vpn.
md 2025-05-19
VPN : VERTUAL PRIVATE NETWORK
technology that creates a secure encrypted connection over a less secure netwok (public internet).
allows users to communicate safly as they were directly connected.
TYPES OF VPNS
remote access
connects individual to a private network.
site to site
connects entire networks using the principle of runnels between routers.
TUNNELING
secure data by encapsulating it inside encrypted packets.
travel through a tunnel accross the public network.
at the tunnel endpoint the outer header is removed.
ELEMENTS OF VPN CONNECTION
vpn client
the device or the software on the user side.
initiate the vpn connection.
encrypt data before sending.
vpn server
the endpoint that receives teh vpn connection.
authenticates teh client.
decrepts the data and forward it to the private network.
tunnel
encryption protocol
authentication mechnism
IPSEC PROTOCOL
a suite of protocl fors providing secure communication over ip betwroks (in tunnels).
main protocols are:
1/4
[Link] 2025-05-19
AH PROTOCOL (authentication header) : provide integrity authentication and antireplay
protection.
ESP PROTOCOL : used for encryption authentication and integrity.
// ah protocol
// normal packet
+---------------------------+
|IPv4 Header |
+---------------------------+
| Payload (e.g., TCP/UDP) |
+---------------------------+
// transport mode
+---------------------------+
|IPv4 Header |
+---------------------------+
| AH Header |
+---------------------------+
| Payload (e.g., TCP/UDP) |
+---------------------------+
// tunnel mode
+---------------------------+
| Outer IPv4 Header | ← New IP header added by tunnel mode
+---------------------------+
| AH Header | ← Authentication Header protects the entire inner
packet
+---------------------------+
| Inner IPv4 Header | ← Original IP packet (header + payload)
+---------------------------+
| Payload (e.g., TCP/UDP) |
+---------------------------+
// esp protocol
// normal packet
+---------------------------+
|IPv4 Header |
+---------------------------+
| Payload (e.g., TCP/UDP) |
+---------------------------+
//transport mode
+-----------------------------+
| Original IP Header |
+-----------------------------+
| (auth) ESP Header |
+-----------------------------+
| (Encrypted + auth) Payload |
+-----------------------------+
| (Encrypted + auth) esp traler|
2/4
[Link] 2025-05-19
+-----------------------------+
| Authentication data |
+-----------------------------+
// tunnel mode
+-----------------------------+
| outer IP Header |
+-----------------------------+
| (auth) ESP Header |
+-----------------------------+
| (Encrypted + auth) Original IP Header |
+-----------------------------+
| (Encrypted + auth) Payload |
+-----------------------------+
| (Encrypted + auth) esp traler|
+-----------------------------+
| Authentication data |
+-----------------------------+
SECURITY ASSOCIATION
defines the parameters and keys used to secure communication between 2 enteties.
defines for exemple :
security protocol like esp and ah.
cryptographic algorithms.
keys.
lifetime
CONFIGURATOPN
1. access lists
define the traffic that needs to be encrypted.
access-list 100 permit ip [Link][source network] [Link]
[Link][destination] [Link]
2. ISAKMP POLICY -PHASE 1-
set the key exchage key
R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 2
R1(config-isakmp)# exit
R1(config)# crypto isakmp key cisco address [Link][ip of the peer]
3/4
[Link] 2025-05-19
3. IPSEC TRANSFORM SET -PHASE 2-
set encry and authentication methods
R1(config)# crypto ipsec transform-set VPN-SET esp-3des esp-sha-hmac
4. CRYPTO MAP
binds everything together.
R1(config)# crypto map VPN-MAP 10 ipsec-isakmp
R1(config-crypto-map)# description VPN connection to R3
R1(config-crypto-map)# set peer [Link]
R1(config-crypto-map)# set transform-set VPN-SET
R1(config-crypto-map)# match address 110
R1(config-crypto-map)# exit
5. apply to interface
interface fa0/0
crypto map VPN-MAP
VERIFY THE IPSEC
// verify the encrypt part
R1# show crypto ipsec sa
// IF ITS INTERSTING TRAFFIC THE NUMBER WILL CHANGE ACCORDING TO THE ACCESS LIST
4/4