2012 년 2 학기 중부대학교 정보보호학과 이병천 교수.  공중망 (Public Network) ◦ 가격이 저렴 ◦ 네트워크를 공동으로 이용. 보안에 취약  사설망 (Private Network) ◦ 공중망보다 가격이 비쌈 ◦ 네트워크를 독립적으로 이용. 보안성이.

Presentation on theme: "2012 년 2 학기 중부대학교 정보보호학과 이병천 교수.  공중망 (Public Network) ◦ 가격이 저렴 ◦ 네트워크를 공동으로 이용. 보안에 취약  사설망 (Private Network) ◦ 공중망보다 가격이 비쌈 ◦ 네트워크를 독립적으로 이용. 보안성이."— Presentation transcript:

1 2012 년 2 학기 중부대학교 정보보호학과 이병천 교수

2  공중망 (Public Network) ◦ 가격이 저렴 ◦ 네트워크를 공동으로 이용. 보안에 취약  사설망 (Private Network) ◦ 공중망보다 가격이 비쌈 ◦ 네트워크를 독립적으로 이용. 보안성이 우수  가상사설망 (Virtual Private Network, VPN) ◦ 공중망에서 터널링 기술을 이용하여 사설망처럼 이용할 수 있도록 하는 기술 ◦ 값싸게 보안통신을 이용할 수 있음

3  안전한 기업 업무환경 구축 ◦ 본사 - 지사간의 안전한 네트워크 연결 ◦ 재택근무 : 집에서 회사 서버에 안전하게 접속 필요  VoIP 네트워크 : 인터넷전화  IPTV, 비디오 회의

4 GRE(Generic Route Encapsulation) DMVPN(Dynamic Multipoint VPN) MPLS(multiprotocol label switching) SSL(secure socket layer)

5

6

7  암호프로토콜 이용하여 인증, 보안, 기밀성 유지  키의 이용 ◦ 대칭키 암호화 (Symmetric Encryption):  PSK(Pre-shared key) – 공유키 이용  디피 - 헬만 (Diffie-Hellman) – 온라인 키합의 방식 ◦ 비대칭키 암호화 (Asymmetric Encryption):  인증서 이용  암호 알고리즘 ◦ 대칭키 암호 : DES, 3DES, AES ◦ 비대칭키 암호 : RSA ◦ 해쉬암고리즘 : HMAC, MD5, SHA-1

8  연결되는 장치간의 인증 및 보안연계 (SA, security association) 프로토콜 ◦ ISAKMP (Internet security association and key management protocol) ◦ IKE (Internet key exchange)  인증 및 암호화 프로토콜 ◦ AH(Authentication Header): 데이터의 인증 및 무결성 ◦ ESP(Encapsulation Security Payload): 데이터 암호화

9 AH 헤더 ESP 헤더

10

11 R1(config)#interface FastEthernet0/0 R1(config-if)#no shutdown R1(config-if)#ip address 11.11.11.1 255.255.255.0 R1(config-if)#exit R1(config)#interface FastEthernet0/1 R1(config-if)#no shutdown R1(config-if)#ip address 21.21.21.1 255.255.255.0 R1(config-if)#exit R1(config)#interface Serial0/3/0 R1(config-if)#no shutdown R1(config-if)#clock rate 1000000 R1(config-if)#ip address 203.230.7.1 255.255.255.0 R1(config-if)#exit R1(config)#int lo 0 R1(config-if)#ip add 1.1.1.1 255.255.255.0 R1(config-if)#exit R1(config)#router ospf 7 R1(config-router)#network 1.1.1.1 0.0.0.0 a 0 R1(config-router)#network 11.11.11.1 0.0.0.0 a 0 R1(config-router)#network 21.21.21.1 0.0.0.0 a 0 R1(config-router)#network 203.230.7.1 0.0.0.0 a 0 R3(config)#interface FastEthernet0/0 R3(config-if)#no shutdown R3(config-if)#ip address 13.13.13.1 255.255.255.0 R3(config-if)#exit R3(config)#interface FastEthernet0/1 R3(config-if)#no shutdown R3(config-if)#ip address 23.23.23.1 255.255.255.0 R3(config-if)#exit R3(config)#interface Serial0/3/0 R3(config-if)#no shutdown R3(config-if)#ip address 150.183.235.2 255.255.255.0 R3(config-if)#exit R3(config)#int lo 0 R3(config-if)#ip add 3.3.3.3 255.255.255.0 R3(config-if)#exit R3(config)#router ospf 7 R3(config-router)#network 3.3.3.3 0.0.0.0 a 0 R3(config-router)#network 13.13.13.1 0.0.0.0 a 0 R3(config-router)#network 23.23.23.1 0.0.0.0 a 0 R3(config-router)#network 150.183.235.2 0.0.0.0 a 0 R2(config)#interface FastEthernet0/0 R2(config-if)#no shutdown R2(config-if)#ip address 12.12.12.1 255.255.255.0 R2(config-if)#exit R2(config)#interface Serial0/3/0 R2(config-if)#no shutdown R2(config-if)#ip address 203.230.7.2 255.255.255.0 R2(config-if)#exit R2(config)#interface Serial0/3/1 R2(config-if)#no shutdown R2(config-if)#clock rate 1000000 R2(config-if)#ip address 150.183.235.1 255.255.255.0 R2(config-if)#exit R2(config)#int lo 0 R2(config-if)#ip add 2.2.2.2 255.255.255.0 R2(config-if)#exit R2(config)#router ospf 7 R2(config-router)#network 2.2.2.2 0.0.0.0 a 0 R2(config-router)#network 12.12.12.1 0.0.0.0 a 0 R2(config-router)#network 203.230.7.2 0.0.0.0 a 0 R2(config-router)#network 150.183.235.1 0.0.0.0 a 0

12 R1#show ip route 1.0.0.0/24 is subnetted, 1 subnets C 1.1.1.0 is directly connected, Loopback0 2.0.0.0/32 is subnetted, 1 subnets O 2.2.2.2 [110/65] via 203.230.7.2, 16:22:43, Serial0/3/0 3.0.0.0/32 is subnetted, 1 subnets O 3.3.3.3 [110/129] via 203.230.7.2, 00:11:12, Serial0/3/0 11.0.0.0/24 is subnetted, 1 subnets C 11.11.11.0 is directly connected, FastEthernet0/0 12.0.0.0/24 is subnetted, 1 subnets O 12.12.12.0 [110/65] via 203.230.7.2, 16:22:43, Serial0/3/0 13.0.0.0/24 is subnetted, 1 subnets O 13.13.13.0 [110/129] via 203.230.7.2, 00:11:12, Serial0/3/0 21.0.0.0/24 is subnetted, 1 subnets C 21.21.21.0 is directly connected, FastEthernet0/1 23.0.0.0/24 is subnetted, 1 subnets O 23.23.23.0 [110/129] via 203.230.7.2, 00:11:12, Serial0/3/0 150.183.0.0/24 is subnetted, 1 subnets O 150.183.235.0 [110/128] via 203.230.7.2, 00:13:17, Serial0/3/0 C 203.230.7.0/24 is directly connected, Serial0/3/0 R2#show ip route 1.0.0.0/32 is subnetted, 1 subnets O 1.1.1.1 [110/65] via 203.230.7.1, 16:23:51, Serial0/3/0 2.0.0.0/24 is subnetted, 1 subnets C 2.2.2.0 is directly connected, Loopback0 3.0.0.0/32 is subnetted, 1 subnets O 3.3.3.3 [110/65] via 150.183.235.2, 00:12:24, Serial0/3/1 11.0.0.0/24 is subnetted, 1 subnets O 11.11.11.0 [110/65] via 203.230.7.1, 16:23:51, Serial0/3/0 12.0.0.0/24 is subnetted, 1 subnets C 12.12.12.0 is directly connected, FastEthernet0/0 13.0.0.0/24 is subnetted, 1 subnets O 13.13.13.0 [110/65] via 150.183.235.2, 00:12:24, Serial0/3/1 21.0.0.0/24 is subnetted, 1 subnets O 21.21.21.0 [110/65] via 203.230.7.1, 16:23:51, Serial0/3/0 23.0.0.0/24 is subnetted, 1 subnets O 23.23.23.0 [110/65] via 150.183.235.2, 00:12:24, Serial0/3/1 150.183.0.0/24 is subnetted, 1 subnets C 150.183.235.0 is directly connected, Serial0/3/1 C 203.230.7.0/24 is directly connected, Serial0/3/0 R3#show ip route 1.0.0.0/32 is subnetted, 1 subnets O 1.1.1.1 [110/129] via 150.183.235.1, 00:13:57, Serial0/3/0 2.0.0.0/32 is subnetted, 1 subnets O 2.2.2.2 [110/65] via 150.183.235.1, 00:13:57, Serial0/3/0 3.0.0.0/24 is subnetted, 1 subnets C 3.3.3.0 is directly connected, Loopback0 11.0.0.0/24 is subnetted, 1 subnets O 11.11.11.0 [110/129] via 150.183.235.1, 00:13:57, Serial0/3/0 12.0.0.0/24 is subnetted, 1 subnets O 12.12.12.0 [110/65] via 150.183.235.1, 00:13:57, Serial0/3/0 13.0.0.0/24 is subnetted, 1 subnets C 13.13.13.0 is directly connected, FastEthernet0/0 21.0.0.0/24 is subnetted, 1 subnets O 21.21.21.0 [110/129] via 150.183.235.1, 00:13:57, Serial0/3/0 23.0.0.0/24 is subnetted, 1 subnets C 23.23.23.0 is directly connected, FastEthernet0/1 150.183.0.0/24 is subnetted, 1 subnets C 150.183.235.0 is directly connected, Serial0/3/0 O 203.230.7.0/24 [110/128] via 150.183.235.1, 00:13:57, Serial0/3/0

13 Tunnel 21 Tunnel 12 Tunnel 23 Tunnel 32 GRE(Generic Route Encapsulation) - Cisco 에서 개발한 터널링 프로토콜

14 R1(config)#int tunnel 12 터널 인터페이스 생성 R1(config-if)#ip add 163.180.116.1 255.255.255.0 터널 인터페이스의 IP 주소 설정 R1(config-if)#tunnel source s0/3/0 터널은 가상 인터페이스를 사용하는데 실제 패킷이 전송될 물리적 인터페이스를 설정 R1(config-if)#tunnel destination 203.230.7.2 터널의 도착지 주소 설정 R1(config-if)#exit

15 각 라우터에 터널링에 이용할 루프백 인터페이스 1 번 추가 - 111.111.111.1/24 - 122.122.122.1/24 - 133.133.133.1/24 터널링 설정 - Tunnel 12: 163.180.116.1 - Tunnel 21: 163.180.116.2 - Tunnel 23: 163.180.117.1 - Tunnel 32: 163.180.117.2 터널간 RIPv2 를 이용해 라우팅 설정 111.111.111.1/24 122.122.122.1/24 133.133.133.1/24 163.180.116.1 163.180.116.2 163.180.117.1 163.180.117.2

16 R1(config)#int tunnel 12 R1(config-if)#ip add 163.180.116.1 255.255.255.0 R1(config-if)#tunnel source s0/3/0 R1(config-if)#tunnel destination 203.230.7.2 R1(config-if)#exit R2(config)#interface tunnel 21 R2(config-if)#ip add 163.180.116.2 255.255.255.0 R2(config-if)#tunnel source s0/3/0 R2(config-if)#tunnel destination 203.230.7.1 R2(config-if)#exit R3(config)#interface tunnel 32 R3(config-if)#ip add 163.180.117.2 255.255.255.0 R3(config-if)#tunnel source s0/3/0 R3(config-if)#tunnel destination 150.183.235.1 R3(config-if)#exit R2(config-if)#interface tunnel 23 R2(config-if)#ip add 163.180.117.1 255.255.255.0 R2(config-if)#tunnel source s0/3/1 R2(config-if)#tunnel destination 150.183.235.2 R2(config-if)#exit R1(config)#int lo 1 R1(config-if)#ip add 111.111.111.1 255.255.255.0 R1(config-if)#exit R1(config)#router rip R1(config-router)#version 2 R1(config-router)#no auto-summary R1(config-router)#network 111.111.111.1 R1(config-router)#network 163.180.116.1 R1(config-router)#exit R2(config)#int lo 1 R2(config-if)#ip add 122.122.122.1 255.255.255.0 R2(config-if)#exit R2(config)#router rip R2(config-router)#version 2 R2(config-router)#no auto-summary R2(config-router)#network 122.122.122.1 R2(config-router)#network 163.180.116.2 R2(config-router)#network 163.180.117.1 R2(config-router)#exit R3(config)#int lo 1 R3(config-if)#ip add 133.133.133.1 255.255.255.0 R3(config-if)#exit R3(config)#router rip R3(config-router)#version 2 R3(config-router)#no auto-summary R3(config-router)#network 133.133.133.1 R3(config-router)#network 163.180.117.2 R3(config-router)#exit Rip version 2 라우팅 설정 터널 설정

17 R1#show ip route rip 122.0.0.0/24 is subnetted, 1 subnets R 122.122.122.0 [120/1] via 163.180.116.2, 00:00:22, Tunnel12 133.133.0.0/24 is subnetted, 1 subnets R 133.133.133.0 [120/2] via 163.180.116.2, 00:00:22, Tunnel12 163.180.0.0/24 is subnetted, 2 subnets R 163.180.117.0 [120/1] via 163.180.116.2, 00:00:22, Tunnel12 R2#show ip route rip 111.0.0.0/24 is subnetted, 1 subnets R 111.111.111.0 [120/1] via 163.180.116.1, 00:00:22, Tunnel21 133.133.0.0/24 is subnetted, 1 subnets R 133.133.133.0 [120/1] via 163.180.117.2, 00:00:02, Tunnel23 R3#show ip route rip 111.0.0.0/24 is subnetted, 1 subnets R 111.111.111.0 [120/2] via 163.180.117.1, 00:00:17, Tunnel32 122.0.0.0/24 is subnetted, 1 subnets R 122.122.122.0 [120/1] via 163.180.117.1, 00:00:17, Tunnel32 163.180.0.0/24 is subnetted, 2 subnets R 163.180.116.0 [120/1] via 163.180.117.1, 00:00:17, Tunnel32 OSPF – 물리적 인터페이스에 설정 RIP – 가상 터널인터페이스에 설정

18 R1#traceroute 13.13.13.2 Type escape sequence to abort. Tracing the route to 13.13.13.2 1 203.230.7.2 9 msec 3 msec 4 msec 2 150.183.235.2 7 msec 11 msec 8 msec 3 13.13.13.2 16 msec 15 msec 15 msec R1#traceroute 133.133.133.1 Type escape sequence to abort. Tracing the route to 133.133.133.1 1 163.180.116.2 15 msec 1 msec 3 msec 2 163.180.117.2 9 msec 20 msec 4 msec 물리 인터페이스를 통해 연결 터널 인터페이스를 통해 연결

19 PC1 과 PC2 사이의 통신은 터널을 통해 이루어지도록 설정

20 R1(config)#interface FastEthernet0/0 R1(config-if)#no shutdown R1(config-if)#ip address 1.1.1.1 255.255.255.0 R1(config-if)#exit R1(config)#interface Serial0/3/0 R1(config-if)#no shutdown R1(config-if)#clock rate 1000000 R1(config-if)#ip address 203.230.7.1 255.255.255.0 R1(config-if)#exit R1(config)#router rip R1(config-router)#version 2 R1(config-router)#network 1.1.1.0 R1(config-router)#network 203.230.7.0 R1(config-router)#network 150.183.235.0 R1(config-router)#exit R1(config)#int tunnel 1 R1(config-if)#ip add 150.183.235.1 255.255.255.0 R1(config-if)#tunnel source s0/3/0 R1(config-if)#tunnel destination 203.230.7.2 R1(config-if)#exit R1(config)#ip route 2.2.2.0 255.255.255.0 150.183.235.2 R2(config)#interface FastEthernet0/0 R2(config-if)#no shutdown R2(config-if)#ip address 2.2.2.1 255.255.255.0 R2(config-if)#exit R2(config)#interface Serial0/3/0 R2(config-if)#no shutdown R2(config-if)#ip address 203.230.7.2 255.255.255.0 R2(config-if)#exit R2(config)#router rip R2(config-router)#version 2 R2(config-router)#network 2.2.2.0 R2(config-router)#network 203.230.7.0 R2(config-router)#network 150.183.235.0 R2(config-router)#exit R2(config)#int tunnel 2 R2(config-if)#ip add 150.183.235.2 255.255.255.0 R2(config-if)#tunnel source s0/3/0 R2(config-if)#tunnel destination 203.230.7.1 R2(config-if)#exit R2(config)#ip route 1.1.1.0 255.255.255.0 150.183.235.1

21 PC>tracert 203.230.7.2 Tracing route to 203.230.7.2 over a maximum of 30 hops: 1 6 ms 5 ms 4 ms 1.1.1.1 2 10 ms 4 ms 17 ms 203.230.7.2 Trace complete. PC>tracert 2.2.2.2 Tracing route to 2.2.2.2 over a maximum of 30 hops: 1 3 ms 2 ms 3 ms 1.1.1.1 2 10 ms 2 ms 4 ms 150.183.235.2 3 10 ms 12 ms 8 ms 2.2.2.2 Trace complete. 목적지가 203.230.7.2 인 경우에는 물리적인 인터페이스로 연결 목적지가 2.2.2.2 인 경우에는 터널 인터페이스로 연결

22  GRE 터널링은 데이터 보안성이 없음  IPSec VPN 을 GRE 와 함께 사용하여 보안성 향상 가능  ISAKMP 정책 ◦ Authentication: pre-share ◦ Encryption: AES 256 ◦ Hash: sha ◦ Lifetime: 3600 초  IPSec 정책 ◦ 대상트래픽 : 각 라우터의 시리얼 인터페이스를 통해 나가는 모 든 트래픽 ◦ Encapsulation: ah-sha-hmac ◦ Encryption: esp-aes 256 ◦ Hash: esp-sha-hmac

23

24 150.183.235.1 150.183.235.2 150.183.235.5 150.183.235.6

25 R1(config)#interface FastEthernet0/0 R1(config-if)#no shutdown R1(config-if)#ip address 11.11.11.1 255.255.255.0 R1(config-if)#exit R1(config)#interface FastEthernet0/1 R1(config-if)#no shutdown R1(config-if)#ip address 21.21.21.1 255.255.255.0 R1(config-if)#exit R1(config)#crypto isakmp policy 10 R1(config-isakmp)#encr aes 256 R1(config-isakmp)#authentication pre-share R1(config-isakmp)#lifetime 3600 R1(config-isakmp)#hash sha R1(config-isakmp)#exit R1(config)#crypto ipsec transform-set strong esp-3des esp-md5-hmac R1(config)#crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 R1(config)#crypto map vpn 10 ipsec-isakmp R1(config-crypto-map)#set peer 203.230.7.2 R1(config-crypto-map)#set transform-set strong R1(config-crypto-map)#match address 110 R1(config-crypto-map)#exit R1(config)#int s0/3/0 R1(config-if)#ip add 203.230.7.1 255.255.255.0 R1(config-if)#clock rate 64000 R1(config-if)#crypto map vpn R1(config-if)#no shutdown R1(config-if)#exit R1(config)#int tunnel 13 R1(config-if)#ip add 150.183.235.1 255.255.255.252 R1(config-if)#tunnel source s0/3/0 R1(config-if)#tunnel destination 203.230.7.2 R1(config-if)#exit R1(config)#router ospf 7 R1(config-router)#network 150.183.0.0 0.0.255.255 a 0 R1(config-router)#network 11.11.11.1 0.0.0.0 a 0 R1(config-router)#network 21.21.21.1 0.0.0.0 a 0 R1(config-router)#network 203.230.7.1 0.0.0.0 a 0 R1(config-router)#exit R1(config)#access-list 110 permit gre host 203.230.7.1 host 203.230.7.2 R1(config)# ISAKMP 정책 선언 IPSec 정책 선언 ISAKMP 인증 암호 선언 어떤 트래픽에 대해 IPSec, ISAKMP 를 적용할 것인지 선언 VPN 동작을 선언 GRE 터널을 설정 정책이 적용될 범위를 ACL 로 정의

26 R2(config)#interface FastEthernet0/0 R2(config-if)#ip address 12.12.12.1 255.255.255.0 R2(config-if)#exit R2(config)#crypto isakmp policy 10 R2(config-isakmp)#encr aes 256 R2(config-isakmp)#authentication pre-share R2(config-isakmp)#lifetime 3600 R2(config-isakmp)#hash sha R2(config-isakmp)#exit R2(config)#crypto ipsec transform-set strong esp-3des esp-md5-hmac R2(config)#crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 R2(config)#crypto map vpn 10 ipsec-isakmp R2(config-crypto-map)#set peer 203.230.7.1 R2(config-crypto-map)#set transform-set strong R2(config-crypto-map)#match address 110 R2(config-crypto-map)#exit R2(config)#crypto map vpn 20 ipsec-isakmp R2(config-crypto-map)#set peer 160.183.235.2 R2(config-crypto-map)#set transform-set strong R2(config-crypto-map)#match address 120 R2(config-crypto-map)#exit R2(config)#int s0/3/0 R2(config-if)#ip add 203.230.7.2 255.255.255.0 R2(config-if)#crypto map vpn R2(config-if)#no shutdown R2(config-if)#exit R2(config)#int s0/3/1 R2(config-if)#ip add 160.183.235.1 255.255.255.0 R2(config-if)#clock rate 64000 R2(config-if)#crypto map vpn R2(config-if)#no shutdown R2(config-if)#exit R2(config)#int tunnel 13 R2(config-if)#ip add 150.183.235.2 255.255.255.252 R2(config-if)#tunnel source s0/3/0 R2(config-if)#tunnel destination 203.230.7.1 R2(config-if)#exit R2(config)#int tunnel 23 R2(config-if)#ip address 150.183.235.5 255.255.255.252 R2(config-if)#tunnel source s0/3/1 R2(config-if)#tunnel destination 160.183.235.2 R2(config-if)#exit R2(config)#router ospf 7 R2(config-router)#network 150.183.0.0 0.0.255.255 a 0 R2(config-router)#network 203.230.7.2 0.0.0.0 a 0 R2(config-router)#network 160.183.235.1 0.0.0.0 a 0 R2(config-router)#exit R2(config)#access-list 110 permit gre host 203.230.7.2 host 203.230.7.1 R2(config)#access-list 120 permit gre host 160.183.235.1 host 160.183.235.2

27 R3(config)#interface FastEthernet0/0 R3(config-if)#no shutdown R3(config-if)#ip address 13.13.13.1 255.255.255.0 R3(config-if)#exit R3(config)#interface FastEthernet0/1 R3(config-if)#no shutdown R3(config-if)#ip address 23.23.23.1 255.255.255.0 R3(config-if)#exit R3(config)#crypto isakmp policy 10 R3(config-isakmp)#encr aes 256 R3(config-isakmp)#authentication pre-share R3(config-isakmp)#lifetime 3600 R3(config-isakmp)#hash sha R3(config-isakmp)#exit R3(config)#crypto ipsec transform-set strong esp-3des esp-md5-hmac R3(config)#crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 R3(config)#crypto map vpn 20 ipsec-isakmp R3(config-crypto-map)#set peer 160.183.235.1 R3(config-crypto-map)#set transform-set strong R3(config-crypto-map)#match address 120 R3(config-crypto-map)#exit R3(config)#crypto map vpn 10 ipsec-isakmp R3(config-crypto-map)#set peer 203.230.7.1 R3(config-crypto-map)#set peer 160.183.235.1 R3(config-crypto-map)#set transform-set strong R3(config-crypto-map)#match address 120 R3(config-crypto-map)#exit R3(config)#int s0/3/0 R3(config-if)#ip add 160.183.235.2 255.255.255.0 R3(config-if)#crypto map vpn R3(config-if)#no shutdown R3(config-if)#exit R3(config)#int tunnel 23 R3(config-if)#ip address 150.183.235.6 255.255.255.252 R3(config-if)#tunnel source s0/3/0 R3(config-if)#tunnel destination 160.183.235.1 R3(config-if)#exit R3(config)#router ospf 7 R3(config-router)#network 150.183.0.0 0.0.255.255 a 0 R3(config-router)#network 13.13.13.1 0.0.0.0 a 0 R3(config-router)#network 23.23.23.1 0.0.0.0 a 0 R3(config-router)#network 160.183.235.2 0.0.0.0 a 0 R3(config-router)#exit R3(config)#access-list 120 permit gre host 160.183.235.2 host 160.183.235.1

28 VPN 을 통해 연결됨을 확인 11.11.11.2/24

29  Show crypto ipsec sa ◦ VPN 이 적용된 인터페이스별로 VPN 에 관한 모든 정보 확 인  Show crypto ipsec transform-set ◦ IPSec 설정이 올바로 적용되었는지 확인  Show crypto isakmp policy ◦ ISAKMP 정책 확인  Show crypto isakmp sa ◦ VPN 의 출발지, 도착지, 현재 상태 확인  Show crypto map ◦ VPN 의 연결정보, ACL 확인

30 R2#show crypto ipsec sa interface: Serial0/3/0 Crypto map tag: vpn, local addr 203.230.7.2 protected vrf: (none) local ident (addr/mask/prot/port): (203.230.7.2/255.255.255.255/47/0) remote ident (addr/mask/prot/port): (203.230.7.1/255.255.255.255/47/0) current_peer 203.230.7.1 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 339, #pkts encrypt: 339, #pkts digest: 0 #pkts decaps: 333, #pkts decrypt: 333, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 203.230.7.2, remote crypto endpt.:203.230.7.1 path mtu 1500, ip mtu 1500, ip mtu idb Serial0/3/0 current outbound spi: 0x71A90ABA(1906903738) inbound esp sas: spi: 0x0EA95861(245979233) --More--

31 R2#show crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id slot status 203.230.7.1 203.230.7.2 QM_IDLE 1075 0 ACTIVE (deleted) 160.183.235.2 160.183.235.1 QM_IDLE 1089 0 ACTIVE (deleted) IPv6 Crypto ISAKMP SA R2#show crypto isakmp policy Global IKE policy Protection suite of priority 10 encryption algorithm: AES - Advanced Encryption Standard (256 bit keys). hash algorithm: Secure Hash Standard authentication method: Pre-Shared Key Diffie-Hellman group: #1 (768 bit) lifetime: 3600 seconds, no volume limit Default protection suite encryption algorithm: DES - Data Encryption Standard (56 bit keys). hash algorithm: Secure Hash Standard authentication method: Rivest-Shamir-Adleman Signature Diffie-Hellman group: #1 (768 bit) lifetime: 86400 seconds, no volume limit

32 R2#show crypto map Crypto Map vpn 10 ipsec-isakmp Peer = 203.230.7.1 Extended IP access list 110 access-list 110 permit gre host 203.230.7.2 host 203.230.7.1 Current peer: 203.230.7.1 Security association lifetime: 4608000 kilobytes/3600 seconds PFS (Y/N): N Transform sets={ strong, } Interfaces using crypto map vpn: Serial0/3/0 Serial0/3/1 Crypto Map vpn 20 ipsec-isakmp Peer = 160.183.235.2 Extended IP access list 120 access-list 120 permit gre host 160.183.235.1 host 160.183.235.2 Current peer: 160.183.235.2 Security association lifetime: 4608000 kilobytes/3600 seconds PFS (Y/N): N Transform sets={ strong, } Interfaces using crypto map vpn: Serial0/3/0 Serial0/3/1

33  실습 1. GRE 터널링 실습 ( 그림 13-1)  실습 2. 터널링을 통한 트래픽 분산과 제어 ( 그림 13-2)  실습 3. GRE+IPSec VPN ( 그림 13-4)

34  실습 4. 윈도우 7 에서의 VPN 연결 실습 VPN 서버 VPN 클라이언트 제어판 -> 네트워크 및 인터넷 -> 네트워크 및 공유센터 -> 어댑터 설정 변경 -> Alt -> 파일 -> 새로 들어오는 연결 -> 사용자 계정 선택 -> 인터넷을 통해 -> 엑세스 허용 Ipconfig 로 ppp 연결 확인 제어판 -> 네트워크 및 인터넷 -> 네트워크 및 공유센터 -> 새 연결 또는 네트워크 설정 -> 회사에 연결 -> 새 연결을 만듭니다 -> 내 인터넷 연결 사용 -> 인터넷 주소 입력 -> VPN 연결 -> 사용자 이름, 암호 입력 Ipconfig 로 ppp 연결 확인

35  연결 후 wireshark 를 이용한 패킷 분석 ◦ VPN 연결을 이용하는 통신은 보안통신 ppp 로 연결됨