Enterasys Networks X-PeditionTM VPN Configuration Overview, Master Encryption Key Generation

VPN Configuration Overview

•Authentication, Authorization, and Accounting (AAA) support including AAA per interface (for clients), AAA for PPP, and AAA debugging

•Dynamic Host Configuration Protocol (DHCP) support

– DHCP Server

•OSPF over VPN

•DF Bit override on IPSec tunnels

•Copy TOS byte support (refer to“Configuring Quality of Service” on page 12-1for a configuration examples)

•QoS on VPN (refer to“Configuring Quality of Service” on page 12-1for more information)

VPN Configuration Overview

IPSec configuration entails the following basic steps. First, decide what type of VPN you want to configure from the following choices:

•Site-to-Site(Peer-to-Peer) using either pre-shared key or digital certificate (PKI) authentication

•EZ-IPSecusing Client or Network Extension mode

•Remote Access using either L2TP/IPSec or PPTP

Consider that in Site-to-Site applications, the XSR can act as a gateway, or terminator, of tunnels and also as the client, or initiator, of tunnels. In Remote Access applications, the router can only act as a server.

Next, perform the following:

•Generate a master encryption key once on the XSR.

•Define ACLs to specify the type of traffic to be secured.

•Specify policies - IKE and IPSec transform-setsspell out authentication, encryption, data integrity, policy lifetime, and other values when negotiating Security Associations (SAs) with IPSec peers.

•Create a Security Policy Database (SPD) by configuring crypto maps, transform-sets, and ACLs.

•Configure authentication via AAA and/or PKI.

•Set up optional auxiliary functions including RADIUS, IP address assignment, and NAT.

•Configure a VPN interface, if required.

Master Encryption Key Generation

The XSR stores sensitive data such as user names, passwords, and certificates in Flash: directory files. Retaining this data in the clear would pose a security risk, so the XSR uses the master encryption key to encode it. The XSR is not supplied with a master encryption key at the factory - you must manually generate it before configuring VPN. To do so:

14-20 Configuring the Virtual Private Network