Cisco PIX 525 Specifiche Scaricare il pdf (Pagina 42)

1-16

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 1 Getting Started

Creating a Virtual Private Network

• Phase 1—This phase, implemented through the Internet Key Exchange (IKE) protocol, establishes

a pair of IKE SAs. IKE SAs are used for negotiating one or more IPSec SAs, which are used for the

actual transmission of application data.

• Phase 2—This phase uses the secure channel provided by the IKE SAs to negotiate the IPSec SAs.

At the end of this phase both peers have established a pair of IPSec SAs, which provide the secure

tunnel used for transmission of application data. One of the SA parameters is its lifetime, which

enhances IPSec security by causing the SA to automatically expire after a configurable length of

time.

The IKE protocol establishes a secure tunnel for negotiating IPSec SAs. It lets you implement IPSec

without manual configuration of every IPSec peer. Manual configuration of IPSec peers becomes

prohibitively complicated as the number of peers increase, because each peer requires a pair of SAs for

every other peer with which it communicates using IPSec.

Like IPSec, IKE uses a pair of SAs to establish a secure tunnel for communication between two peers.

However, IKE uses its SAs to securely negotiate SAs for IPSec tunnels, rather than for the transmission

of user information.

You can manually configure SAs to establish an IPSec tunnel between two peers. However, this method

is not as secure, because manually configured SAs do not automatically expire. In addition, a severe

problem of scalability occurs as the number of peers increases. A new pair of SAs is required on each

existing peer whenever you add a peer that uses IPSec to your network. For this reason, manual

configuration is only used when the remote peer does not support IKE.

IKE SAs can be established by using pre-shared keys, in a way similar to manual configuration of IPSec

SAs. This method, however, suffers from the same problems of scalability that affects manual

configuration of IPSec SAs. A certification authority (CA) provides a scalable method to share keys for

establishing IKE SAs.

Certification Authorities

Understanding how CAs help to configure IKE requires understanding something about public/private

key encryption. Public/private keys, also called asymmetric keys, are created in pairs. Data encrypted

with one key of this pair can only be unencrypted using the other key. One key is kept secret (called a

private key) and the other key is made easily available (the public key). When any peer needs to share a

secret with the owner of the private key, it simply encrypts the information using the public key. The only

way to unencrypt the original information is by using the private key. Using this method, encrypted

information can be shared over a non-secure network without transmitting the secret key required to

decipher the encrypted information.

This unique property of public/private key pairs also provides an excellent method of authentication. A

public key only unencrypts a message encrypted with the corresponding private key. If a message can be

read using a given public key, you know for certain that the sender of the message owns the

corresponding private key.

This is where the CA comes in. A public key certificate, or digital certificate, is used to associate a

public/private key pair with a given IP address or host name. A certification authority (CA) issues public

key certificates for a specific period of time. A CA can be a private (in-house) CA, run by your own

organization, or a public CA. A public CA, like VeriSign, is operated by a third party that you trust to

validate the identity of each client or server to which it issues a certificate.

Digital certificates are used by the IKE protocol to create the first pair of SAs, which provide a secure

channel for negotiating the IPSec SAs. To use certificates for negotiating IKE SAs, both IPSec peers

have to generate public/private key pairs, request and receive public key certificates, and be configured

to trust the CA that issues the certificates.

1 2 ... 37 38 39 40 41 42 43 44 45 46 47 ... 465 466

Commenti su questo manuale

Nessun commento

Cisco PIX 525 Specifiche Pagina 42

Commenti su questo manuale

Prodotti e manuali riguardandi Sistemi di controllo di accesso Cisco PIX 525