Chapitre 8:

La mise en œuvre des réseaux

privés virtuels

v2.0 CCNA sécurité

Translated by JE.BENRAHAL
June 2017
 8.0 Présentation
8.1 réseaux privés virtuels
8.2 VPN IPsec Composants et
opérations
8.3 Mise en œuvre du site à site
VPN IPSec avec CLI
8.4 Résumé

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 2
 À la fin de cette section, vous devriez pouvoir:
• Décrire réseaux privés virtuels et leurs avantages.

• Comparez le site à site et réseaux privés virtuels d'accès à distance.

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 3
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 4
 VPN Avantages:
• Économies de
coûts
• Sécurité

• évolutivité

• Compatibilité

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 5
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 6
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 7
 Distance-accès VPN

Site à site VPN

d'accès

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 8
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 9
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 10
 À la fin de cette section, vous devriez pouvoir:
• Décrire le protocole IPsec et ses fonctions de base.

• Comparer les protocoles AH et ESP.

• Décrire le protocole IKE.

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 11
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 12
 IPsec Exemples de mise en
cadre IPsec œuvre

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 13
Confidentialité avec chiffrement:

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 14
Les algorithmes de chiffrement:

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 15
Les algorithmes de hachage

Sécurité des algorithmes de

hachage

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 16
 Peer Méthodes
d'authentification

PSK

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 17
RSA

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 18
Diffie-Hellman Key Exchange

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 19
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 20
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 21
Protocoles AH

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 22
 Routeur crée Hash et Transmet to
Peer

Routeur Peer Compares Hash

recalculée à Hash reçu

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 23
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 24
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 25
 Appliquer ESP et AH en deux
modes

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 26
 ESP Tunnel Mode

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 27
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 28
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 29
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 30
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 31
 À la fin de cette section, vous devriez pouvoir:
• Décrire la négociation IPsec et les cinq étapes de configuration IPsec.

• Configurez la stratégie ISAKMP.

• Configurer la stratégie IPSec.

• configurer et appliquer une carte Crypto.

• Vérifiez la IPsec VPN.

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 32
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 33
 VPN IPsec négociation:
Étape 1 - hôte A envoie le
trafic intéressant à l'hôte B.

VPN IPsec négociation:

Etape 2 - R1 et R2 négocier
une session IKE Phase 1.

VPN IPsec négociation:

Etape 3 - R1 et R2
négocier une session
IKE de phase 2.

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 34
 VPN IPsec négociation:
Étape 4 - Les informations
sont échangées via le tunnel
IPsec.

VPN IPsec négociation:

Etape 5 - Le tunnel
IPsec est terminé.

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 35
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 36
 ACL Syntaxe pour
le trafic IPsec

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 38
 Le trafic des négociations permettant IPsec

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 39
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 40
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 41
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 42
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 43
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 44
le Crypto isakmp clé Commander

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 45
Pre-Shared Key Configuration

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 46
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 47
La phase 1 IKE tunnel n'existe pas encore

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 48
Configurer une ACL pour définir le trafic Intéressant

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 49
le Crypto ipsec transformation-set Commander

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 50
le Crypto ipsec transformation-set Commander

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 51
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 52
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 53
Carte Crypto Commandes de configuration

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 54
 Configuration de la carte Crypto:

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 55
 Configuration de la carte Crypto:

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 56
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 57
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 58
 Utilisez Ping prolongé pour envoyer le trafic Intéressant

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 59
 Vérifiez que le tunnel est établi ISAKMP

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 60
 Vérifiez que le tunnel IPsec est établi

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 61
 Objectifs du chapitre:
• Expliquer le but de réseaux privés virtuels.

• Expliquer comment IPsec Réseaux privés virtuels fonctionnent.

• configurer un IPsec de site à site VPN, l'authentification clé pré-partagée,

à l'aide de la CLI.

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 62
Thank you.
• Rappelles toi, Il y a des
tutoriels utiles et guides
d'utilisation disponibles via
votre Netspace maison 1
page. (https: 2
//www.netacad.com)
• Ces ressources couvrent
une variété de sujets, y
compris la navigation, des
évaluations et des missions.
• Une capture d'écran a été
fourni ici mettant en lumière
les didacticiels liés à
l'activation des examens, la
gestion des évaluations, et
la création de
questionnaires.

© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 64