mode
3DES
 Tunnel mode
DH
 Hash

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—4-9

 IPsec Configuration Task LIst

 Check network connectivity

 Ensure ACLs lists are compatible with IPsec
– Allow IP protocols 50 and 51
– Allow UDP 500
 Configure IKE
– ISAKMP
 Configure IPsec
– Create crypto ACLs
– Define transform sets
– Create crypto map entries
 Set global lifetimes for IPsec SAs
– Apply crypto map to the interface

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—4-10

 Summary

 IPsec is designed to provide interoperable, high-quality,

cryptographically based security.
 AH is used to provide connectionless integrity and data origin
authentication for IP datagrams.
 ESP is designed to provide a mix of security services in IPv4 and
IPv6.
 IKE is used to establish a shared security policy and
authenticated keys for services (such as IPsec) that require keys.

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—4-11

 Summary (Cont.)

 ISAKMP defines the procedures for authenticating a

communicating peer.
 Other protocols or standards used with IPsec include DES,
HMAC, and MD5.
 IPsec configuration on a Cisco router comprises the configuration
of ISAKMP and IPsec.

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—4-12

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0—4-13