Virtual Private Networks in Software

Printer Denso QR Bar Code in Software Virtual Private Networks

We noted earlier that the PIX supports Virtual Private Network (VPN) connections between PIX units A VPN is an encrypted connection between two devices that allows secure communication across an unsecure network, such as the Internet The VPN feature of the PIX is called a private link and requires an additional private link card to be installed in the PIX The use of a private link requires two commands The first command, link, specifies the IP address of the PIX box you are creating a VPN connection to and the encryption key used: link [(if_name)] foreign_external_ip key_id key|md5 Here's an example: link (inside) 171101100 1 abbdccddeeffaf The if_name parameter indicates the interface where the private link connection originates If an interface other than the inside is used, packets are processed using normal nat and global commands before being transmitted across the private link The key_id specifies a unique key number, and a maximum of seven keys can be defined for each remote VPN peer The key is a value of up to 14 hexadecimal digits and is used to establish a VPN connection The key value must match on both sides of the VPN link The md5 parameter puts an md5 digital signature on each packet before it is sent across the VPN link The second command, linkpath, specifies the networks that are reachable through a particular PIX specified by the link command linkpath foreign_internal_ip netmask foreign_external_ip Here's an example: linkpath 1501000 25525500 171101100 The foreign_internal_ip and netmask specify the network that can be reached by the VPN connection to the PIX defined by the foreign_external_ip parameter The foreign_external_ip parameter must be the same as that specified on a previously defined link command, while the linkpath command is essentially a route statement

The PIX supports a redundant design using two PIX boxes through the use of a special cable connected to each PIX box This cable is called a failover cable and is specially designed by Cisco The cable has a limited distance, so the PIX boxes must be in close physical proximity, and the distance between them cannot be extended The specifications for this cable can be found on the Cisco Web site

the standby unit are not active until a failure of the active unit is detected The standby PIX must have a physical interface on the same networks as the active PIX A failover IP address must also be assigned to each interface on the standby PIX that will be used failover ip address if_name ip_address Here's an example: failover ip address inside 101110 failover ip address outside 17111010 For obvious reasons, the configuration on the standby PIX must be identical to the configuration on the active PIX During normal operation, the active PIX will automatically update the configuration of the standby PIX as new commands are entered on the active PIX Also, if the active PIX is rebooted, it will replicate its entire configuration to the standby PIX You can force the active PIX to replicate its configuration to the standby PIX by using the command write standby All configuration changes should be made on the active PIX because any changes made on the standby PIX will not be propagated to the active unit You can observe the state of the failover connection with the command show failover The command determines whether failover is enabled and which device is the active unit No sharing of information about existing connections is shared between the active and the standby PIX units When the active PIX fails, it takes approximately 30 to 45 seconds for the standby PIX to take over When the standby PIX becomes active, it has no information about the state of existing connections and therefore all active sessions would most likely be dropped You can use the failover timeout command to specify a time interval during which the standby PIX allows all traffic in and out so it can build a connection table: failover timeout hh:mm:ss During this period of time, adaptive security is totally disabled Once the period of time expires, normal adaptive security resumes By default, this command is disabled If used, Cisco recommends it be set to two minutes or less: failover timeout 0:02:00