Please enable JavaScript.

Coggle requires JavaScript to display documents.

Site-to-Site VPN (Topologies (Combinations (Partial Mesh, Teared Hub and…

- - - - Configure IKE Policy
        
        Asa has default
        
        is default suffciet?
        
        Components
      - Configure PSK
        
        Tunnel Group
      - Enable IKE on Interface
    - - Create Transform Set
        
        Local Protected Network
        
        Remote Protected Network
        
        Preshsared Key
        
        Configure Peer IP
        
        Identification Proposals
        
        Diff Helman
        
        Encryption Method
        
        Done via cryptomap (tunnel map)
        
        Maps a transform to traffic flow
        
        Add new cryptomap
        
        IKEv1
        
        Encryption
        
        Authentication
        
        Mode
        
        IKEv2
- - - - Phase 1
        
        Purpose
        
        Secure Channel for Phase 2
        
        Process
        
        Devices Exchange Credentials
        
        Devices Identify Each Other
        
        Agree on Phase 1 Parameters
        
        NAT Traversal permitted?
        
        Send IKE Keep-alives?
        
        Use Dead Peer Detection?
        
        Always on for IKEv2
        
        Agree on Phase 1 Transform Settings
        
        Authentication
        
        Encryption
        
        SA Life
        
        Key Group
        
        Choose mode (IKEv1 Only)
        
        Main Mode?
        
        First Exchange (Messages 1 & 2)
        
        Encryption
        
        2 more items...
        
        Authentication
        
        2 more items...
        
        Second Exchange (Messages 3 & 4)
        
        DH Exchange
        
        2 more items...
        
        Third Exchange (Messages 5 & 6)
        
        Identity Verification
        
        2 more items...
        
        Aggressive Mode?
        
        First Message
        
        Initiator proposal
        
        3 more items...
        
        Second Message
        
        Recipient
        
        5 more items...
        
        Third Message
        
        Initiator
        
        3 more items...
        
        Identities Exchanged in Clear
        
        No Identity Protection
      - Phase 2
        
        IPSEC Security Associations
        
        Encryption Type Established
        
        Transform Sets (Policies one each end)
        
        IPSEC session keys
        
        Perfect Forward Secrecy
        
        New independant keys
        
        Default derived from Phase 1
        
        Purpose
        
        What traffic?
        
        How to encrypt?
        
        How to authenticate?
      - RFC 2308
      - Destination UDP Port 500
    - - No Phases for IKE SA
      - IKE_SA_INIT
      - IKE_AUTH
      - CREATE_CHILD_SA
      - Fewer Roundtrip Comms
      - Built in DPD
      - Built-on EAP
      - Builtin NAT Traversal
      - Better Rekeying & Collision Handling
  - - - Tunnel Mode
      - Encrypts, Sequences, Authenticates Data
      - New IP Header
      - Original Packet encrypted
  - - - Multicast
      - QoS