5.VPN实验 GETVPN-Work Blog

VPN 实验 GETVPNtR,-t& 10 ，． 10 生 4 CCSPVPN 实验现任明教教主出品大型企业网部署 1 1 ．， 024 VPN 101 ． 7 ．伊 24 100 ． 4 还 / 24 10 ，， 024 VPN 实验 GETVPNiR4 CCSP VPNR-• 现任明教教主出品 QoS 在企业网内的部署伊卜 0 以 d VPN 实验 CCSPVPN 实验现任明教教主出品 GETVPNii-4 传统 IPSec 问题 —:QOS ， 0 性 RTP 0 《以巫《不门娥 VPN 实验 CCSP VPN 实验现任明教教主出品 GETVPNÄ-# 传统 | PSec 问题二：点对点 SA 传统旧 S VPN 使用点对， "JSA 如无 A 、 T 孬朊 3 ．丸法加诩矚流《无法区连 0 VPN GETVPNtR4 CCSPVPNN •.0verlay Routing 'SCIPSec VPNfEjtjOver1ay Routing c, MN-s VPN VPN 实验 GETVPNÄ-•# CCSP VPN 实验现任明教教主出品 GETVPN 特点 1 ．基于现有路由架构的透传解决方案。 2 」 p Header Preservation 技术，实现 IP 卖保留《 2 ．不影响 QOS ，不增加网络开销和复杂 00 、 4．基于 Trusted Group Members 的概念 HEGroup 内的 Routerff 用相同的安全策略，比点对卓 VPN 管理更简单。 5 ． Group 内成员预先协商安全参数 (IPSEC (A) ，实现 any-to-any 连接。 2 ．即时连接，减少类似于语音流量的延时。 6 ．支持对单播和组播的加密。 7 ．是一个 WAN 解决方案，需要全局可路山，个人观点不支持 internet. VPNN GETVPNÄ+ CCSPVPNN IPsec Tunnel Mode with Address Preservation F Packet Encrypted Transpon IP Header Copy of Original ESP cp Header IP Payload IP Payload • IPsec header pres rved by VPN Gateway • Preserved IP address uses original routing plane $C:\F1B412C5\6ED9EDAF-B95F-4C25-AB35-9945FFB79FC5.files\image010.png$ GETVPN±żô ccspvPN" TJSA 1c.1.t.2. GETVPNfQIJKStŕ VPN VPNi* GETVPNii4 Net I 10.1_1.0/24 OSPF ative Routing 10.1.6.0,'24 ccsp :Native Routing GETVPN Wd Native Routing tive Routing MPLS VPN VPNN GETVPNtR4 CCSPVPNN GETVPN VS (O IPSÉC Peers IKE! IPSEC any-to—a v overlay routing tunnel overlay åny—to-any co any-to—any native routing ( IP header preservation , ipsec tunnel overlay 411 IP header preservation, VPNN GET VPNiR4 ccsp VPNN Group Security Functions Routing Member Key Server • Validate Group Members • Manage Security Policy • Create Group Keys • Distribute Policy K Group Member roup Member • Encryption Devices • Route Between Secure I Unsecure Regions • Multicast Participation Key coo Routinj•.. • Forwarding • Replication • Routing Group Member Group Group VPNN CCSPVPNN Group Security Elements Group Pdicy Encryptcn (ey Group Group Dcmain Of Interpretation CDC)' Routinj•.. Members (ietary• KS alive Protocol Group Wmber Group VPNit* GETVPNii4 CCSPVPNN GDOI Protocol GDOI Protocol RFC3547 Definitions is a •Grot. Me,rntær• Receiver or GCKS is 'Key • GROUPKEY Registration)' . XO . Gro•.o W mt»r Info Key Serve Supplies GroLV Member a,rÉ asks Keys Key Servg Keys • GROUPKEY-PUSH (a.k.a Rekey) Key Server refreshes Keys arÜ'or Poky VPN 实验 GETVPNii4 CCSP VPN-': 验现任明教教主出品 GETVPN 注册过程 1 ．每一个组成员发送注册请求到密钥服务器。过 GDOI 协议，密钥服务器对组成员认证和授权，并且发策和里于加解密 | P 单播和组播的密钥。 ` 触发注册的条件： 1 ． GM 启；在 GM 接口调用 0 pto map> 2 ．当组成员注册成功获取 IPSecSA 后，就会获取相应的密钥，组成员之间能够直接加密 IP 组播和单播，旁路掉密钥服务器直接建立安全的通讯。 TEK 用于加蜜组成员之间的流量！ 3 ．如果需要，密钥服务器发送密钥史新信息 (rekey message) 到组内的所有成员。这个密钥更新信息包含新的 ] PSec 策略和当前 | PSecSA 超时以后使用的更新的密钥，密钥更新信息会在 SA 超时之前发送，保障组密钥一直可用！ VPNN CCSPVPNN GETVPNiR4 Group Keys • Key Encryption Key (KEK) I-Jsed to encrypt GDOI (i.e. con traffc) between KS and CM • Traffc Encryption Key (tEK) co Used to encrypt data . used traffic) between 9M' IP VPN Group M.mt»r Group VPNi* GETVPNiR4 GETVPN XSA 1. IKE Phasel Policy Rekey SA policy 3. IPSec SA Policy 1 u IKF Phasel Policy GM c, REKEY SA Key : IPSec SA Key : TEK VPNN CCSPVPN-X-• Cooperative Key Server Primary: Elected by eligible set of KS jlÄlSecondaWKS , Secondary: Eligible KS in cooperative state for a group Prima@ Secondary Group Member GET VPN Group Member Secondary VPNit* GETVPNti4 CCSPVPNN Cooperative Key Server Protocol I.ISAKMP Phase 1 • Authentication PSK or PKI • IKE Security Assoc. 2.COOP Process • Announcement Messages • Election • Policy and Key Creation nou Primary KS (partitioned) Secondary KS (reboot) Secondary ndary Primary KS Kev VPNN GETVPNiR4 Policy Synchronization Policy Synchronization Requirements: 1. KS MUST use the same ?hared RSA key pair 2. Cooperative KS MUSThave matching policies including • Proxy Identities . Transforms Lifetimes VPNN GETVPNiR4 CCSPVPN" Rekey 1. RekeyEhPrimary KS$lihfrk0 2. Policies, Jimeync, or New Keyso KEKfi{JReken TEKMJReke • Multicast Rekey ( {Ri,kfijt) Unicast Rekey 5. VPNit* GETVPN-±R+ Counter-Based Anti-Replay CCSPVPNN 1. 2. 00 00. Time-Based Anti-Replav GM's automatically synchronize their group pseudo- time to 'KS Group Time' during GDOI-REISEY Initial PTr - W PTr Anti-replay window PTr W VPN 实验 GETVPNtR4 1014 CCSP VPN 实验现任明教教主出品 GETVPN 实验拓扑 10440 ／ Network 100 ． 1.1 、 0 / 24 VPNN GETVPNtR4 STEP I hostname KSI interface LoopbackO iP address 10.1.101.1 25055.2550 ip ospf network point-to-poirYD interface FastEthernetO/O ip address 100.1.1.101 255.255.255.0 no shutdown router ospf I log-adjacency-changes network 10.1.101.0 0.0.0.255 area O network 100.1.1.0 0.0.0.255 area O ccspvPNg• (KSI) VPNN GETVPNtR4 STEP I hostname KS2 interface LoopbackO iP address 10.1.102.1 255255.2550 ip ospf network point-to-poinyes interface FastEthernetO/O ip address 400.1.1.102 255.255.255.0 no shutdown router ospf I log-adjacency-changes network 10.1.102.0 0.0.0.255 area O network 100.1.1.0 0.0.0.255 area O ccspvPN.g• (KS2) VPNN GETVPNtR4 STEP I hostname GMI interface LoopbackO iP address 10.1.1.1 255.255.2559) ip ospf network point-to-panpy interface FastEthernetO/O ip address 100.1.1.1 255.255.255.0 no shutdown router ospf I log-adjacency-changes network 10.1.1.0 0.0.0.255 area O network 100.1.1.0 0.0.0.255 area O CCSPVPN.N (GMO VPNN GETVPNiR4 STEP I hostname GM2 interface LoopbackO iP address 10.1.2.1 255.255.2559) ip ospf network point-to-poinyts interface FastEthernetO/O ip address 100.1.1.2 255.255.255.0 no shutdown router ospf I log-adjacency-changes network 10.1.2.0 0.0.0.255 area O network 100.1.1.0 0.0.0.255 area O CCSPVPN" (GM2) VPNN GETVPNtR4 STEP I hostname GM3 interface LoopbackO iP address 10.1.3.1 255255.2559) ip ospf network point-to-pon!ö interface FastEthernetO/d ip address<OO.1.1.3 255.255.255.0 no shutdown router ospf I log-adjacency-changes network 10.1.3.0 0.0.0.255 area O network 100.1.1.0 0.0.0.255 area O CCSPVPN.N (GM3) $VPNi* GETVPNtR4 KSI (config)#ip domain-name mingjiao.org ccsp (KSI) KSI(config)#crypto key generate rsa modLJIus102410béI getvpnkey exportable KSI (config)#crypto key exportrså getyöG\ % Key getvpnkey purpæe Key Key data —BEGIN PUBLIC —END PUBLIC KEY— —BEGIN RSA PRIVATE KEY— Proc-Type: 4 ENCRYPTED DEK-lnro: DES-EDE3-CEC.6CA5AAE699604971 —END RSA PRIVATE KEY— pem terminal 3des ey$ VPNN GETVPNtR4 ccsp VPN-N (KS2) I occies key import rsa getvpn key % Entg public Geneal purpose key or cert"cate_ % End wth a blank line •qur a line by —BEGIN PUBLIC KEY— —END PUBLIC KEY— % Ent« Gen«al Purpse key. % End wdh "quit" a Wie by tself. —BEGIN RSA PRIVATE proc-Type: 4.ENCRYPTED DEK-lnfo: DES-EDE3-CBC.6CA5AAE699604971 RSA PRIVATE % Key paw irnp«t VPNN GETVPN±R+ CCSPVPNN STEP4:æYlPSec Profile (KSI) KSI access-list extended getvpntraffiC KSI ip 10.1 .o„p 09?55.25560.1.O.0 0.0.255.255 IPSec Profile (IPSec SA Policy, : KS 1 (config)#crypto ipseg transform-set cisco esp-des esp-md5-hmac KS I iPsec profile ipsecprof KS 1 (ipsec-profile)#set transform-set Cisco VPNit* GETVPNiR4 ccspvPNN (KSI) KS I gdoi group mygroup @J2GD01 Group KS I number 88888 Group ID KS 1 (config-gdoi-group)#server local KSI ipv4 100. I .9.101 VPNN GETVPNii4 CCSPVPN" (KSI) KS 1 authentication mypubkey rsa Rekey NJ RSAæ KS1(gdoi-local-server)#rekey algOrithrri aes 256 ævjRekey (Rekey SA) KSI (gdoi-local-server)#rekey transport unicast KS 1 (config)#access-list 106 permit udp host 202.100.1.100 eq 848 host 239.0.1.2 eq 848 KSI address ipv4 106 VPN 实验 GETVPN±R+ CCSPVPN-T-• 现任明教教主出品 STEP7: 配置 IPSec SA 策略 (KSI ） KSI (gd01-local-server)#sa ipsec 1 配置第一个 IPSecSA 策略（可以配置更多 KSI (gdOi-sa-iPSeC)#matCh address iPV4 getvpntraffiC 匹配感兴趣流 KSI (gdoi-sa-ipsec)#profile ipsecprof 配置处理感兴趣流的策略 KSI (gdoi-sa-ipsec)#replay time window-size 3 启用基于时间的防重放技术（可选配置） VPNi* GETVPNiR4 ccsp STEP8:GrvmdY2 (FTrfiGM) GMI(config)#crypto map cisco 10 gdoi (GDOIhcr9pto TEK) GMI group mygroup hCWNGDPIGroup) GMI (config-crypto-map)#exit GM' fa0/0 ) GMI ciscc» VPNN GETVPNiR4 CCSPVPNN GM I (config)#interface fastEthernet 0/0 GM1(config-if)#crypto map Cisco (UÆcrypto •Mar 1 start registration to KS 100. I. I. 101 for group mygroup using address 100.1. I. I *Mar 1 %CRYPTO-6-GD01 ON_OFF: GDOI is ON •Mar 1 Group mygroup transitioned to Unicast Rekey. •Mar 1 Registration to KS 100.1.1.101 complete for group mygroup using address 100M 1.1 VPNN GETVPN-ti4 CCSPVPN" LISTifiJ (ks members) KS I#show crypto gdoi ks members Group Member Information : Number of rekeys sent tor group mygroup . I Grocp N•lember ID Group ID Group Name Key Server ID Group Elember ID Group ID GrolQ Name Key Server ID Group Elember ID GroLQ ID Gr014) Name Key Server ID : 100.1.1.1 : 100.%.2 100.1.1.101 : 100.1.1.3 . 100.1.1.101 VPNit* GETVPNiR+ CCSPVPNN GMfü,UTifiJ (show crypto gdoi) IPSec SR t Server Server lis it 10.1 me KFX PM rcv t Type Life t i " Sig Sig .1.e.o e.ø.&. VPNi* GETVPNiR4 ccsp GMfÜ,UTifiJ ( gdoi ipsec sa ) crypto gdoi ipsec sa created for FastE ther t 0/ ro oco local ident 0.0/16, port 0 direction: th replay method/window) : Time/3 sec VPNit* GETVPNti4 ÅdHCoop Key Server (KSI ) KS I gdoi group mygroup KS 1 local KS I KS I address PO 00.1.1.102 KS 1 priority 100 VPNN GETVPNtR4 CCSPVPNN æYCoop Key Server (KS2) KS2(config)#crypto gdoi group mygroup local ipv4 '60.1. . address ipv4 100.1. I. 101 KS I priority 75 Secondary KS