vpn roadshow module 2 3000

VPV RoadshowVPN 3005 Concentrator Private Public 100–240V power supply... VPV RoadshowVPN 3080 Concentrator Private Private SEP module Slots... VPV RoadshowIPSec Client to LAN Components

© 2003, Cisco Systems, Inc All rights reserved VPN Roadshow

Cisco VPN Partner Technical Development

Module 2 : VPN 3000 Configuration

APAC Channels Technical Operations

Course Agenda

© 2003, Cisco Systems, Inc All rights reserved VPN Roadshow

Cisco VPN 3000 Concentrator

Series

VPN Concentrator Series

VPN 3030 regional office

VPN 3030 regional office

VPN 3005 or 3015

branch office Internet

VPN 3060 or 3080 central site

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

VPN 3005 Concentrator

Private Public

100–240V power supply

VPN 3015 Concentrator

SEP module Slots

Private Private 100-240V power supplies

load sharing

100–240V power

supplies load sharing

External External

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

VPN 3030 Concentrator

SEP module Slots

External External

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

VPN 3080 Concentrator

Private Private

SEP module Slots

Concentrator Product Comparison

1000 1000

500 100

100 Site-to-Site Tunnels

N 4 2 256M HW

10000 100M 2U

3080

Y 2 2 256M HW

5000 100M 2U

3060

Y Y

N Upgradeable

0

Up to 2 64M SW

100 4M 2U

3015

128M 32M

Memory

HW SW

Encryption

1 0

SEP Modules

Up to 2 1

Power Supplies

1500 100

Remote Access Sessions

50M 4M

Performance

2U 1U

Height

3030 3005

Feature

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

Scalable Encryption Processor—SEP2

POWER STATUS

SEP-200U

• DSP-based hardware encryption—1,500 to 5,000 simultaneous sessions

SEP Redundancy

SEP redundancy redundancy SEP

Failover

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

Slave

Server

Private network

Public network

Master

Non-master

Load Balancing

© 2003, Cisco Systems, Inc All rights reserved VPN Roadshow

Overview of Remote Access

Using Pre-Shared Keys

Client to LAN

Internet service provider

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

IPSec Client to LAN Components

VPN Concentrator

Internet

ISP ISP

Internet

Application

server

PPP connectivity Dial access

Telecommuter with the Cisco VPN 3000 Concentrator Series Client

IPSec tunnel or session

Telecommuter with the Cisco VPN 3000 Concentrator Series Client Internet

ISP

VPN public IP 192.168.1.5

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

IPSec “Windows” Client

Cisco VPN “Windows”

Client software

Installed on Windows system

Summary (cont.)

• Mode configuration enables the Cisco VPN

3000 Concentrator Series to push the network information to the Cisco VPN 3000

Concentrator Series Client.

• The Cisco VPN 3000 Concentrator Series can use several different types of authentication servers.

• The Cisco VPN 3000 Concentrator Series

provides extensive monitoring capabilities.

© 2003, Cisco Systems, Inc All rights reserved VPN Roadshow

Remote Access Configuration

of the Cisco VPN 3000 Concentrator Series

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

System Information

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

Protocols

Internet

Internet

IPSec

Address Assignment

DHCP server

10.0.1.10

DHCP address Internet

Internet

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

External Authentication—NT Domain

NT domain

10.0.1.10

User authentication

Internet

Internet

Cisco VPN

3000 Concentrator Series Client

Computer Name: BOSTON

Domain: Domain_BOSTON

Configure Users and Groups

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

Customer Service /Base/Service

MIS /Base/Sales

Finance

Groups and Users

Base Group Corporate

Groups Department

Users Individuals

VP of MIS

User and Group Policies

Access rights and privileges

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

Group Database

Cisco VPN

3000 Concentrator Series Client

Internal server

Group:

Training Internet

Internet

Admin Password

© 2003, Cisco Systems, Inc All rights reserved VPN Roadshow

CA Support Overview

CA Server Fulfilling

Requests from IPSec Peers

Each IPSec peer individually enrolls with the CA server.

CA server

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

Digital Signature

Remote

Internet

Pay to Terry Smith $100.00

One Hundred and xx/100 Dollars

Pay to Terry Smith $100.00

One Hundred and xx/100 Dollars

4ehIDx67NMop9

Hash algorithm

Hash algorithm

Encryption algorithm

Encryption algorithm

Decryption algorithm Hash

Public key

Pay to Terry Smith $100.00 One Hundred and xx/100 Dollars

4ehIDx67NMop9

Hash

Match

Why Digital Certificates

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

Certificate-Based Authentication

Certificate Authority

trusted third party

Request certificate

Request certificate Issue

certificates

Digital certificates

Alex

Terry

Alex Terry

Certificate Authorities (CA)

© 2003, Cisco Systems, Inc All rights reserved VPV Roadshow

Public Key Infrastructure (PKI)