The following excerpt is from chapter four, Configuring Cisco VPN 3000 for Remote Access Using Preshared Keys, of CCSP Cisco Secure VPN Exam Certification Guide (CCSP Self-Study), written by John Roland and Mark Newcomb, and published by Cisco Press.
Using VPNs for remote access with preshared keys
For site-to-site VPN connections, peer devices must authenticate one another before IPSec
communications can occur. In addition to requiring device authentication, remote access VPN
connections require user authentication to make certain that the user is permitted to use the
applications that are protected by the IPSec connection.
User authentication can be handled in a variety of ways. You can configure Remote Authentication
Dial-In User Service (RADIUS), NT Domain, and Security Dynamics International (SDI)
authentication on most Cisco devices, and the VPN 3000 Concentrators have the additional
ability to authenticate users through an internal database.
If you want to use internal authentication, create a username and password for each user and
assign the users to the group that is to be used for IPSec device authentication. Once the devices
have established the IPSec tunnel, the user is prompted to enter a username and password to
continue. Failure to authenticate causes the tunnel to drop. A similar login prompt is displayed
if you are using RADIUS, NT Domain, or SDI authentication.
You can establish device authentication by using either preshared keys or digital certificates.
(For more information, see Chapter 5, "Configuring Cisco VPN 3000 for Remote Access Using
Digital Certificates.") With preshared keys, the system administrator chooses the key and then
shares that key with users or other system administrators. Combining a preshared key with
some other metric establishes three different uses for preshared keys, as follows:
The following sections describe each type of preshared key in more detail.
Unique preshared keys
When a preshared key is tied to a specific IP address, the combination makes the preshared
key unique. Only the peer with the correct IP address can establish an IPSec session using this key.
Ideal for site-to-site VPNs where the identity of the peer devices is always known, unique
preshared keys are not recommended for remote access VPNs. Unique preshared keys scale
particularly poorly because each new user requires a new key and the administrative burden
that entails.
While this type of preshared key is the most secure of the three types, it is not practical for
remote access applications, where users are typically connecting through a commercial Internet
service provider (ISP). Most users are not willing to pay for the luxury of a permanently
assigned IP address from their ISP and are assigned an IP address from an available pool of
addresses when they connect to the service. If you had a large installed base of VPN users,
keeping up with these dynamically assigned IP addresses to provide this level of security would
be a maintenance nightmare.
Group preshared keys
If you begin using unique preshared keys, at some point you can decide to just use the same
password for discrete groups of users. If you decide to do that, and shed the association with
the IP address, you have begun to use the next type of preshared key, the group preshared key.
A group preshared key is simply a shared key that is associated with a specific group. In a VPN
3000 Concentrator configuration, the group can be the Base Group or any other group that you
define.
A group preshared key is well suited for remote access VPNs and is the method used by Cisco
VPN 3000 Concentrators. It is good practice to use groups to establish Internet Key Exchange
(IKE) and IPSec settings and to provide other capabilities that are unique to a specific set of
users. If you choose to use the Cisco VPN 3000 Concentrator's internal database for user
authentication, you can assign your users to specific groups, making the process of managing
preshared keys much easier.
Wildcard preshared keys
The final type of preshared key classification is the wildcard preshared key. This type of key
does not have an IP address or group assigned to it and can be used by any device holding
the key to establish an IPSec connection with your VPN concentrator. When you set up your
concentrator to use wildcard preshared keys, every device connecting to the concentrator must
also use preshared keys. If any device is compromised, you must change the key for all the
devices in your network. This type of key is also open to man-in-the-middle attacks and should
not be used for site-to-site applications.
Read the rest of this chapter.
