background image
576 Chapter 15: Network Security Technologies
·
ISAKMP framework--ISAKMP (Internet Security Association and Key Management
Protocol) was developed at the National Security Agency and is the protocol used by
IPSec to manage keys.
NOTE
ISAKMP is the manager, and Oakley/Diffie-Hellman and Skeme all work for him. And
ISAKMP reports to IKE.
IKE has the following benefits:
·
Eliminates the need to manually specify all the IPSec security parameters in the crypto
maps at both peers.
·
Allows you to specify a lifetime for the IPSec security association.
·
Allows encryption keys to change during IPSec sessions.
·
Allows IPSec to provide anti-replay services.
NOTE
VeriSign, Inc., is the leading provider of digital certificate solutions for extranets and intranets,
including IPSec. VeriSign OnSite for IPSec lets organizations easily issue certificates and build
their own virtual private networks (VPNs) using the IPSec capabilities built into Cisco products.
Data Encryption Standard (DES) Encryption
DES is a widely used encryption standard that works on the data itself. By performing an
algorithm, DES can turn clear-text messages into cipher text at the source. The destination
restores the cipher text back to data. Keys called shared secret keys enable this to happen.
Virtual Private Networks (VPNs)
With the advent of the Internet, corporate networks must seriously consider VPN technology.
VPNs enable the creation of private networks across the Internet, enabling tunneling and
privacy of non-TCP/IP protocols and saving money in the process. In some cases, TCP/IP is
tunneled as well.
A typical example of the use of VPN occurs whenever a corporate user on a travel assignment
dials into a local service provider for a popular online service. The user can access company
information over a virtual tunnel through the Internet, without fear of someone's intercepting
the data as it transits the unsecured Internet. The user could be using an IP-based workstation
or a Macintosh AppleTalk workstation because the AppleTalk traffic can be tunneled through
IP. Figure 15-17 shows an example of a VPN.
87200333.book Page 576 Wednesday, August 22, 2001 1:41 PM