IKEv2 IPsec Virtual Private Networks Understanding and Deploying IKEv2, IPsec VPNs, and FlexVPN in Cisco IOS

by Bartlett, Graham; Inamdar, Amjad

• ISBN13: 9781587144608
• ISBN10: 1587144603
• Edition: 1st
• Format: Paperback
• Copyright: 2016-09-12
• Publisher: Cisco Press

Summary

Create and manage highly-secure Ipsec VPNs with IKEv2 and Cisco FlexVPN

The IKEv2 protocol significantly improves VPN security, and Cisco’s FlexVPN offers a unified paradigm and command line interface for taking full advantage of it. Simple and modular, FlexVPN relies extensively on tunnel interfaces while maximizing compatibility with legacy VPNs. Now, two Cisco network security experts offer a complete, easy-tounderstand, and practical introduction to IKEv2, modern IPsec VPNs, and FlexVPN.

The authors explain each key concept, and then guide you through all facets of FlexVPN planning, deployment, migration, configuration, administration, troubleshooting, and optimization. You’ll discover how IKEv2 improves on IKEv1, master key IKEv2 features, and learn how to apply them with Cisco FlexVPN.

IKEv2 IPsec Virtual Private Networks offers practical design examples for many common scenarios, addressing IPv4 and IPv6, servers, clients, NAT, pre-shared keys, resiliency, overhead, and more. If you’re a network engineer, architect, security specialist, or VPN administrator, you’ll find all the knowledge you need to protect your organization with IKEv2 and FlexVPN.

• Understand IKEv2 improvements: anti-DDoS cookies, configuration payloads, acknowledged responses, and more
• Implement modern secure VPNs with Cisco IOS and IOS-XE
• Plan and deploy IKEv2 in diverse real-world environments
• Configure IKEv2 proposals, policies, profiles, keyrings, and authorization
• Use advanced IKEv2 features, including SGT transportation and IKEv2 fragmentation
• Understand FlexVPN, its tunnel interface types, and IOS AAA infrastructure
• Implement FlexVPN Server with EAP authentication, pre-shared keys, and digital signatures
• Deploy, configure, and customize FlexVPN clients
• Configure, manage, and troubleshoot the FlexVPN Load Balancer
• Improve FlexVPN resiliency with dynamic tunnel source, backup peers, and backup tunnels
• Monitor IPsec VPNs with AAA, SNMP, and Syslog
• Troubleshoot connectivity, tunnel creation, authentication, authorization, data encapsulation, data encryption, and overlay routing
• Calculate IPsec overhead and fragmentation
• Plan your IKEv2 migration: hardware, VPN technologies, routing, restrictions, capacity, PKI, authentication, availability, and more

Author Biography

Graham Bartlett (CCIE, CISSP) is a Networking Consulting Engineer for Cisco Security Solutions. He has designed many large scale virtual private networks, and helped customers around the world leverage IKEv2 and next-generation encryption. He has discovered a number of zero-day VPN vulnerabilities, and has intellectual property published as prior art. A member of CLAS, he holds a BSc (Hons) in Computer Systems and Networks.

 

Amjad Inamdar (CISSP, CCSK, CCNP Security, CCDP, CCNP RandS) is Senior Technical Leader with Cisco IOS Security Engineering. He has 16+ years of experience in networking and security, including 10+ years at Cisco. He specializes in the design, development and deployment of IOS IPsec secure connectivity solutions, including FlexVPN, DMVPN, GetVPN and EzVPN solutions. He has extensive experience with the IKEv2 protocol, wrote an IETF draft on IKEv2-based data communication, and has authored a patent. He holds a B.E. degree in Electronics and Communication Engineering.

Table of Contents

Part 1: The IKEv2 Protocol
1. Introduction to IPsec VPNs
2. IKEv2 the Protocol
3. IKEv2: Comparison with IKEv1
4. Modes of IPsec Used with IKEv2

 

Part 2: IKEv2 Features and Configuration
5. IKEv2 Features
6. IKEv2 Configuration

 

Part 3: Configuring IKEv2 with Cisco Flex VPN
7. Introduction to FlexVPN
8. FlexVPN Deployments
9. FlexVPN Remote Access Server
10. FlexVPN Remote Access Client
11. FlexVPN Load Balancer

 

Part 4: IKEv2 Migration and Troubleshooting
12. Migration Strategies
13. Monitoring and Troubleshooting