لطفا منتظر باشید ...
VPNs with IPSec
As you noticed in the previous discussion, IPSec can use a robust set of protocols and processes. You can use them without knowing much about the protocols, but good practice dictates some preparation steps that need to be taken care of before you can effectively configure a device with IPSec. These steps can be organized as follows:
| Step 1. | Establish an IKE policy This policy must be identical on both sides of the VPN. The following elements go into an IKE policy:
|
| Step 2. | Establish an IPSec policy Only certain traffic has to go through the IPSec tunnel. Of course, you can decide to send all traffic between peers through that tunnel, but there is a significant performance penalty when using IPSec. It is better to be selective. As in step 1, both peers need to have the same IPSec policies. The following information is needed for an IPSec policy:
|
| Step 3. | Examine the configuration as it is at this stage Check your devices to avoid conflicts with existing settings on one of the devices. |
| Step 4. | Test the network before IPSec Check whether you can ping the peers that are going to participate in IPSec. If you cannot ping them, you must fix this before you can configure IPSec. |
| Step 5. | Permit IPSec ports and protocols If there are access lists enabled on the devices along the path of the VPN, make sure that those devices permit the IPSec traffic. |
NOTEIf you use access lists, it might be interesting to know that when AH and ESP are used together, the IP protocol number is that of AH.After completing these steps, you can begin the configuration process. You can think of configuring IPSec as the following five-step process:
| Step 1. | Interesting traffic initiates the setup of an IPSec tunnel. |
| Step 2. | IKE Phase 1 authenticates peers and establishes a secure tunnel for IPSec negotiation. |
| Step 3. | IKE Phase 2 completes the IPSec negotiation and establishes the tunnel. |
| Step 4. | Secure VPN communication can occur. |
| Step 5. | When there is no traffic to use IPSec, the tunnel is torn down, either explicitly or because the security association (SA) timed out. |
