-
Using Management Center for VPN Routers 1.3
-
Preface
-
Introduction
-
Getting Started with Router MC
-
Router MC Scenarios
-
Working with Activities
-
Managing Devices
-
Configuring VPN Settings
-
Configuring an IOS Firewall on your VPN Router
-
Defining IKE Policies
-
Defining VPN Tunnel Policies
-
Configuring Translation Rules
-
Working with Building Blocks
-
Uploading Device Configurations
-
Deploying Configurations
-
Viewing Reports
-
Router MC Administration
-
Troubleshooting
-
Router MC Operating Prerequisites
-
Router MC User Permissions
-
Table Of Contents
Deciding Which Security Protocols to Use
Deciding Which Algorithms to Use With Each Protocol
Transport Mode vs. Tunnel Mode
Viewing Existing Transform Sets
Accessing the Transform Set Wizard
Defining Transform Set Protocols
Viewing a Summary of the Transform Set
Accessing the Network Group Wizard
Specifying Networks and Contained Groups
Viewing a Summary of the Network Group
Accessing the Service Group Wizard
Including Other Service Groups
Viewing a Summary of the Service Groups
Working with Building Blocks
Building blocks in Router MC refer to network groups, transform sets and service groups. Building blocks are reusable, named, global components that can be referenced by name by multiple policies. If you change the definition of a building block, this change is reflected in all policies that reference that building block.
Building blocks aid in policy definition by eliminating the need to define that component each time you define a policy. For example, although transform sets are integral to tunnel policies, you can define several transform sets independently of your tunnel policy definitions. These transform sets are always available for selection when you create tunnel policies (on the object on which you defined them and its descendants). Each transform set can be referenced by multiple tunnel policies.
If you change the definition of a building block, this change is reflected in all policies that reference that building block.
You can define building blocks on any level in the object hierarchy. If you define building blocks on the global level, they will be available for selection in all policies. If you define them on the device group or device level, they will only be available for policies defined on that device group or device.
Building blocks are referenced by name. A building block defined on a lower level object with the same name as a building block defined on the parent object will override the building block on the parent object.
The following topics provide information about the building blocks available in Router MC:
Working with Transform Sets
A transform set is an acceptable combination of security protocols, algorithms, and other settings to apply to IPSec protected traffic. This combination of rules specifies exactly how your data will be encrypted and authenticated. During the IPSec security association negotiation, the peers agree to use a particular transform set when protecting a particular data flow.
The following topics provide information about transform sets:
•
Viewing Existing Transform Sets
Understanding Transform Sets
A transform set is an acceptable combination of security protocols, algorithms, and other settings to apply to IPSec protected traffic. This combination of rules specifies exactly how your data will be encrypted and authenticated. During the IPSec security association negotiation, the peers agree to use a particular transform set when protecting a particular data flow.
Crypto map entries reference specific transform sets and apply them to the traffic flow specified in the crypto ACL.
Router MC provides you with several predefined transform sets that you can use if they meet your requirements. If not, you can create additional transform sets that you can use in your tunnel policies. The crypto map entry produced when a tunnel policy is deployed to the relevant devices, will reference the transform set(s) you selected for the policy.
The following topics provide information about the combination of security protocols, algorithms, and IPSec modes that you can use in your transform sets:
•
•
•
Deciding Which Security Protocols to Use
The first step in defining transform sets is to decide on which protocols to use for authentication and confidentiality. Router MC supports AH and ESP IPSec protocols. AH is used for authentication and anti-replay services, while ESP is used for authentication, confidentiality, and anti-replay services. AH authenticates the entire IP packet, including the IP header on the packet. However, it does not provide confidentiality for the data payload of the packet. ESP can provide both authentication and confidentiality services. It uses two separate algorithms to provide these services: a hash algorithm for authentication and a cipher for confidentiality. The difference between AH and ESP authentication is that ESP only authenticates the ESP payload; it does not authenticate the outer IP header. Furthermore, you can use ESP without the authentication services to provide confidentiality services only.
If you require data confidentiality only in your IPSec tunnel implementation, you should use ESP without authentication. By doing so, you gain some performance speed but lose the authentication service.
If you need authentication and confidentiality services, use ESP with authentication. It is more resource intensive than ESP without authentication, because it must perform another computation for authentication, but you gain the security of authentication. However, if you need stronger authentication (by having the entire IP packet authenticated) and confidentiality, you should use both AH and ESP in your IPSec tunnel implementation.
When you use both, the ESP protocol is applied to the packet first, and then AH is used to authenticate the entire packet. When using both AH and ESP in your tunnel implementation, you should consider using ESP without authentication services (because authentication is also being provided by the AH protocol) to provide a less resource-intensive implementation.
Deciding Which Algorithms to Use With Each Protocol
The security protocols define the method used for authentication or encryption, but do not define the algorithms used to achieve that method. You must decide on the algorithms to be used with each protocol.
Authentication Hash Algorithms
You have two options for hash algorithm: SHA and MD5:
•
•
ESP Encryption Algorithms
You have the following options for ESP encryption algorithm: DES, 3DES, and AES.
•
•
•
Note
Transport Mode vs. Tunnel Mode
When you define a transform set in Router MC, you can choose which IPSec mode of operation to use: transport mode or tunnel mode. Tunnel mode is the recommended mode because of its increased security.
Transport Mode
In transport mode, only the IP payload is encrypted, and the original IP headers are left intact. This mode has the advantage of adding only a few bytes to each packet. It also allows devices on the public network to see the final source and destination of the packet. However, by passing the IP header in the clear, transport mode allows an attacker to perform some traffic analysis. For example, an attacker could see when a company's CEO sent many packets to another senior executive. However, the attacker would only know that IP packets were sent; the attacker would not be able to decipher the contents of the packets.
With transport mode, the destination of the flow must be an IPSec termination device.
Tunnel Mode
In tunnel mode, the entire original IP datagram is encrypted, and it becomes the payload in a new IP packet. This mode allows a router to act as an IPSec proxy. That is, the router performs encryption on behalf of the hosts. The source's router encrypts packets and forwards them along the IPSec tunnel. The destination's router decrypts the original IP datagram and forwards it on to the destination system. The major advantage of tunnel mode is that the end systems do not need to be modified to enjoy the benefits of IPSec. Tunnel mode also protects against traffic analysis. With tunnel mode, an attacker can only determine the tunnel endpoints and not the true source and destination of the tunneled packets, even if they are the same as the tunnel endpoints.
Predefined Transform Sets
Router MC provides various predefined policies for your convenience, including two predefined transform sets. If they meet your requirements, you can use the predefined transform sets instead of having to create your own transform sets.
The predefined transform set "Default-Strong-TS" offers high security using the following parameters:
•
•
•
•
The predefined transform set "Default-Weak-TS" offers lower security using the following parameters:
•
•
•
•
Viewing Existing Transform Sets
The Transform Sets page, accessed from the Building Blocks section of the Configuration tab, displays a list of transform sets, in table format. Each table row represents a transform set and each table column provides a different field of information for that transform set.
The list of transform sets includes several sample transform sets provided by Router MC and any custom transform sets that were previously defined.
You can select a custom transform set in the list to edit or delete it. You cannot delete the sample transform sets provided by Router MC.
Table 1-1 describes the elements in the Transform Sets page.
Creating a Transform Set
Transform sets play an integral role in tunnel policies in that they determine which protocols and algorithms will be used to secure the specified traffic. Transform sets are created independently of tunnel policies and then each tunnel policy references the relevant transform sets. A single transform set might be referenced by several tunnel policies.
You create a transform set using the Transform Set wizard. The following topics describe the tasks you perform to create a transform set using this wizard:
•
•
•
Note
Accessing the Transform Set Wizard
To access the wizard, complete the steps in this procedure.
Before You Begin
•
•
Procedure
Step 1
Step 2
The Transform Sets page appears. It contains a list of the transform sets defined on the selected device or device group (if any).
Step 3
The first page of the Transform Set wizard appears. The steps in the wizard are listed in the TOC on the left side of the page.
Naming the Transform Set
The Name and Comment page is the first page of the Transform Set wizard. Router MC identifies each transform set that you create by a name that you assign in this page. When you have finished creating the transform set, it is listed by this name in the Transform Sets page. See Viewing Existing Transform Sets for more information. It is also included in the list of transform sets available for selection for a tunnel policy. See Selecting Transform Sets, page 1-15 for more information.
Because the transform set name also enables you to distinguish one transform set from another for reviewing, editing, or deleting transform sets, you should assign a logical name that reflects the contents of the transform set. You can also enter a description of the transform set for quick and easy identification of transform set contents.
Procedure
Step 1
Step 2
Step 3
Table 1-2 describes the elements in the Transform Set Name and Comment page.
Defining Transform Set Protocols
The Protocols page of the Transform Set wizard allows you to select the transform set's protocols and their associated algorithms to determine how traffic will be secured in the IPSec tunnel.
Procedure
Step 1
Step 2
OR
If Summary does not appear in the TOC, click Finish to complete the creation of the transform set, or go back to a previous step in the wizard to change your definitions, as required.
Table 1-3 describes the elements in the Transform Set Protocols page.
Table 1-3 Transform Set Protocols: GUI Reference
Mode list box
Select the IPSec mode of operation, either Transport or Tunnel mode. Tunnel mode is recommended because it provides greater security. See Transport Mode vs. Tunnel Mode for more information.
AH Hash list box
Select an authentication hash algorithm, either MD5 or SHA. If you do not want to use AH authentication, do not make a selection in this field. See Deciding Which Security Protocols to Use and Deciding Which Algorithms to Use With Each Protocol for more information.
ESP Encryption list box
Select an encryption algorithm, either DES, 3DES, or one of the AES options. See Deciding Which Algorithms to Use With Each Protocol for more information.
ESP Hash list box
If you want to use ESP authentication, select an algorithm from the list box, either MD5 or SHA.
Compression check box
Select the check box if you want the data in the IPSec tunnel to be compressed using the LZS algorithm.
Back button
Click to go back to the previous page in the wizard.
Next button
Available only if Summary appears in the TOC. See Defining System Settings, page 1-1.
Click to go to the next page in the wizard.
Finish Button
Available only if Summary does not appear in the TOC. See Defining System Settings, page 1-1.
Click to exit the wizard and complete the transform set creation or modification process.
Cancel button
Click to exit the wizard without saving your settings.
Viewing a Summary of the Transform Set
Note
The Summary page provides an overview of your transform set definitions for your verification. See Table 1-4 for a description of the fields and buttons in this page.
Procedure
Step 1
Step 2
Table 1-4 describes the elements in the Transform Set Summary page.
Editing a Transform Set
You can edit any existing transform set. On deployment, the changes will take effect in all policies that reference the edited transform set.
Before You Begin
•
•
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Deleting a Transform Set
You can delete a transform set if it is not currently being used by a policy.
Before You Begin
•
•
Procedure
Step 1
Step 2
Step 3
Working with Network Groups
A network group is a named collection of networks and/or hosts. The network group name can be referenced during the definition of VPN settings and policies, instead of having to specify each network or host individually for each policy definition. For example, when creating a custom ACE for a tunnel policy, you can select a network group to specify the source or the destination traffic flow.
If you change the contents of a network group, the change will be applied to all policies that reference the network group.
Network groups can contain the following:
•
•
•
The following topics provide information about working with network groups:
Table 1-5 describes the elements in the Network Groups page.
Creating a Network Group
You create a network group using the Network Group wizard.
The following topics describe the tasks you must perform to create a network group using this wizard:
•
•
•
Note
Accessing the Network Group Wizard
To access the wizard, complete the steps in this procedure.
Before You Begin
•
•
Procedure
Step 1
Step 2
The Network Groups page appears. It contains a list of the network groups defined on the selected device or device group (if any).
Step 3
The first page of the Network Group wizard appears. The steps in the wizard are listed in the TOC on the left side of the page.
Naming the Network Group
The Name and Comment page of the Network Group wizard appears when you click the Create button in the Network Groups page. Router MC identifies each network group you create by a name you assign in this page. When you have finished creating the network group, it is listed by this name in the Network Groups page (see Table 1-5). It is also included as an option for selection wherever network groups can be used.
Procedure
Step 1
Step 2
Step 3
Table 1-6 describes the elements in the Network Group Name and Comment page.
Specifying Networks and Contained Groups
In the Networks page of the Network Group wizard you specify the networks/hosts to be included in the network group. A network group can contain other network groups. The Networks page also displays predefined network groups that are available for inclusion in the network group you are creating.
Procedure
Step 1
Step 2
Step 3
a.
b.
Step 4
OR
If Summary does not appear in the TOC, click Finish to complete the creation of the network group, or go back to a previous step in the wizard to change your definitions, as required.
Table 1-7 describes the elements in the Network Group Networks page.
Table 1-7 Network Group Networks: GUI Reference
Enter Network/Host field
To add a subnet to the network group, enter the IP address and subnet mask, for example, 192.10.9.1/255.255.255.0.
To add a host to the network group, enter the IP address or host name.
>> button
Click to add the specified network/host/network group to the network group.
Delete button
Select a network/host/network group in the list and click the Delete button to delete it from the network group.
Available Groups
Lists existing network groups. You can choose one or more of these network groups to include in the network group being created.
Predefined Groups to be Included
Lists the predefined network groups selected to be included in the network group being created.
>> button
Click to add the selected network group to the network group you are creating. The network group is moved to the Predefined Groups to be Included area.
<< button
Click to remove a selected network group from the Predefined Groups to be Included area. It will not be contained in the network group you are creating.
Back button
Click to go back to the previous page in the wizard.
Next button
Available only if Summary appears in the TOC. See Defining System Settings, page 1-1.
Click to go to the next page in the wizard.
Finish Button
Available only if Summary does not appear in the TOC. See Defining System Settings, page 1-1.
Click to exit the wizard and complete the network group creation or modification process.
Cancel button
Click to exit the wizard without saving your settings.
Viewing a Summary of the Network Group
Note
The Summary page provides an overview of your network group definitions for your verification. See Table 1-8 for a description of the fields and buttons in this page.
Procedure
Step 1
Step 2
Table 1-8 describes the elements in the Network Group Summary page.
Editing a Network Group
You can edit any existing network group. On deployment, your changes will be applied on all devices with policies that reference the edited network group.
Before You Begin
•
•
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Deleting a Network Group
You can delete a network group if it is not currently being referenced by a policy.
Before You Begin
•
•
Procedure
Step 1
Step 2
Step 3
Working with Service Groups
Services are pre-defined mappings of protocol and port definitions that describe network services that are used when defining access rules. In Router MC, you can create service groups. One service group may include one or more different services.
Service groups can be referenced when defining access rules for firewall functionality. See Defining the Parameters for the Access Rule, page 1-36.
Note
Access the Service Groups page by selecting Configuration > Building Blocks > Service Groups.
The Service Groups page displays a scrollable table listing all the currently defined service groups. By clicking on any heading title, and then clicking the arrow that is displayed alongside, you can switch the list to display from ascending to descending order, and vice versa.
In the Service Groups page you can create, edit, and delete service groups.
The following topics provide information about working with service groups:
Table 1-9 describes the elements in the Service Groups page.
Creating a Service Group
You create a service group using the Service Group wizard.
Note
The following topics describe the tasks you perform to create a service group using this wizard:
•
•
•
•
Note
Accessing the Service Group Wizard
To access the wizard, complete the steps in this procedure.
Before You Begin
•
•
Procedure
Step 1
Step 2
The Service Groups page appears. It contains a list of the service groups defined on the selected object.
Step 3
The first page of the Service Group wizard appears. The steps in the wizard are listed in the TOC on the left side of the page. You can click on a step in the TOC to go directly to its corresponding page, or you can click the Next button to move sequentially through the wizard pages.
Naming the Service Group
The Name and Comment page of the Service Group wizard appears when you click the Create button in the Service Groups page. Router MC identifies each service group you create by a name you assign in this page. When you have finished creating the service group, it is listed by this name in the Service Groups page (see Table 1-9). It is also included as an option for selection wherever service groups can be used.
Procedure
Step 1
Step 2
Step 3
Table 1-10 describes the elements in the Service Group Name and Comment page.
Specifying Protocol and Ports
In the Protocol and Ports page of the Service Group wizard, you specify the protocol and port definitions that describe the service group you are creating.
In this page, you can define both ACL and CBAC protocols. You can only define a CBAC protocol if the ACL protocol is "tcp" or "udp".
Procedure
Step 1
Step 2
Table 1-11 describes the elements in the Protocol and Ports page.
Including Other Service Groups
A service group can contain other service groups. The Contained Groups page of the Service Group wizard shows the existing service groups available for inclusion in the service group you are creating. See Table 1-12 for descriptions of the Contained Groups page.
Procedure
Step 1
Step 2
Step 3
OR
If Summary does not appear in the TOC, click Finish to complete the creation of the service group, or go back to a previous step in the wizard to change your definitions, as required.
Table 1-12 describes the elements in the Contained Groups page.
Table 1-12 Contained Groups: GUI Reference
Available Service Groups column
Lists the available service groups. You can choose one of these service groups to include in the service group being created.
Selected Service Groups column
Lists the service groups that will be included in the service group you are creating.
< Add >> button
Click to add the selected service group to the service group you are creating. The service group is moved to the Selected Service Groups column.
<< Remove > button
Click to remove a service group from the Selected Service Groups area. It will not be contained in the service group you are creating.
Back button
Click to go back to the previous page in the wizard.
Next button
Available only if Summary appears in the TOC. See Defining System Settings, page 1-1.
Click to go to the next page in the wizard.
Finish Button
Available only if Summary does not appear in the TOC. See Defining System Settings, page 1-1.
Click to exit the wizard and complete the service groups creation or modification process.
Cancel button
Click to exit the wizard without saving your settings.
Viewing a Summary of the Service Groups
Note
The Service Groups Summary page provides an overview of your service group definitions for your verification. See Table 1-13 for a description of the fields and buttons in this page.
Procedure
Step 1
Step 2
Table 1-13 describes the elements in the Service Groups Summary page.
Editing a Service Group
You can edit any existing service group. On deployment, your changes will be applied on all devices with policies that reference the edited service group.
Before You Begin
•
•
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Deleting a Service Group
You can delete a service group if it is not currently being referenced by a policy.
Before You Begin
•
•
Procedure
Step 1
Step 2
Step 3
If the service group is not currently being referenced by a policy, it is deleted from the list of service groups. If it is being referenced by a policy, an error message will indicate that the service group cannot be deleted.
