Triển khai mô phỏng

c) Các vấn đề còn tồn tại trong IPSec

3.5.2. Triển khai mô phỏng

 Mô hình mô phỏng trên GNS3:

 Gán địa chỉ IP cho các thiết bị:

Device Interface Sub-Int IP Mạng SM DG

TN S1/0 10.0.0.2 10.0.0.0 /24 Fa0/0 10.0.1.1 10.0.1.0 /24 HN S1/0 S1/0.10 2 10.0.2.1 10.0.2.0 /24 S1/0.10 3 10.0.3.2 10.0.3.0 /24 Fa0/0 10.0.4.1 10.0.4.0 /24 HCM S1/0 S1/0.20 1 10.0.2.2 10.0.2.0 /24 S1/0.20 3 10.0.5.2 10.0.5.0 /24 Fa0/0 10.0.6.1 10.0.6.0 /24 Center WAN S1/0 10.0.0.1 10.0.0.0 /24 S1/1 S1/1.30 1 10.0.3.1 10.0.3.0 /24 S1/1.30 2 10.0.5.1 10.0.5.0 /24 Fa0/0 172.16.1.1 172.16.1.0 /24 PIX Firewall E0 172.16.1.2 172.16.1.0 /24 E1 172.16.4.1 172.16.4.0 /24 E2 172.16.6.1 172.16.6.0 /24 E3 192.168.1.1 192.168.1.0 /24 Internet Router Fa0/0 192.168.1.10 0 192.168.1. 0 /24 F1/0 195.168.1.1 195.168.1.0 /24 Web Server 172.16.4.2 /24 172.16.4.1 Mail Server 172.16.4.3 /24 172.16.4.1 DNS Server 172.16.4.4 /24 172.16.4.1 Database Server 172.16.6.2 /24 172.16.6.1 App Server 172.16.6.3 /24 172.16.6.1 Report Server 172.16.6.4 /24 172.16.6.1 PC_HCM 10.0.6.6 /24 10.0.6.1 PC_HN 10.0.4.6 /24 10.0.4.1 PC_TN 10.0.1.6 /24 10.0.1.1 PC_outside 195.168.1.2 /24 195.168.1.

 Yêu cầu của mô hình mạng:

Router:

• Đặt mật khẩu console, đặc quyền (mã hóa mật khẩu), mở 5 đường telnet trên 4 Router:

 TN: Console: tncity; Đặc quyền: ciscotn; Telnet: ankhanhtn

 HN: Console: hncity; Đặc quyền: ciscohn; Telnet: ankhanhhn

 HCM: Console: hcmcity; Đặc quyền: ciscohcm; Telnet: ankhanhhcm

 Center WAN: Console: city; Đặc quyền: ciscowan; Telnet: ankhanhwan

• Cấu hình Frame Relay trên 3 Router: TN, HN, Center WAN sử dụng kỹ thuật Sub-Interface và Dynamic Map Point-to-Point với DLCI như sau:

 HN HCM = 102; HN CENTER_WAN = 103;

 HCM HN = 201; HCM CENTER_WAN = 203;

 CENTER_WAN HN = 301; CENTER_WAN HCM = 302

• Trên Router TN và Router Center WAN cấu hình PPP xác thực bằng giao thức CHAP với password: truongneo

• Cấu hình định tuyến động RIP trên 4 router TN, HN, HCM, Center WAN. Đồng thời trên 4 router cấu hình bảo mật bằng cách mã hóa các gói tin của RIP khi gửi qua router bằng thuật toán MD5. Mật khẩu sử dụng trong quá trình xác thực router RIP là: Security

• Cấu hình đường mặc định trên Router Center WAN trỏ vào PIX Firewall với IP next hop. Quảng bá đường mặc định cho các Router ở 3 chi nhánh

PIX Firewall:

• Cấu hình mức bảo mật 100

• Tất cả các host khi truy cập ra ngoài Internet đều được NAT (PAT) để ẩn địa chỉ IP Private

• Không sử dụng NAT tới các vùng khác trong mạng

• Các truy cập khác đều cho phép

Vùng DMZ:

• Cấu hình mức bảo mật 50

• Cấu hình NAT tĩnh khi ra ngoài Internet: Web Server khi ra ngoài Internet có địa chỉ: 192.168.1.2

Vùng Server Center:

• Cấu hình mức bảo mật 80

• Không cho phép truy cập ra Internet

Vùng Outside:

• Cho phép người dùng Internet truy cập vào Web Server với địa chỉ đã được NAT

• Các truy cập khác đều bị cấm

Cấu hình chung với PIX:

• Đặt mật khẩu đặc quyền: pixfirewall, Console: 12345678

• Cấu hình đường tĩnh trỏ vào mạng nội bộ là mạng được tổng hợp của 3 chi nhánh

• Cấu hình đường mặc định trỏ đến Internet Router với IP next hop

• Cấu hình Easy VPN server cho phép nhân viên Tập Đoàn ngoài Internet kết nối VPN vào mạng công ty để làm việc từ xa với:

 Nhóm làm việc: AK

 Username: truongneo

 Password: 246810

• Cấu hình SSH cho phép người quản trị truy cập PIX Firewall từ xa: bên ngoài Internet và từ mạng nội bộ

 Cấu hình hệ thống: Router TN:

TN>enable

TN#configure terminal

TN(config)#no ip domain lookup TN(config)#enable secret ciscotn

TN(config)#line con 0 TN(config-line)#logging synchronous TN(config-line)#password tncity TN(config-line)#login TN(config-line)#exit TN(config)#line vty 0 4 TN(config-line)#password ankhanhtn TN(config-line)#login TN(config-line)#exit

TN(config)#username CENTER_WAN password truongneo

TN(config)#interface serial 1/0

TN(config-if)#clock rate 64000 TN(config-if)#no shutdown

TN(config-if)#encapsulation ppp

TN(config-if)#ppp authentication chap TN(config-if)#compress predictor TN(config-if)#interface fastEthernet0/0 TN(config-if)#ip address 10.0.1.1 255.255.255.0 TN(config-if)#no shutdown TN(config-if)#exit TN(config)#router rip TN(config-router)#version 2 TN(config-router)#network 10.0.0.0 TN(config-router)# network 10.0.1.0 TN(config-router)#no auto-summary TN(config-router)#passive-interface fastEthernet 0/0 TN(config-router)#exit

TN(config)#key chain RIP-key TN(config-keychain)#key 1

TN(config-keychain-key)#key-string Security

TN(config-keychain-key)#interface serial 1/0 TN(config-if)#ip rip authentication mode md5

TN(config-if)#ip rip authentication key-chain RIP-key

HN>enable

HN#configure terminal

HN(config)#no ip domain lookup HN(config)#enable secret ciscohn

HN(config)#line console 0 HN(config-line)#logging synchronous HN(config-line)#password hncity HN(config-line)#login HN(config-line)#exit HN(config)#line vty 0 4 HN(config-line)#password ankhanhhn HN(config-line)#login HN(config-line)#exit HN(config)#interface fastEthernet 0/0 HN(config-if)#ip address 10.0.4.1 255.255.255.0 HN(config-if)#no shutdown HN(config-if)#interface serial 1/0 HN(config-if)#clock rate 64000 HN(config-if)#no shutdown HN(config-if)#encapsulation frame-relay

HN(config-if)#interface serial 1/0.102 point-to-point HN(config-subif)#ip address 10.0.2.1 255.255.255.0 HN(config-subif)#frame-relay interface-dlci 102

HN(config-subif)#ip address 10.0.3.2 255.255.255.0 HN(config-subif)#frame-relay interface-dlci 103 HN(config-subif)#exit HN(config-if)#exit HN(config)#router rip HN(config-router)#version 2 HN(config-router)#network 10.0.2.0 HN(config-router)#network 10.0.3.4 HN(config-router)#network 10.0.4.0 HN(config-router)#no auto-summary HN(config-router)#passive-interface fastEthernet 0/0 HN(config-router)#exit

HN(config)#key chain RIP-key HN(config-keychain)#key 1

HN(config-keychain-key)#key-string Security

HN(config-keychain-key)#int serial 1/0.102

HN(config-subif)#ip rip authentication mode md5

HN(config-subif)#ip rip authentication key-chain RIP- key

HN(config-subif)#int serial 1/0.103

HN(config-subif)#ip rip authentication mode md5

HN(config-subif)#ip rip authentication key-chain RIP- key

Router HCM:

HCM#configure terminal

HCM(config)#no ip domain lookup HCM(config)#enable secret ciscohcm

HCM(config)#line con 0 HCM(config-line)#logging synchronous HCM(config-line)#password hcmcity HCM(config-line)#login HCM(config-line)#exit HCM(config)#line vty 0 4 HCM(config)#password ankhanhhcm HCM(config)#login HCM(config)#exit HCM(config)#interface fastEthernet 0/0 HCM(config-if)#ip address 10.0.6.1 255.255.255.0 HCM(config-if)#no shutdown HCM(config-if)#interface serial 1/0 HCM(config-if)#encapsulation frame-relay HCM(config-if)#clock rate 64000 HCM(config-if)#no shutdown

HCM(config-if)#interface serial 1/0.201 point-to-point HCM(config-subif)#ip address 10.0.2.2 255.255.255.0 HCM(config-subif)#frame-relay interface-dlci 201

HCM(config-fr-dlci)#interface serial 1/0.203 point-to- point

HCM(config-subif)#frame-relay interface-dlci 203 HCM(config-subif)#exit HCM(config-if)#exit HCM(config)#router rip HCM(config-router)#version 2 HCM(config-router)#network 10.0.2.0 HCM(config-router)#network 10.0.4.0 HCM(config-router)#network 10.0.6.0 HCM(config-router)#no auto-summary HCM(config-router)#passive-interface fastEthernet 0/0 HCM(config-router)#exit

HCM(config)#key chain RIP-key HCM(config-keychain)#key 1

HCM(config-keychain-key)#key-string Security

HCM(config-keychain-key)#interface serial 1/0.201 HCM(config-subif)#ip rip authentication mode md5

HCM(config-subif)#ip rip authentication key-chain RIP- key

HCM(config-subif)#interface serial 1/0.203

HCM(config-subif)#ip rip authentication mode md5

HCM(config-subif)#ip rip authentication key-chain RIP- key

Router Center WAN:

CENTER_WAN#configure terminal

CENTER_WAN(config)#no ip domain lookup CENTER_WAN(config)#enable secret ciscowan

CENTER_WAN(config)#line con 0 CENTER_WAN(config-line)#logging synchronous CENTER_WAN(config-line)#password city CENTER_WAN(config-line)#login CENTER_WAN(config-line)#exit CENTER_WAN(config)#line vty 0 4 CENTER_WAN(config-line)#password ankhanhwan CENTER_WAN(config-line)#login CENTER_WAN(config-line)#exit

CENTER_WAN(config)#username TN pass truongneo

CENTER_WAN(config)#interface serial 1/0 CENTER_WAN(config-if)#ip address 10.0.0.1 255.255.255.0 CENTER_WAN(config-if)#clock rate 64000 CENTER_WAN(config-if)#no shutdown CENTER_WAN(config-if)#encapsulation ppp CENTER_WAN(config-if)#compress predictor

CENTER_WAN(config-if)#ppp authentication chap CENTER_WAN(config-if)#exit

CENTER_WAN(config)#interface fastEthernet 0/0

CENTER_WAN(config-if)#ip address 172.16.1.1 255.255.255.0

CENTER_WAN(config-if)#no shutdown

CENTER_WAN(config)#interface serial 1/1

CENTER_WAN(config-if)#encapsulation frame-relay CENTER_WAN(config-if)#clock rate 64000

CENTER_WAN(config-if)#no shutdown

CENTER_WAN(config-if)#interface serial 1/1.301 point- to-point CENTER_WAN(config-subif)#ip address 10.0.3.1 255.255.255.0 CENTER_WAN(config-subif)#frame-relay interface-dlci 301 CENTER_WAN(config-fr-dlci)#interface serial 1/1.302 point-to-point CENTER_WAN(config-subif)#ip address 10.0.5.1 255.255.255.0 CENTER_WAN(config-subif)#frame-relay interface-dlci 302 CENTER_WAN(config-subif)#exit CENTER_WAN(config-if)#exit CENTER_WAN(config)#router rip CENTER_WAN(config-router)#version 2 CENTER_WAN(config-router)#network 10.0.0.0 CENTER_WAN(config-router)#network 10.0.3.0 CENTER_WAN(config-router)#network 10.0.5.0 CENTER_WAN(config-router)#network 172.16.1.0 CENTER_WAN(config-router)#no auto-summary

CENTER_WAN(config-router)#passive-interface fastEthernet 0/0

CENTER_WAN(config-router)#exit

CENTER_WAN(config)#key chain RIP-key CENTER_WAN(config-keychain)#key 1

CENTER_WAN(config-keychain-key)#key-string Security CENTER_WAN(config-keychain-key)#interface serial 1/1.301

CENTER_WAN(config-subif)#ip rip authentication mode md5

CENTER_WAN(config-subif)#ip rip authentication keychain RIP-key

CENTER_WAN(config-subif)#interface serial 1/1.302

CENTER_WAN(config-subif)#ip rip authentication mode md5

CENTER_WAN(config-subif)#ip rip authentication keychain RIP-key

CENTER_WAN(config-subif)#interface serial 1/0

CENTER_WAN(config-if)#ip rip authentication mode MD5 CENTER_WAN(config-if)#ip rip authentication key-chain RIP-key

PIX Firewall:

hostname PIX

domain-name ankhanh-group.vn

names name 172.16.6.2 Database name 10.0.4.6 PC_HN name 10.0.1.6 PC_TN ! interface Ethernet0 nameif inside security-level 100 ip address 172.16.1.2 255.255.255.0 ! interface Ethernet1 nameif dmz security-level 50 ip address 172.16.4.1 255.255.255.0 ! interface Ethernet2 nameif Server_Center security-level 80 ip address 172.16.6.1 255.255.255.0 ! interface Ethernet3 nameif outside security-level 0 ip address 192.168.1.1 255.255.255.0

! interface Ethernet4 shutdown no nameif no security-level no ip address !

passwd Vyg.C3I6hdMIQb10 encrypted ftp mode passive

dns server-group DefaultDNS domain-name ankhanh-group.vn

access-list dmz_access_in extended permit icmp any any echo-reply

access-list outside_access_in extended permit tcp any host 192.168.1.2 eq www

access-list outside_access_in extended permit icmp any any echo-reply

access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.248.0 172.16.4.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.248.0 172.16.6.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.248.0 10.0.7.0 255.255.255.224

access-list inside_nat0_outbound extended permit ip host 172.16.4.2 10.0.7.0 255.255.255.224

access-list inside_nat0_outbound extended permit ip host Database 10.0.7.0 255.255.255.224

access-list Server_Center_access_in extended permit icmp any any echo-reply

access-list inside_access_in extended deny ip host PC_HN host Database

access-list inside_access_in extended deny ip host PC_TN host Database

access-list inside_access_in extended permit ip any any

access-list AK_splitTunnelAcl standard permit 10.0.0.0 255.255.248.0

access-list AK_splitTunnelAcl standard permit host 172.16.4.2

access-list AK_splitTunnelAcl standard permit host Database pager lines 24 mtu inside 1500 mtu dmz 1500 mtu Server_Center 1500 mtu outside 1500

ip local pool BOSS 10.0.7.10-10.0.7.20 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1 asdm image flash:/asdm-603.bin

no asdm history enable arp timeout 14400

global (outside) 1 192.168.1.10-192.168.1.11 netmask 255.255.255.0

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound nat (inside) 1 10.0.0.0 255.255.248.0

static (dmz,outside) tcp 192.168.1.2 www 172.16.4.2 www netmask 255.255.255.255

access-group inside_access_in in interface inside access-group dmz_access_in in interface dmz

access-group Server_Center_access_in in interface Server_Center

access-group outside_access_in in interface outside route outside 0.0.0.0 0.0.0.0 192.168.1.100 1

route inside 10.0.0.0 255.255.248.0 172.16.1.1 1 timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy http server enable

http 172.16.4.0 255.255.255.0 dmz no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp- md5-hmac

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp- sha-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp- sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp- md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES- 192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256- MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside crypto isakmp enable outside

crypto isakmp policy 10 authentication pre-share encryption 3des

hash md5 group 2

lifetime 86400

no crypto isakmp nat-traversal telnet timeout 5 ssh 10.0.6.6 255.255.255.255 inside ssh 195.168.1.2 255.255.255.255 outside ssh timeout 15 console timeout 0 threat-detection basic-threat

threat-detection statistics access-list !

group-policy AK attributes wins-server value 172.16.4.2 dns-server value 172.16.4.4 vpn-tunnel-protocol IPSec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value AK_splitTunnelAcl default-domain value ankhanh-group.vn

username admin password eY/fQXw7Ure8Qrz7 encrypted privilege 15

username truongneo password XQMQI36AeOhYMSMm encrypted privilege 0

username truongneo attributes vpn-group-policy AK

tunnel-group AK type remote-access tunnel-group AK general-attributes address-pool BOSS

default-group-policy AK

tunnel-group AK ipsec-attributes pre-shared-key *

prompt hostname context

Cryptochecksum:3d87b71c9ccf13cfa5068914c2b8705b : end

Phương thức hoạt động của Firewall

Mô phỏng mô hình thiết kế