Configuring Cisco Easy VPN and Easy VPN Server Using SDM参考.ppt

IPsec VPNs Configuring Cisco Easy VPN and Easy VPN Server Using SDM Introducing Cisco Easy VPN Cisco Easy VPN has two main functions:Cisco Easy VPN有两种主要的功能: Simplify client configuration简单的客户端配置 Centralize client configuration and dynamically push the configuration to clients集中的客户端配置以及向客户端推送配置 How are these two goals achieved?如何完成两个目标? IKE Mode Config functionality is used to download some configuration parameters to clients.IKE模式配置用于下载配置参数到客户端 Clients are preconfigured with a set of IKE policies and IPsec transform sets.客户端预先配置IKE策略集和IPsec变换集 Cisco Easy VPN Components Easy VPN Server: Enables Cisco IOS routers, Cisco PIX Firewalls, and Cisco VPN Concentrators to act as VPN head-end devices in site-to-site or remote-access VPNs, in which the remote office devices are using the Cisco Easy VPN Remote feature Easy VPN Server: 在站点到站点或者远程访问VPN中能够激活Cisco IOS 路由器、Cisco PIX防火墙和Cisco VPN集中器充当VPN前端设备为远端设备提供使用Cisco Easy VPN远程连接特性. Easy VPN Remote: Enables Cisco IOS routers, Cisco PIX Firewalls, and Cisco VPN Hardware Clients or Software Clients to act as remote VPN clientsEasy VPN Remote: 能够激活Cisco IOS 路由器、Cisco PIX防火墙和Cisco VPN硬件软件客户端充当远程VPN的连接客户端. Remote Access Using Cisco Easy VPN Cisco Easy VPN RemoteConnection Process The VPN client initiates the IKE Phase 1 process.VPN客户端初始化IKE阶段1处理 The VPN client establishes an ISAKMP SA.VPN客户端建立ISAKMP的安全联盟. The Easy VPN Server accepts the SA proposal.Easy VPN Server接受客户端的SA建议. The Easy VPN Server initiates a username and password challenge.Easy VPN Server初始化用户名和密码挑战. The mode configuration process is initiated.模式配置处理进行初始化. The RRI process is initiated.RRI处理被初始化. IPsec quick mode completes the connection.IPsec快速模式完成连接. Step 1: The VPN Client Initiatesthe IKE Phase 1 Process Using pre-shared keys? Initiate aggressive mode.是否使用预共享密钥? 初始化积极模式. Using digital certificates? Initiate main mode.使用数字证书? 初始化主模式. Step 2: The VPN Client Establishesan ISAKMP SA The VPN client attempts to establish an SA between peer IP addresses