Cisco PIX 525 Especificações descarregar pdf (Página 413)

B-9

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Appendix B Configuration Examples for Other Remote Access Clients

L2TP with IPSec in Transport Mode

L2TP Overview

Layer 2 Tunneling Protocol (L2TP) is a VPN tunneling protocol which allows remote clients to use the

public IP network to securely communicate with private corporate network servers. L2TP uses PPP over

UDP (port 1701) to tunnel the data. L2TP protocol is based on the client/server model. The function is

divided between the L2TP Network Server (LNS), and the L2TP Access Concentrator (LAC). The LNS

typically runs on a network gateway such as a router, while the LAC can be a dial-up Network Access

Server (NAS), or a PC with a bundled L2TP client such as Microsoft Windows 2000.

PIX Firewall with L2TP/IPSec support provides the capability to deploy and administer an L2TP VPN

solution alongside the IPSec VPN and PIX

Firewall services in a single platform. To implement L2TP,

perform the following steps:

1. Configure IPSec transport mode to enable IPSec with L2TP.

2. Configure L2TP with a virtual private dial-up network VPDN group.

The primary benefit of configuring L2TP with IPSec in a remote access scenario is that remote users can

access a VPN over a public IP network without a gateway or a dedicated line, enabling remote access

from virtually anyplace with POTS. An additional benefit is that the only client requirement for VPN

access is the use of Windows 2000 with Microsoft Dial-Up Networking (DUN). No additional client

software, such as Cisco VPN client software, is required.

The configuration of L2TP with IPSec supports certificates using the pre-shared keys or RSA signature

methods, and the use of dynamic (as opposed to static) crypto maps. This summary of tasks assumes

completion of IKE, as well as pre-shared keys or RSA signature configuration. See “

Xauth with RSA

Ace/Server and RSA SecurID” for the steps to configure pre-shared keys, RSA, and dynamic crypto

maps.

Note L2TP with IPSec, as introduced with PIX Firewall Version 6.0, allows the L2TP LNS to interoperate

with the Windows 2000 L2TP client. Interoperability with LACs from Cisco and other vendors is

currently not supported. Only L2TP with IPSec is supported, native L2TP itself is not supported on

PIX

Firewall.

If the PIX Firewall IPSec lifetime is set to less than 300 seconds, then the Windows 2000 client ignores

it and replaces it with a 300 second lifetime because the minimum IPSec lifetime supported by the

Windows 2000 client is 300 seconds.

IPSec Transport and Tunnel Modes

IPSec can be configured in tunnel mode or transport mode. In IPSec tunnel mode, the entire original IP

datagram is encrypted, and it becomes the payload in a new IP packet. This mode allows a network

device, such as a router, to act as an IPSec proxy. That is, the router performs encryption on behalf of

the hosts. The source router encrypts packets and forwards them along the IPSec tunnel. The destination

router decrypts the original IP datagram and forwards it on to the destination system. The major

advantage of tunnel mode is that the end systems do not need to be modified to receive the benefits of

IPSec. Tunnel mode also protects against traffic analysis; with tunnel mode, an attacker can only

determine the tunnel endpoints and not the true source and destination of the tunneled packets, even if

they are the same as the tunnel endpoints.

In IPSec transport mode, only the IP payload is encrypted, and the original IP headers are left intact.

(See

Figure B-4.) This mode has the advantage of adding only a few bytes to each packet. It also allows

devices on the public network to see the final source and destination of the packet. With this capability,

you can enable special processing (for example, QoS) on the intermediate network based on the

1 2 ... 408 409 410 411 412 413 414 415 416 417 418 ... 465 466

Comentários a estes Manuais

Sem comentários

Cisco PIX 525 Especificações Página 413

Comentários a estes Manuais

Manuais e produtos relacionados com Sistemas de segurança - controlo de acesso Cisco PIX 525