cisco ccna free training

cisco ccna free training..IKE: The Internet Key Exchange Protocol is responsible for generating and managing the encryption algorithms and the keys used by the HMAC function. In practice. ISAKMP and IKE work in concert to secure the tunnel between the two devices: they use UDP as the transport protocol. and connect to port 500..DH: Diffie-Hellman is used to securely exchange encryption keys and HMAC keys that are used to secure the management connection and the data connection..AH: The Authentication Header protocol is used only to verify the origin and validity of data packets received from a peer over a data connection; it uses the HMAC function for such tasks, where the signature is generated from almost the entire IP packet. The two main drawbacks of AH are: it cannot traverse address translation devices; and it does not support encryption..ESP: Encapsulating Security Payload Protocol is used to provide packet confidentiality and authentication. It uses encryption to provide confidentiality and uses HMAC functions to provide packet authentication. Since it supports encryption, it is used to protect data connections. However, its disadvantage is that the signature does not cover the external IP header, so it does not detect when that header is tampered with, whereas AH is able to detect it. Another important advantage of ESP is that it can traverse address translation devices performing NAT without any modification, but to traverse PAT or firewall devices, it must be encapsulated in a UDP packet. This part of the IPsec standard is known as NAT transparency or NAT traversalChapter 24 Introduction to WAN 665(NAT.T).Exam Points Keep in mind the IPSec protocols listed earlier (ISAKMP, IKE, DH, AH, and ESP) and their descriptions.Authentication Objectives 24.0524.5 Generic Routing Encapsulation TunnelsA unicast Generic Routing Encapsulation (GRE) point-to-point tunnel is a logical connection between two routers that is used to carry a variety of IP and non-IP traffic. GRE is commonly used to provide scalability and flexibility in IPSec site-to-site VPN solutions. Originally developed by Cisco and later standardized by RFC 1701 and 1702, GRE provides a logical connection (subnet) between two routers that traverses a private or public network, as shown in Figure 24.8. In this example, the two sites are connected via a GRE tunnel with subnet number 192.168.1.0/24. The next few subsections describe GRE and its configuration.