思科网络安全-第八部分解读.ppt

* * * First packet - The initiator packages everything needed for the SA negotiation in the first message, including its DH public key. Second packet - The recipient responds with the acceptable parameters, authentication information, and its DH public key. 上面提到的两个DH public key是指在DH交换信息过程中的YA和YB 。 * * * * * * * 双方的优先级可以不同，系统会自动协商两者之间匹配的一对。数值越低优先级越高。 双方的密钥生存周期若不一致，则以短的一方为准。 Notice however, that policy numbers are only locally significant and do not have to match between IPsec peers. * * * * * * * * * PFS (Perfect Forwarding Secrecy) enhances security by using different security key for the IPSec Phase 1 and Phase 2 SAs. Overview Negotiates tunnel parameters Establishes tunnels according to set parameters Automatically creates a NAT / PAT and associated ACLs Authenticates users by usernames, group names, and passwords Manages security keys for encryption and decryption Authenticates, encrypts, and decrypts data through the tunnel Components Securing the VPN Initiate IKE Phase 1 Establish ISAKMP SA Accept Proposal1 Username/Password Challenge Username/Password System Parameters Pushed Reverse Router Injection (RRI) adds a static route entry on the router for the remote clients IP address Initiate IKE Phase 2: IPsec IPsec SA 1 2 3 4 5 6 7 Configuring a VPN Server Using SDM Configuring Cisco Easy VPN Server Configuring IKE Proposals Creating an IPSec Transform Set Group Authorization and Group Policy Lookup Summary of Configuration Parameters Configuring Cisco Easy VPN Server 1 2 3 4 5 Configuring IKE Proposals 1 2 3 Click Add Specify required parameters Click OK Creating an IPSec Transform Set 1 2 3 4 Group Authorization and Group Policy Lookup 1 2 3 4 5 Select the location whereEasy VPN group policiescan be stored Click Next Click Add Click Next Configure the localgroup policies Summary of Configuration Parameters Connecting with a VPN Client Overview Establishing a Connection VPN Client Overview Establishes end-to-end, encrypted VPN tunnels for secu