VPN Setup 1

[robotdave]

Hi There

I'm still a Cisco Newbie, but the users on this site have helped my loads with the initial setup of my new pix 506e.

Now I have a solid security policy and no unwanted traffic in or out )

My second step is to implement VPN. I already have the client software but before I begin configuring things I thought I'd check to see if anybody here can offer some quick tips in the right direction.

Thanks in advance

Steve )

 

[yizhar]

HI.

VPN is a very big door to your internal network, so it should be protected as much as reasonable, while allowing the needed services.

So, some tips for protecting VPN:

* Ask yourself - what will happen if an attacker gains full or partial control over a remote machine. How much effort and time will (s)he need to gain access to the main network.

* Ask yourself - what services will be available via the VPN. Will you allow the common scenario of unlimitted traffic or only allow access to specific hosts and services like mail, intranet, etc...

* And ask yourself - how much time and effort will be needed by an attacker without taking control over a remote machine with VPN client.

* Dual authentication helps protecting the VPN. With Cisco PIX use the XAUTH feature (user will need to authenticate to the pix and also to a RADIUS server with different passwords).

* Some techniques like certificates and/or hardware (smart-cards, etc) can provide a higher level of protection.


Some tips for the actual implementation:

* Here are some related links:

http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Internetworking:IPSec

http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Hardware:PIX&s=Software_Configuration

* You can use PDM.

* If you have only the DES key (and not 3DES), then use MD5+DES rather then SHA+DES which is not compatible with the Cisco software VPN client.
If you do have 3DES, you can use either SHA or MD5.

* Test VPN using different connections types of the remote clinet, like:
Ethernet - directly connected to pix outside interface.
Dial up modem.
ADSL.
Behind another NAT/Firewall device.

Good luck.


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar