VPNs Illustrated: Tunnels, Vpns, and Ipsec: Tunnels, Vpns, and Ipsec

Cover......Page 1 Contents......Page 8 Preface......Page 14 Part 1. Background......Page 18 1.1 Purpose......Page 20 1.3 Typographical Conventions......Page 21 1.5 Testbed......Page 22 1.6 Road Map......Page 23 1.7 Summary......Page 25 2.2 Layering......Page 26 2.3 Encapsulation......Page 28 2.4 Addressing......Page 30 2.5 IP......Page 37 2.6 UDP......Page 39 2.7 TCP......Page 41 2.8 ICMP......Page 48 2.9 NAT and Private IP Addresses......Page 52 2.10 PPP......Page 57 2.11 IPv6......Page 60 2.12 Routing......Page 64 2.13 Summary......Page 71 Exercises......Page 72 3.1 Introduction......Page 74 3.2 Symmetric Ciphers......Page 75 3.3 Asymmetric Ciphers......Page 86 3.4 Cryptographic Hash Functions, MACs, and HMACs......Page 92 3.5 Digital Signatures......Page 97 3.6 Certificates......Page 100 3.7 Summary......Page 104 Exercises......Page 105 4.1 Introduction......Page 106 4.2 IP-in-IP Tunnels......Page 109 4.3 PPPoE......Page 112 4.4 GRE......Page 117 4.5 PPTP......Page 121 4.6 L2TP......Page 126 4.7 MPLS......Page 152 4.8 gtunnel......Page 162 4.9 Summary......Page 168 Exercises......Page 169 Part 2. Tunnels and VPNs......Page 170 5.1 Introduction......Page 172 5.2 PPTP......Page 174 5.3 L2TP......Page 175 5.4 Other VPNs......Page 179 Exercises......Page 180 6.1 Introduction......Page 182 6.2 Cipher Suites......Page 183 6.3 The SSL Protocol......Page 184 6.4 SSL on the Wire......Page 188 6.5 OpenSSL......Page 208 6.6 The stunnel Program......Page 213 6.7 SSL Security......Page 221 Exercises......Page 222 7.1 Introduction......Page 224 7.2 The SSHv1 Protocol......Page 225 7.3 The SSHv2 Protocol......Page 249 7.4 Building VPNs with SSH......Page 277 Exercises......Page 283 8.2 VTun......Page 284 8.3 CIPE......Page 289 8.4 Tinc......Page 300 8.5 OpenVPN......Page 309 Exercises......Page 319 Part 3. IPSec......Page 322 9.1 Introduction......Page 324 9.3 Road Map for Part 3......Page 325 9.4 Summary......Page 326 Exercises......Page 327 10.1 Introduction......Page 328 10.2 Protocols......Page 329 10.3 IPsec Modes......Page 330 10.4 Security Associations......Page 333 10.5 Combining Security Associations......Page 335 10.6 Policies......Page 337 10.7 IPsec Processing......Page 338 10.8 Summary......Page 340 Exercises......Page 341 11.1 Introduction......Page 342 11.2 The AH Header......Page 343 11.3 Sequence Numbers......Page 345 11.4 AH Processing......Page 347 11.5 Transport Mode......Page 348 11.6 Tunnel Mode......Page 350 11.7 AH with IPv6......Page 353 Exercises......Page 355 12.1 Introduction......Page 358 12.2 The ESP Header......Page 359 12.3 ESP Processing......Page 361 12.4 Transport Mode......Page 362 12.5 Tunnel Mode......Page 365 12.6 ESP with IPv6......Page 370 12.7 Summary......Page 371 Exercises......Page 372 13.1 Introduction......Page 374 13.2 ISAKMP......Page 375 13.3 IKE......Page 392 13.4 An Example Negotiation......Page 405 13.5 Summary......Page 410 Exercises......Page 411 14.1 Introduction......Page 414 14.2 IPsec Architecture......Page 415 14.3 AH......Page 418 14.4 ESP......Page 420 14.5 IKE......Page 421 14.6 NAT Traversal......Page 426 Exercises......Page 433 A.2 Cryptographic Routines......Page 436 A.3 Library Code......Page 440 B.1 Netcat......Page 442 B.2 tcpdump and Other Packet Sniffers......Page 443 B.3 ssldump......Page 446 B.4 PPP......Page 448 Bibliography......Page 452 A......Page 462 C......Page 463 E......Page 465 F......Page 466 I......Page 467 K......Page 469 M......Page 470 O......Page 471 P......Page 472 S......Page 474 T......Page 477 Z......Page 478 Cover 1 Contents 8 Preface 14 Part 1. Background 18 Chapter 1. Introduction 20 1.1 Purpose 20 1.2 Readers 21 1.3 Typographical Conventions 21 1.4 Source Code and Third-Party Programs 22 1.5 Testbed 22 1.6 Road Map 23 1.7 Summary 25 Chapter 2. TCP/IP Overview 26 2.1 Introduction 26 2.2 Layering 26 2.3 Encapsulation 28 2.4 Addressing 30 2.5 IP 37 2.6 UDP 39 2.7 TCP 41 2.8 ICMP 48 2.9 NAT and Private IP Addresses 52 2.10 PPP 57 2.11 IPv6 60 2.12 Routing 64 2.13 Summary 71 Exercises 72 Chapter 3. Cryptography Overview 74 3.1 Introduction 74 3.2 Symmetric Ciphers 75 3.3 Asymmetric Ciphers 86 3.4 Cryptographic Hash Functions, MACs, and HMACs 92 3.5 Digital Signatures 97 3.6 Certificates 100 3.7 Summary 104 Exercises 105 Chapter 4. Tunnels 106 4.1 Introduction 106 4.2 IP-in-IP Tunnels 109 4.3 PPPoE 112 4.4 GRE 117 4.5 PPTP 121 4.6 L2TP 126 4.7 MPLS 152 4.8 gtunnel 162 4.9 Summary 168 Exercises 169 Part 2. Tunnels and VPNs 170 Chapter 5. Virtual Private Networks 172 5.1 Introduction 172 5.2 PPTP 174 5.3 L2TP 175 5.4 Other VPNs 179 5.5 Summary 180 Exercises 180 Chapter 6. Secure Sockets Layer 182 6.1 Introduction 182 6.2 Cipher Suites 183 6.3 The SSL Protocol 184 6.4 SSL on the Wire 188 6.5 OpenSSL 208 6.6 The stunnel Program 213 6.7 SSL Security 221 6.8 Summary 222 Exercises 222 Chapter 7. SSH 224 7.1 Introduction 224 7.2 The SSHv1 Protocol 225 7.3 The SSHv2 Protocol 249 7.4 Building VPNs with SSH 277 7.5 Summary 283 Exercises 283 Chapter 8. Lightweight VPNs 284 8.1 Introduction 284 8.2 VTun 284 8.3 CIPE 289 8.4 Tinc 300 8.5 OpenVPN 309 8.6 Summary 319 Exercises 319 Part 3. IPSec 322 Chapter 9. IPsec 324 9.1 Introduction 324 9.2 An Overview of IPsec 325 9.3 Road Map for Part 3 325 9.4 Summary 326 Exercises 327 Chapter 10. IPsec Architecture 328 10.1 Introduction 328 10.2 Protocols 329 10.3 IPsec Modes 330 10.4 Security Associations 333 10.5 Combining Security Associations 335 10.6 Policies 337 10.7 IPsec Processing 338 10.8 Summary 340 Exercises 341 Chapter 11. AH 342 11.1 Introduction 342 11.2 The AH Header 343 11.3 Sequence Numbers 345 11.4 AH Processing 347 11.5 Transport Mode 348 11.6 Tunnel Mode 350 11.7 AH with IPv6 353 11.8 Summary 355 Exercises 355 Chapter 12. ESP 358 12.1 Introduction 358 12.2 The ESP Header 359 12.3 ESP Processing 361 12.4 Transport Mode 362 12.5 Tunnel Mode 365 12.6 ESP with IPv6 370 12.7 Summary 371 Exercises 372 Chapter 13. IKE 374 13.1 Introduction 374 13.2 ISAKMP 375 13.3 IKE 392 13.4 An Example Negotiation 405 13.5 Summary 410 Exercises 411 Chapter 14. IPsec Futures 414 14.1 Introduction 414 14.2 IPsec Architecture 415 14.3 AH 418 14.4 ESP 420 14.5 IKE 421 14.6 NAT Traversal 426 14.7 Summary 433 Exercises 433 Appendix A: Source Code 436 A.1 Introduction 436 A.2 Cryptographic Routines 436 A.3 Library Code 440 Appendix B: Miscellaneous Software 442 B.1 Netcat 442 B.2 tcpdump and Other Packet Sniffers 443 B.3 ssldump 446 B.4 PPP 448 Bibliography 452 Index 462 A 462 B 463 C 463 D 465 E 465 F 466 G 467 H 467 I 467 J 469 K 469 L 470 M 470 N 471 O 471 P 472 Q 474 R 474 S 474 T 477 U 478 V 478 W 478 X 478 Y 478 Z 478

Virtual private networks (VPNs) based on the Internet instead of the traditional leased lines offer organizations of all sizes the promise of a low-cost, secure electronic network. However, using the Internet to carry sensitive information can present serious privacy and security problems. By explaining how VPNs actually work, networking expert Jon Snader shows software engineers and network administrators how to use tunneling, authentication, and encryption to create safe, effective VPNs for any environment.

Using an example-driven approach, VPNs Illustrated explores how tunnels and VPNs function by observing their behavior on the wire. By learning to read and interpret various network traces, such as those produced by tcpdump, readers will be able to better understand and troubleshoot VPN and network behavior.

Specific topics covered include:

• Block and stream symmetric ciphers, such as AES and RC4; and asymmetric ciphers, such as RSA and EIGamal
• Message authentication codes, including HMACs
• Tunneling technologies based on gtunnel
• SSL protocol for building network-to-network VPNs
• SSH protocols as drop-in replacements for telnet, ftp, and the BSD r-commands
• Lightweight VPNs, including VTun, CIPE, tinc, and OpenVPN
• IPsec, including its Authentication Header (AH) protocol, Encapsulating Security Payload (ESP), and IKE (the key management protocol)

Packed with details, the text can be used as a handbook describing the functions of the protocols and the message formats that they use. Source code is available for download, and an appendix covers publicly available software that can be used to build tunnels and analyze traffic flow.

VPNs Illustrated gives you the knowledge of tunneling and VPN technology you need to understand existing VPN implementations and successfully create your own.

Virtual private networks (VPNs) based on the Internet instead of the traditional leased lines offer organizations of all sizes the promise of a low-cost, secure electronic network. However, using the Internet to carry sensitive information can present serious privacy and security problems. By explaining how VPNs actually work, networking expert Jon Snader shows software engineers and network administrators how to use tunneling, authentication, and encryption to create safe, effective VPNs for any environment. Using an example-driven approach, VPNs Illustrated explores how tunnels and VPNs function by observing their behavior "on the wire." By learning to read and interpret various network traces, such as those produced by tcpdump, readers will be able to better understand and troubleshoot VPN and network behavior. Specific topics covered include: Block and stream symmetric ciphers, such as AES and RC4; and asymmetric ciphers, such as RSA and EIGamal Message authentication codes, including HMACs Tunneling technologies based on gtunnel SSL protocol for building network-to-network VPNs SSH protocols as drop-in replacements for telnet, ftp, and the BSD r-commands Lightweight VPNs, including VTun, CIPE, tinc, and OpenVPN IPsec, including its Authentication Header (AH) protocol, Encapsulating Security Payload (ESP), and IKE (the key management protocol) Packed with details, the text can be used as a handbook describing the functions of the protocols and the message formats that they use. Source code is available for download, and an appendix covers publicly available software that can be used to build tunnels and analyze traffic flow. VPNs Illustrated gives you the knowledge of tunneling and VPN technology you need to understand existing VPN implementations and successfully create your own. Virtual private networks (VPNs) based on the Internet instead of the traditional leased lines offer organizations of all sizes the promise of a low-cost, secure electronic network. However, using the Internet to carry sensitive information can present serious privacy and security problems. By explaining how VPNs actually work, networking expert Jon Snader shows software engineers and network administrators how to use tunneling, authentication, and encryption to create safe, effective VPNs for any environment.Using an example-driven approach,explores how tunnels and VPNs function by observing their behavior "on the wire." By learning to read and interpret various network traces, such as those produced by tcpdump, readers will be able to better understand and troubleshoot VPN and network behavior.Specific topics covered include:Block and stream symmetric ciphers, such as AES and RC4; and asymmetric ciphers, such as RSA and EIGamal Message authentication codes, including HMACs Tunneling technologies based on gtunnel SSL protocol for building network-to-network VPNs SSH protocols as drop-in replacements for telnet, ftp, and the BSD r-commands Lightweight VPNs, including VTun, CIPE, tinc, and OpenVPN IPsec, including its Authentication Header (AH) protocol, Encapsulating Security Payload (ESP), and IKE (the key management protocol) Packed with details, the text can be used as a handbook describing the functions of the protocols and the message formats that they use. Source code is available for download, and an appendix covers publicly available software that can be used to build tunnels and analyze traffic flow.**__VPNs Illustrated__** "Using an example-driven approach, VPNs Illustrated explores how tunnels and VPNs function by observing their behavior "on the wire." By learning to read and interpret various network traces, such as those produced by tcpdump, readers will be able to better understand and troubleshoot VPN and network behavior."--Jacket