Patton electronic 2800 user manual Authentication, Encryption

Page 68

OnSite 2800 Series User Manual

6 • VPN configuration

 

 

Introduction

This chapter describes how to configure the VPN connections between two OnSite routers or between an OnSite and a third-party device.

A virtual private network (VPN) is a private data network that uses the public telecommunications infrastruc- ture, maintaining privacy through the use of a tunneling protocol and security procedures.

There are different technologies to implement a VPN. OnSite applies the internet protocol security (IPsec) Architecture (see RFC 2401). The following sections describe the main building blocks of the IPsec architec- ture as implemented in OnSite router.

Authentication

Authentication verifies the integrity of data stream and ensures that it is not tampered with while in transit. It also provides confirmation about data stream origin.

Two authentication protocols are available:

Authentication header (AH): protects the IP payload, the IP header, and the authentication header itself

Encapsulating security payload (ESP): protects the IP payload and the ESP header and trailer, but not the IP header

Two algorithms perform the authentication:

HMAC-MD5-96: is a combination of the keyed-hashing for message authentication (HMAC) and the message digest version 5 (MD5) hash algorithm. It requires an authenticator of 128-bit length and calculates a hash of 96 bits over the packet to be protected (see RFC 2403).

HMAC-SHA1-96: is a combination of the (HMAC) and the secure hash algorithm version 1 (SHA1). It requires an authenticator of 160 bit length and calculates a hash of 96 bits over the packet to be protected (see RFC 2404).

Encryption

Encryption protects the data in transit from unauthorized access. Encapsulating security payload (ESP) is the protocol to transport encrypted IP packets over IP (see RFC 2406).

The following encryption algorithms are available:

 

 

Key Length [Bit]

RFC

 

 

 

 

DES-CBC (Data Encryption Standard - Cipher Block Chaining)

56

2405

3DES-CBC (Triple Data Encryption Standard - Cipher Block Chaining)

128 or 192a

1851

AES-CBC (Advanced Encryption Standard - Cipher Block Chaining)

128, 192, or 256

3268

 

 

 

 

a.The 3DES algorithm uses only 112 out of the 128 Bit or 168 out of the 192 Bit as key information. Cisco only supports 192 Bit keys with 3DES.

The single DES algorithm no longer offers adequate security because of its short key length (a minimum key length 100 bits is recommended). The AES algorithm is very efficient and allows the fastest encryption. AES with a key length of 128 bits is therefore the recommended algorithm.

Introduction

68

Image 68
Contents Managed VPN Router Mailsupport@patton.com Summary Table of Contents Table of Contents Getting started with the OnSite Managed VPN Router VPN configuration LEDs status and monitoring 112 Cabling 124 OnSite 2800 Series factory configuration 132 List of Figures List of Tables Structure About this guideAudience Precautions Impaired functioningSafety when working with electricity General observations Typographical conventions used in this document General conventionsChapter contents General informationOnSite Model 2800 Series overview OnSite Managed VPN Router 2805 shownOnSite 2800 Series detailed description OnSite 2800 Series model codesDMZ OnSite 2800 Series power input connectors Model code extensionsPorts descriptions OnSite 2800 Series rear-panel ports are described in tableApplications overview Corporate multi-function virtual private network Corporate multi-function virtual private networkGeneral information Hardware installation Planning the installation Create a network diagram see section Network information onInstallation checklist Power source Site logNetwork information IP related informationInstalling the VPN router Connecting cablesInstalling the Ethernet cable Location and mounting requirementsInstalling the serial WAN cable Connecting an OnSite 2800 Series device to a hubDCD Hardware installation Rear panel of 2803K/EUI Pins not listed are not used Rear panel of 2803K/UIConnecting to external power source Power connector location on rear panelUI and EUI power supplies automatically adjust to accept an Getting started with the OnSite Managed VPN Router Configure IP address IntroductionConfigure IP address Power connection and default configurationAll Ethernet interfaces are activated upon power-up Terminal emulation program settings 9600 bps No parity BitLogin Select the context IP mode to configure an IP interfaceStop bit No flow control Changing the IP addressRespectively from the host ping Load configurationConnect the OnSite VPN Router to the network Load configuration Serial port configuration Serial port configuration task list Disabling an interfaceEnabling an interface Port Configuring the encapsulation for Frame RelayExample Configuring the serial encapsulation type Enter Frame Relay mode Configuring the LMI typeConfiguring the keep-alive interval Entering Frame Relay PVC configuration modeConfiguring the PVC encapsulation type Binding the Frame Relay PVC to IP interfaceMode PVC Enabling a Frame Relay PVC Disabling a Frame Relay PVCDisplaying serial port information CRCDisplaying Frame Relay information DlciIntegrated service access Configure the serial interface settings PortConfigure the introduced PVCs Check that the Frame Relay settings are correctT1/E1 port configuration T1/E1 port configuration task list Enable/Disable T1/E1 portMode port e1t1 slot port Configuring T1/E1 port-typeConfiguring T1/E1 clock-mode Configuring T1/E1 line-codeConfiguring T1/E1 framing Configuring T1/E1 line-build-out T1 onlyConfiguring T1/E1 used-connector E1 only Name prt-e1t1 slot/port# framingConfiguring T1/E1 application mode Configuring T1/E1 LOS thresholdConfiguring T1/E1 encapsulation Default short-haulBe used Mode port e1t1 slot port Configuring Channel-Group TimeslotsMode channel-group group-name Configuring Channel-Group EncapsulationConfiguring Hdlc CRC-Type Configuring Hdlc EncapsulationT1/E1 Configuration Examples Default no encapsulationExample 1 Frame Relay without a channel-group Example 4 PPP with a channel-group Example 2 Framerelay with a channel-groupExample 3 PPP without a channel-group VPN configuration Authentication EncryptionCreating an IPsec transformation profile VPN configuration task listTransport and tunnel modes Procedure To create an IPsec policy profile Creating an IPsec policy profileNodecfg#profile ipsec-policy-man Creating/modifying an outgoing ACL profile for IPsec Configuration of an IP interface and the IP router for IPsec Displaying IPsec configuration informationExample Display IPsec transformation profiles Example Display IPsec policy profilesDebugging IPsec Example IPsec Debug OutputIPsec tunnel, DES encryption Sample configurationsOnSite configuration Cisco router configuration Cisco router configuration VPN configuration Access control list configuration Why you should configure access lists About access control listsWhat access lists do When to configure access lists Features of access control listsAccess control list configuration task list Mapping out the goals of the access control listNodepf-acl name#permit ip src src-wildcard any Where the syntax is Src-wildcardNodepf-acl name#permit icmp src src-wildcard any Type type type type code code cos groupNodepf-acl name#deny icmp src src-wildcard Any host src dest dest-wildcard any host destWhere the syntax is as following Msg nameNodepf-acl name#permit tcp udp sctp src src-wild Card any host src eq port gt port lt port rangePort lt port range from to cos group cos-rtp group Nodepf-acl name#deny tcp udp sctp src srcGroup-data Where the syntax is Debugging an access control list profile Unbind an access control list profile from an interfaceDisplaying an access control list profile Control list profile shall be debugged Examples Denying a specific subnetLink scheduler configuration Configuring access control lists Applying scheduling at the bottleneck Configuring quality of service QoSUsing traffic classes Priority Weighted fair queuing WFQIntroduction to Scheduling Hierarchy ShapingBurst tolerant shaping or wfq Some explanations Setting the modem rateQuick references Link scheduler configuration task list Command cross referenceDefining the access control list profile Packet classificationCreating an access control list Scenario with Web server regarded as a single source hostCreating a service policy profile Nodecfg#profile acl nameNodepf-acl name#permit ip host ip-address any traffic-class Nodepf-acl name#permit ip any anyStructure of a Service-Policy Profile Defining fair queuing weight Specifying the handling of traffic-classesSpecifying the type-of-service TOS field Defining the bit-rateDefining absolute priority Defining the maximum queue lengthSpecifying differentiated services codepoint Dscp marking Specifying the precedence fieldNodesrc name#set ip tos value Nodesrc name#set ip precedence valueNodesrc name#set layer2 cos value Specifying layer 2 markingNodesrc name#set ip dscp value Nodesrc name#random-detect burst-tolerance Defining random early detectionDiscarding Excess Load Policy name in out Devoting the service policy profile to an interfaceNodeif-ip if-name#use profile service Displaying link scheduling profile information Enable statistics gatheringDisplaying link arbitration status Values defining detail of the queuing statistics LEDs status and monitoring Status LEDs Contacting Patton for assistance Patton Support Headquarters in the USA Warranty coverageContact information Out-of-warranty service Returns for creditReturn for credit policy RMA numbersAppendix a Compliance information Safety ComplianceRadio and TV Interference FCC Part CE Declaration of ConformityIndustry Canada Notice Model 2803 only Authorized European RepresentativeFCC Part 68 Acta Statement Model 2803 only Appendix B Specifications Ethernet interfaces Sync serial interfaceT1/E1 interface Model 2803 only PPP supportIP services DimensionsManagement Operating environmentInternal AC version Power supplyInternal power supply 100-240 VAC, 50/60 Hz, 200 mA Appendix C Cabling Connecting a serial terminal Serial consoleEthernet 10Base-T and 100Base-T Ethernet cross-overEthernet straight-through Appendix D Port pin-outs Console port, RJ-45, EIA-561 RS-232 EIA-561 RJ-45 8-pin port RS-232 Console PortEthernet 10Base-T and 100Base-T port Sync serial portEthernet ports are auto-detect MDI-X Serial port21 Female DB-15 connector Appendix E OnSite 2800 Series factory configuration OnSite 2800 Series factory configuration Appendix F Installation checklist Installation checklist
Related manuals
Manual 8 pages 44.23 Kb