VIRTUAL PRIVATE NETWORKS USING CISCO IOS ROUTERS

74. Which security services does IPSec provide? Data integrity, origin authentication, antireplay protection, and confidentiality.

75. You use encryption to deter a man-in-the-middle attack.

76. DES, 3DES, AES, and RSA are types of encryption algorithms.

77. You use Diffie-Hellman (D-H) to derive shared secrets between two IPSec peers.

78. You use HMACs to provide authentication in IKE Phase 2.

79. RSA uses asymmetric keys for encryption.

80. AH does not provide payload encryption.

81. ESP provides authentication and encryption of the payload.

82. You can do peer authentication using preshared keys, RSA signatures, and RSA encrypted nonces .

83. You can have multiple transform sets on each router.

84. You globally configure lifetime parameters for IPSec using the crypto ipsec security-association lifetime command.

85. SHA-1 is stronger than MD5.

86. 3DES is stronger than DES.

87. AES is designed to be more secure than DES and has variable key length. By default, it uses a 128-bit key; however, it can also be configured to use a 192-bit key or a 256-bit key.

88. RSA signatures are stronger than preshared keys.

89. You use crypto key zeroize rsa to remove all old keys from a router.

90. The goal of planning for IKE Phase 1 is to minimize potential misconfiguration.

91. ESP is IP protocol number 50. AH is protocol number 51. IKE uses UDP port 500.

92. No user data flows across the IKE Phase 1 tunnel.

93. By default, the identity command uses the address keyword. Therefore, whatever IP address you configured on a specific interface will be used for authentication.

94. The ISAKMP policy default protection suite is

    Encryption algorithm DES

    Hash algorithm SHA

    Authentication method RSA signatures

    D-H group #1 (768 bit)Lifetime86,400 seconds, no volume limit

95. The priority values are used internally by a router and have no meaning or significance to the remote IPSec peer router. Commands to create an IKE Phase 1 policy follow:

     crypto isakmp policy  priority  encryption {des  3des} hash {sha  md5} authentication {rsa-sig  rsa-encr  pre-share} group {1  2} lifetime  seconds  

96. You can use a command to configure a preshared key using the IP address of the remote IPSec peer. If you are using a preshared key of ATLANTIS and the remote's IP address is 30.1.1.1, issue the following command:

     Router(config)# crypto isakmp key ATLANTIS address 30.1.1.1 

97. A route stores a Certificate Revocation List (CRL) in its memory if the CA does not use an RA. If the CA uses an RA, the router must store multiple CRLs in memory.

98. If the router already has RSA keys and you need to delete the keys, use the command crypto key zeroize rsa .

99. The usage-keys keyword is an optional parameter used to generate two RSA key pairs.

100. Configure CA support using the following commands:

      R1(config)# crypto ca trustpoint name R1(ca-trustpoint)# enrollment url http://SECUR/certsrv/mscep/mscep.dll R1(config)# crypto ca authenticate name R1(config)# crypto ca enroll name 

101. Crypto ACLs determine whether outbound traffic should be encrypted and what traffic is forwarded in cleartext (bypassed).

102. Crypto ACLs determine whether received traffic is permitted into the router, the traffic is dropped, or the traffic bypasses the router's IPSec engine.

103. To configure a transform set, use the command crypto ipsec security-association lifetime {seconds seconds kilobytes kilobytes } .

104. Before the IPSec is torn down, a new tunnel is renegotiated, and there is no interruption in the flow of data traffic.

105. The match address command in crypto map configuration mode actually specifies the crypto ACL that will be used.

106. You can apply only a single crypto map to an interface. However, you can use the same crypto map on multiple interfaces.

107. Easy VPN consists of an Easy VPN Server and an Easy VPN Remote.

108. The Easy VPN Server pushes security policies to the Easy VPN Remote device.

109. The Cisco Easy VPN features require IOS version 12.2(8)T if you are using a router as a head-end device or remote device.

110. Some of the new features added to IOS version 12.2(8)T are mode configuration, XAUTH, IKE, dead peer detection (DPD), and split tunneling.

111. Easy VPN supports HMAC-MD5 and HMAC-SHA1.

112. Easy VPN supports preshared keys and RSA signatures.

113. Easy VPN supports D-H groups 2 and 5.

114. Easy VPN supports DES and 3DES for IKE encryption.

115. Easy VPN supports DES, 3DES, and NULL for IPSec encryption.

116. Easy VPN supports ESP and IPCOMP-LZS. Compression is implemented using IPCOMP-LZS.

117. Easy VPN supports tunnel mode only.

118. Easy VPN does not support Digital Signature Standard, AH, and PFS.

119. IOS version 12.2(8)YJ supported Easy VPN Remote Phase II features.

120. Easy VPN Remote devices do not support subinterfaces, PFS, and multiple peers. Only D-H group 2 is supported.

121. Disable the Easy VPN Remote Web Manager by using the command no ip http ezvpn . Enable the Cable Monitor Web interface with the command ip http cable-monitor .

122. Use the key command to configure a preshared key for a specific group in ISAKMP group configuration mode.

123. You can define a maximum of two DNS servers and two WINS servers.

124. The fields for the preshared key are labeled Password and Confirm Password. Do not get confused ; the password fields are the preshared key that is used for authentication during IKE Phase 1.

125. MTU size options are default, 576, 1400, and custom. The default MTU size is about 1420 bytes. If you select custom, you can enter any MTU size in the field provided.

126. SSL is used between the clients and the Router MC. SSH is used between the Router MC and the managed router.

127. The two ways to populate the Router MC inventory database is through device discovery or configuration file import.