Mc lc

MNG RING O

LI NI U

LI NI U

Vi chin lc pht trin ton din mang tnh cht n u v cng ngh nhm to ra tim lc to ln, sc cnh tranh v cht lng v s a dng ha cc dch v gi thnh thp, nng sut lao ng cao, Tp on Bu chnh Vin thng Vit nam c chin lc v k hoch chuyn i mng Vin thng s sang mng th h sau (NGN). Mng NGN c h tng thng tin duy nht da trn cng ngh chuyn mch gi, trin khai dch v mt cch a dng v nhanh chng, p ng s hi t gia thoi v s liu, gia c nh v di ng, bt ngun t s tin b ca cng ngh thng tin v cc u im ca cng ngh chuyn mch gi ni chung v cng ngh IP ni ring v cng ngh truyn dn quang bng rng. Cu trc ca mng th h sau v cc nguyn tc hot ng ca n v c bn khc nhiu so vi cu trc ca mng PSTN hin nay. Do vy i ng k s v cn b k thut Vin thng cn phi c bi dng cp nht kin thc v cng ngh mi ny, c nh vy h mi kh nng v trnh vn hnh khai thc qun l v trin khai cc dch v Vin thng mt cch an ton v hiu qu.

Chng trnh Bi dng k s in t vin thng v cng ngh IP v NGN ca Tp on c xy dng vi mc ch cung cp kin thc v k nng c bn lin quan ti cng ngh IP v NGN cho cc cn b k thut ang trc tip qun l v khai thc h thng trang thit b ti c s nhm p ng yu cu v chuyn i cng ngh mng li v dch v vin thng ca Tp on.

Cun ti liu Mng ring o bao gm 5 chng, gii thiu nhng vn k thut c bn lin quan n vic xy dng VPN, cc gii php VPN da trn nn IPSec v MPLS cng nh l tnh hnh trin khai VPN trn thc tin hin nay.

Chng 1 gii thiu nhng khi nim c bn v VPN, cc chc nng v c im ca VPN, t lm c s phn loi VPN v a ra cc thun li cng nh kh khn khi s dng cc loi hnh VPN .

Chng 2 trnh by v cc giao thc ng hm s dng cho VPN, phn tch hot ng, cc c im v kh nng ng dng ca chng trong cc m hnh VPN khc nhau.

Chng 3 trnh by v giao thc bo mt IPSec v mt s vn k thut lin quan n vic thc hin VPN trn nn IPSec nh cc tiu chun mt m, cc cng c kim tra tnh ton vn thng tin, cc thut ton xc thc cng nh l k thut qun l v trao i kha.

Chng 4 trnh by v cc m hnh VPN trn nn MPLS, cc thnh phn v hot ng ca MPLS-VPN, cc vn v iu khin kt ni, bo mt v QoS trong MPLS-VPN. Trong chng ny cng a ra mt s so snh c im v kh nng ng dng ca hai gii php VPN da trn nn IPSec v MPLS.

Chng 5 trnh by v cc m hnh v gii php trin khai VPN, trong tp trung vo nhng gii php gn y nht c thc hin trn nn MPLS. Mt s thng tin v tnh hnh trin khai cc loi hnh dch v VPN hin nay ca VNPT cng c gii thiu trong chng ny.

Trong qu trnh bin son, mc d gio vin rt c gng, tuy nhin khng th trnh khi nhng thiu st. Rt mong nhn c kin ng gp ca cc bn c nhng ln xut bn sau cht lng ca ti liu c tt hn.

TRUNG TM O TO BU CHNH VIN THNG 1MC LC

iLI NI U

MC LCiiivDANH SCH HNH

1CHNG 1 - GII THIU CHUNG V VPN

21.1Khi nim VPN

31.2Cc chc nng v u nhc im ca VPN

31.2.1Chc nng

41.2.2u im

51.2.3Nhc im v mt s vn cn khc phc

61.3Cc m hnh VPN

61.3.1M hnh chng ln

81.3.2M hnh ngang hng

91.4Phn loi VPN v ng dng

101.4.1VPN truy nhp t xa

111.4.2VPN im ti im

131.4.3ng dng VPN

141.5Kt chng

CHNG 2 - 15CC GIAO THC NG HM

162.1Gii thiu cc giao thc ng hm

162.2Giao thc chuyn tip lp 2 L2F

172.2.1Cu trc gi L2F

172.2.2Hot ng ca L2F

192.2.3u nhc im ca L2F

202.3Giao thc ng hm im ti im PPTP

202.3.1Khi qut v hot ng ca PPTP

212.3.2Duy tr ng hm bng kt ni iu khin PPTP

222.3.3ng gi d liu ng hm PPTP

242.3.4X l d liu ti u cui ng hm PPTP

242.3.5Trin khai VPN da trn PPTP

252.3.6u nhc im v kh nng ng dng ca PPTP

262.4Giao thc ng hm lp 2 L2TP

262.4.1Khi qut v hot ng ca L2TP

272.4.2Duy tr ng hm bng bn tin iu khin L2TP

272.4.3ng gi d liu ng hm L2TP

302.4.4X l d liu ti u cui ng hm L2TP trn nn IPSec

302.4.5Trin khai VPN da trn L2TP

312.4.6u nhc im v kh nng ng dng ca L2TP

322.5Kt chng

CHNG 3 - 33MNG RING O TRN NN IPSec

343.1Gii thiu v IPSec

353.2ng gi thng tin IPSec

353.2.1Cc ch hot ng

373.2.2Giao thc tiu xc thc AH

413.2.3Giao thc ng gi ti tin an ton ESP

453.3Lin kt an ninh v hot ng trao i kha

453.3.1Lin kt an ninh

483.3.2Hot ng trao i kha IKE

543.4Mt s vn k thut trong thc hin VPN trn nn IPSec

553.4.1Mt m

563.4.2Ton vn bn tin

573.4.3Xc thc cc bn

583.4.4Qun l kha

583.5V d thc hin VPN trn nn IPSec

593.6Cc vn cn tn ti trong IPSec

603.7Kt chng

CHNG 4 - 61MNG RING O TRN NN MPLS

624.1Cc thnh phn ca MPLS-VPN

624.1.1H thng cung cp dch v MPLS-VPN

634.1.2B nh tuyn bin nh cung cp dch v

634.1.3Bng nh tuyn v chuyn tip o

644.2Cc m hnh MPLS-VPN

644.2.1M hnh L3VPN

664.2.2M hnh L2VPN

674.3Hot ng ca MPLS-VPN

674.3.1Truyn thng tin nh tuyn

684.3.2a ch VPN-IP

714.3.3Chuyn tip gi tin VPN

744.4Bo mt trong MPLS-VPN

754.5Cht lng dch v trong MPLS-VPN

764.5.1M hnh ng

774.5.2M hnh vi

794.6So snh cc c im ca VPN trn nn IPSec v MPLS

794.6.1Cc tiu ch nh gi

804.6.2Cc c im ni bt ca IPSec-VPN v MPLS-VPN

834.7Kt chng

CHNG 5 - 84TRIN KHAI V NG DNG VPN

855.1Cc m hnh trin khai VPN

865.2Gii php VPN trn nn MPLS ca VNPT

875.3M hnh cung cp dch v MegaWAN

885.4Kt chng

89THUT NG VIT TT

93TI LIU THAM KHO

DANH SCH HNH

3Hnh 1.1 M hnh VPN an ton

10Hnh 1.2 M hnh VPN truy nhp t xa

12Hnh 1.3 M hnh VPN cc b

13Hnh 1.4 M hnh VPN m rng

TOC \h \z \c "Hnh 2." 17Hnh 2.1 Khun dng gi ca L2F

18Hnh 2.2 M hnh h thng s dng L2F

22Hnh 2.3 Gi d liu kt ni iu khin PPTP

22Hnh 2.4 ng gi d liu ng hm PPTP

23Hnh 2.5 S ng gi PPTP

24Hnh 2.6 Cc thnh phn ca h thng cung cp VPN da trn PPTP

27Hnh 2.7 Bn tin iu khin L2TP

28Hnh 2.8 ng gi d liu ng hm L2TP

29Hnh 2.9 S ng gi L2TP

30Hnh 2.10 Cc thnh phn ca h thng cung cp VPN da trn L2TP

TOC \h \z \c "Hnh 3." 36Hnh 3.1 X l gi tin IP ch truyn ti

36Hnh 3.2 X l gi tin IP ch ng hm

37Hnh 3.3 Thit b mng thc hin IPSec trong ch ng hm

38Hnh 3.4 Cu trc tiu AH cho gi tin IPSec

40Hnh 3.5 Khun dng gi tin IPv4 trc v sau khi x l AH

40Hnh 3.6 Khun dng gi tin IPv6 trc v sau khi x l AH

41Hnh 3.7 C ch ng gi ESP

42Hnh 3.8 Khun dng gi ESP

43Hnh 3.9 Khun dng gi tin IPv4 trc v sau khi x l ESP

44Hnh 3.10 Khun dng gi tin IPv6 trc v sau khi x l ESP

47Hnh 3.11 Kt hp cc SA kiu ng hm khi hai im cui trng nhau

47Hnh 3.12 Kt hp cc SA kiu ng hm khi mt im cui trng nhau

48Hnh 3.13 Kt hp cc SA kiu ng hm khi khng c im cui trng nhau

49Hnh 3.14 Cc pha v ch trao i kha IKE

50Hnh 3.15 Hot ng iu khin truy nhp mt m theo ACL

51Hnh 3.16 IKE pha mt s dng ch chnh

53Hnh 3.17 Trao i cc tp chuyn i IPSec

54Hnh 3.18 ng hm IPSec c thit lp

59Hnh 3.19 V d thc hin kt ni VPN trn nn IPSec

TOC \h \z \c "Hnh 4." 62Hnh 4.1 H thng cung cp dch v MPLS-VPN v cc thnh phn

63Hnh 4.2 B nh tuyn PE v s kt ni cc site khch hng

65Hnh 4.3 M hnh MPLS L3VPN

66Hnh 4.4 M hnh MPLS L2VPN

68Hnh 4.5 a ch VPN-IPv4

69Hnh 4.6 Khun dng trng phn bit tuyn

71Hnh 4.7 S dng nhn chuyn tip gi tin VPN

72Hnh 4.8 S dng ngn xp nhn chuyn tip gi tin VPN

73Hnh 4.9 Hot ng chuyn tip d liu VPN qua mng MPLS

77Hnh 4.10 M hnh ng cht lng dch v trong MPLS-VPN

78Hnh 4.11 M hnh vi cht lng dch v trong MPLS-VPN

86Hnh 5.1 M hnh cung cp dch v VPN qua mng MPLS ca VNPT

87Hnh 5.2 Gii php kt ni MPLS-VPN ca VNPT

87Hnh 5.3 M hnh mng cung cp dch v MegaWAN

CHNG 1

GII THIU CHUNG V VPNVPN c th c hiu nh l mng kt ni cc site khch hng m bo an ninh trn c s h tng mng chung cng vi cc chnh sch iu khin truy nhp v bo mt nh mt mng ring. Tuy c xy dng trn c s h tng sn c ca mng cng cng nhng VPN li c c cc tnh cht ca mt mng cc b nh khi s dng cc ng knh thu ring. Chng ny trnh by nhng khi nim c bn v VPN, cc chc nng v c im ca VPN, t lm c s phn loi VPN v a ra cc thun li cng nh kh khn khi s dng cc loi hnh VPN khc nhau. Ni dung chng ny bao gm:

Khi nim VPN Cc chc nng v u nhc im ca VPN Cc m hnh VPN Phn loi VPN theo ng dng1.1 Khi nim VPNMng ring o khng phi l khi nim mi. Chng tng c s dng trong cc mng in thoi trc y nhng do mt s hn ch v cng ngh m cha c c sc mnh v kh nng cnh tranh ln. Trong thi gian gn y, c s h tng mng IP lm cho VPN thc s c tnh mi m. Cc kiu mng ring o xy dng trn c s h tng mng Internet cng cng mang li mt kh nng mi, mt ci nhn mi cho ngi s dng. Cng ngh VPN l gii php thng tin ti u i vi cc cng ty, t chc c nhiu vn phng hay chi nhnh. Ngy nay, vi s pht trin ca cng ngh v bng n ca mng Internet, kh nng ca VPN ngy mt hon thin v dch v ny tr thnh mt dch v cnh tranh y trin vng.

Mng ring o c nh ngha nh l mt kt ni mng trin khai trn c s h tng mng cng cng vi cc chnh sch qun l v bo mt ging nh mng cc b. Mng ring o m rng phm vi ca cc mng LAN m khng b hn ch v mt a l. Cc hng thng mi c th dng VPN cung cp quyn truy nhp mng cho ngi dng di ng v t xa, kt ni cc chi nhnh phn tn thnh mt mng duy nht v cho php s dng t xa cc trnh ng dng da trn cc dch v trong cng ty. Trong thc t, ngi ta thng ni ti hai khi nim VPN l VPN kiu tin cy (Trusted VPN) v VPN an ton (Secure VPN).

Mng ring o kiu tin cy c xem nh mt s mch thu ca mt nh cung cp dch v vin thng. Mi mch thu ring hot ng nh mt ng dy trong mt mng cc b. Tnh ring t ca Trusted VPN th hin ch nh cung cp dch v s m bo khng c ai s dng cng mch thu ring . Khch hng ca mng ring o loi ny tin cy vo nh cung cp dch v duy tr tnh ton vn v bo mt ca d liu truyn trn mng. Cc mng ring xy dng trn cc ng dy thu thuc dng Trusted VPN.

Mng ring o an ton l cc mng ring o c s dng mt m bo mt d liu. D liu u ra ca mt mng c mt m ri chuyn vo mng cng cng nh cc d liu khc truyn ti ch v sau c gii m ti pha thu. D liu mt m c th coi nh c truyn trong mt ng hm (tunnel) bo mt t ngun ti ch. Cho d mt k tn cng c th nhn thy d liu trn ng truyn th cng khng c kh nng c c v n c mt m.

V d v giao thc s dng trong vic m ho m bo an ton l IPSec. l mt tiu chun cho m ho cng nh xc thc cc gi IP ti tng mng. IPSec h tr mt tp hp cc giao thc mt m vi hai mc ch: an ninh gi mng v thay i cc kho mt m. IPSec c h tr trong Windows XP, 2000, 2003 v Vista; Linux phin bn 2.6 tr i v nhiu h iu hnh khc na. Nhiu hng nhanh chng pht trin v cung cp cc dch v IPSec-VPN server v IPSec-VPN client.

Mng ring o xy dng da trn Internet l v d v mng ring o kiu an ton, s dng c s h tng m v phn tn ca Internet cho vic truyn d liu gia cc site ca mng (hnh 1.1).

Hnh 1.1 M hnh VPN an ton

Kt ni trong VPN l kt ni ng, ngha l khng c gn cng v tn ti nh mt kt ni thc khi lu lng mng chuyn qua. Kt ni ny c th thay i v thch ng vi nhiu mi trng khc nhau. Khi c yu cu kt ni th n c thit lp v duy tr bt chp c s h tng mng gia nhng im u cui.

Tnh ring ca VPN th hin ch d liu truyn lun c gi b mt v ch c th b truy nhp bi nhng ngui s dng c trao quyn. iu ny rt quan trng bi v giao thc Internet ban u khng c thit k h tr cc mc bo mt. Do , bo mt s c cung cp bng cch thm phn mm hay phn cng VPN.

1.2 Cc chc nng v u nhc im ca VPN1.2.1 Chc nngVPN cung cp ba chc nng chnh l tnh xc thc (Authentication), tnh ton vn (Integrity) v tnh bo mt (Confidentiality).

Tnh xc thc

thit lp mt kt ni VPN th trc ht c hai pha phi xc thc ln nhau khng nh rng mnh ang trao i thng tin vi ngi mnh mong mun ch khng phi l mt ngi khc.

Tnh ton vn

m bo d liu khng b thay i hay c bt k s xo trn no trong qu trnh truyn dn.

Tnh bo mt

Ngi gi c th m ho cc gi d liu trc khi truyn qua mng cng cng v d liu s c gii m pha thu. Bng cch lm nh vy, khng mt ai c th truy nhp thng tin m khng c php. Thm ch nu c ly c th cng khng c c.

1.2.2 u imMng ring o mang li li ch thc s v tc thi cho cc cng ty. N khng ch gip n gin ho vic trao i thng tin gia cc nhn vin lm vic xa, ngi dng lu ng, m rng Intranet n tng vn phng, chi nhnh, thm ch trin khai Extranet n tn khch hng v cc i tc ch cht m cn cho php gim chi ph rt nhiu so vi vic mua thit b v ng dy cho mng WAN ring. Nhng li ch trc tip v gin tip m VPN mang li bao gm: tit kim chi ph, tnh linh hot, kh nng m rng, v.v.

Tit kim chi ph

Vic s dng VPN s gip cc cng ty gim c chi ph u t v chi ph thng xuyn. Tng gi thnh ca vic s hu mt mng VPN s c thu nh, do ch phi tr t hn cho vic thu bng thng ng truyn, cc thit b mng ng trc v duy tr hot ng ca h thng. Nhiu s liu cho thy, gi thnh cho vic kt ni LAN-to-LAN gim t 20 ti 30% so vi vic s dng ng thu ring truyn thng, cn i vi vic truy nhp t xa gim t 60 ti 80%.

Tnh linh hot

Tnh linh hot y khng ch th hin trong qu trnh vn hnh v khai thc m n cn thc s mm do i vi yu cu s dng. Khch hng c th s dng nhiu kiu kt ni khc nhau kt ni cc vn phng nh hay cc i tng di ng. Nh cung cp dch v VPN c th cho php nhiu s la chn kt ni cho khch hng: modem 56 kbit/s, ISDN 128 kbit/s, xDSL, E1,

Kh nng m rng

Do VPN c xy dng da trn c s h tng mng cng cng nn bt c ni no c mng cng cng (nh Internet) u c th trin khai VPN. Ngy nay mng Internet c mt khp mi ni nn kh nng m rng ca VPN rt d dng. Mt vn phng xa c th kt ni mt cch kh n gin n mng ca cng ty bng cch s dng ng dy in thoi hay ng dy thu bao s DSL.Kh nng m rng cn th hin ch, khi mt vn phng hay chi nhnh yu cu bng thng ln hn th n c th c nng cp d dng. Ngoi ra, cng c th d dng g b VPN khi khng c nhu cu.

Gim thiu cc h tr k thut

Vic chun ho trn mt kiu kt ni t i tng di ng n mt POP ca ISP v vic chun ho cc yu cu v bo mt lm gim thiu nhu cu v ngun h tr k thut cho mng VPN. V ngy nay, khi m cc nh cung cp dch v m nhim vic h tr mng nhiu hn th nhng yu cu h tr k thut i vi ngi s dng ngy cng gim.

Gim thiu cc yu cu v thit b

Bng vic cung cp mt gii php truy nhp cho cc doanh nghip qua ng Internet, VPN yu cu v thit b t hn v n gin hn nhiu so vi vic bo tr cc modem ring bit, cc card tng thch cho thit b u cui v cc my ch truy nhp t xa. Mt doanh nghip c th thit lp cc thit b khch hng cho mt mi trng, chng hn nh T1 hay E1, phn cn li ca kt ni c thc hin bi ISP.

p ng cc nhu cu thng mi

i vi cc thit b v cng ngh vin thng mi th nhng vn cn quan tm l chun ho, cc kh nng qun tr, m rng v tch hp mng, tnh k tha, tin cy v hiu sut hot ng, c bit l kh nng thng mi ca sn phm.

Cc sn phm dch v VPN tun theo chun chung hin nay, mt phn m bo kh nng lm vic ca sn phm nhng c l quan trng hn l sn phm ca nhiu nh cung cp khc nhau c th lm vic vi nhau.

1.2.3 Nhc im v mt s vn cn khc phc

S ri ro an ninh

Mt mng ring o thng r v hiu qu hn so vi gii php s dng knh thu ring. Tuy nhin, n cng tim n nhiu ri ro an ninh kh lng trc. Mc d hu ht cc nh cung cp dch v qung co rng gii php ca h l m bo an ton, s an ton khng bao gi l tuyt i. Cng c th lm cho mng ring o kh ph hoi hn bng cch bo v tham s ca mng mt cch thch hp, song iu ny li nh hng n gi thnh ca dch v.

tin cy v s thc thi VPN s dng phng php m ho bo mt d liu, v cc hm mt m phc tp c th dn n lu lng ti trn cc my ch l kh nng. Nhim v ca ngi qun tr mng l qun l ti trn my ch bng cch gii hn s kt ni ng thi bit my ch no c th iu khin. Tuy nhin, khi s ngi c gng kt ni ti VPN t nhin tng vt v ph v ht qu trnh truyn tin, th chnh cc nhn vin qun tr ny cng khng th kt ni c v tt c cc cng ca VPN u bn. iu chnh l ng c thc y ngi qun tr to ra cc kho ng dng lm vic m khng i hi VPN. Chng hn thit lp dch v proxy hoc dch v Internet Message Access Protocol cho php nhn vin truy nhp e-mail t nh hay trn ng.

Vn la chn giao thcVic la chn gia IPSec hay SSL/TLS l mt vn kh quyt nh, cng nh vin cnh s dng chng nh th no cng kh c th ni trc. Mt iu cn cn nhc l SSL/TLS c th lm vic thng qua mt tng la da trn bng bin dch a ch NAT, cn IPSec th khng. Nhng nu c hai giao thc lm vic qua tng la th s khng dch c a ch.

IPSec m ho tt c cc lu lng IP truyn ti gia hai my tnh, cn SSL/TLS th c t mt ng dng. SSL/TLS dng cc hm m ho khng i xng thit lp kt ni v n bo v hiu qu hn so vi dng cc hm m ho i xng.

Trong cc ng dng trn thc t, ngi qun tr c th quyt nh kt hp v ghp cc giao thc to ra s cn bng tt nht cho s thc thi v an ton ca mng. V d, cc client c th kt ni ti mt Web server thng qua tng la dng ng dn an ton ca SSL/TLS, Web server c th kt ni ti mt dch v ng dng dng IPSec, v dch v ng dng c th kt ni ti mt c s d liu thng qua cc tng la khc cng dng SSL.

1.3 Cc m hnh VPN

C hai m hnh trin khai VPN l: da trn khch hng (Customer-based) v da trn mng (Network-based). M hnh da trn khch hng cn c gi l m hnh chng ln (overlay), trong VPN c cu hnh trn cc thit b ca khch hng v s dng cc giao thc ng hm xuyn qua mng cng cng. Nh cung cp dch v s bn cc mch o gia cc site ca khch hng nh l ng kt ni thu ring (leased line). M hnh da trn mng cn c gi l m hnh ngang hng hay ngang cp (peer-to-peer), trong VPN c cu hnh trn cc thit b ca nh cung cp dch v v c qun l bi nh cung cp dch v. Nh cung cp dch v v khch hng trao i thng tin nh tuyn lp 3, sau nh cung cp s sp t d liu t cc site khch hng vo ng i ti u nht m khng cn c s tham gia ca khch hng.1.3.1 M hnh chng lnM hnh VPN chng ln ra i t rt sm v c trin khai di nhiu cng ngh khc nhau. Ban u, VPN c xy dng bng cch s dng cc ng thu ring cung cp kt ni gia khch hng nhiu v tr khc nhau. Khch hng mua dch v ng thu ring ca nh cung cp. Cc ng thu ny c thit lp gia cc site ca khch hng cn kt ni v l ng dnh ring cho khch hng.

Khi Frame Relay ra i, n c xem nh l mt cng ngh h tr tt cho VPN v p ng c yu cu kt ni cho khch hng nh dch v ng thu ring. im khc l ch khch hng khng c cung cp cc ng dnh ring, m s s dng mt ng chung nhng c ch nh cc mch o. Cc mch o ny m bo lu lng cho mi khch hng l ring bit. Mch o c th gm mch o c nh PVC v mch o chuyn mch SVC. Cung cp mch o cho khch hng ngha l nh cung cp dch v xy dng mt ng hm ring cho lu lng khch hng truyn qua mng dng chung ca nh cung cp dch v. Khch hng thit lp phin lin lc gia cc thit b pha khch hng CPE qua knh o. Giao thc nh tuyn chy trc tip gia cc b nh tuyn khch hng thit lp mi quan h cn k v trao i thng tin nh tuyn vi nhau. Nh cung cp dch v khng h bit n thng tin nh tuyn ca khch hng. Nhim v ca nh cung cp dch v trong m hnh ny ch l m bo vn chuyn d liu im-im gia cc site ca khch hng m thi.

VPN chng ln cn c trin khai di dng ng hm. S thnh cng ca cng ngh IP thc y cc nh cung cp dch v trin khai VPN qua IP. Nu khch hng no mun xy dng mng ring ca h qua Internet th c th dng gii php ny v chi ph thp. Bn cnh l do kinh t, m hnh ng hm cn p ng cho khch hng vic bo mt d liu. Hai cng ngh VPN ng hm ph bin l IPSec (IP Security) v GRE (Generic Routing Encapsulation).

Cc cam kt v QoS trong m hnh VPN chng ln thng l cam kt v bng thng trn mt VC. Gi tr ny c gi l CIR (Committed Information Rate). Bng thng c th s dng c ti a trn mt knh o gi l PIR (Peak Information Rate). Vic cam kt bng thng c thc hin thng qua cc thng k t nhin ca dch v lp 2 nhng li ph thuc vo chin lc ca nh cung cp. iu ny c ngha l tc cam kt khng tht s c bo m. Thng th nh cung cp c th m bo tc nh nht MIR (Minimum Information Rate). Cam kt v bng thng cng ch l cam kt cho hai im trong mng khch hng. Nu khng c ma trn lu lng y cho tt c cc lp lu lng th tht kh c th thc hin cam kt ny cho khch hng trong m hnh chng ln. V tht kh cung cp nhiu lp dch v v nh cung cp dch v khng th phn bit c lu lng gia mng. Vn ny c th c khc phc bng cch to ra nhiu kt ni (full-mesh), nh trong mng Frame Relay hay ATM c cc PVC gia cc site khch hng. Tuy nhin, kt ni y thng lm tng thm chi ph ca mng.

M hnh VPN chng ln c u im l d thc hin, theo quan im ca c khch hng v nh cung cp dch v. Trong m hnh ny nh cung cp dch v khng tham gia vo nh tuyn lu lng khch hng. Nhim v ca h l vn chuyn d liu im-im gia cc site ca khch hng. Vic nh du im tham chiu gia nh cung cp dch v v khch hng s cho php qun l d dng hn.

M hnh chng ln thch hp cho cc mng khng cn d phng vi t site trung tm v nhiu site u xa, nhng li kh qun l nu nh cn nhiu kt ni mt li. Vic cung cp nhiu VC i hi phi c s hiu bit cn k v loi lu lng gia cc site, m iu ny thng khng tht s thch hp. Ngoi ra, khi thc hin m hnh ny vi cc cng ngh lp 2 th s to ra mt lp mi khng cn thit i vi cc nh cung cp hu ht ch da trn IP, v nh vy lm tng thm chi ph hot ng ca mng.

1.3.2 M hnh ngang hng

khc phc cc hn ch ca m hnh VPN chng ln v ti u ha vic vn chuyn d liu qua mng ng trc, m hnh VPN ngang hng ra i. Vi m hnh ny nh cung cp dch v s tham gia vo hot ng nh tuyn ca khch hng. B nh tuyn bin mng nh cung cp PE (Provider Edge) thc hin trao i thng tin nh tuyn trc tip vi b nh tuyn ca khch hng CE (Customer Edge). i vi m hnh VPN ngang hng, vic nh tuyn tr nn n gin hn (nhn t pha khch hng) khi b nh tuyn khch hng ch trao i thng tin nh tuyn vi mt hoc mt vi b nh tuyn bin nh cung cp PE. Trong khi m hnh VPN chng ln, s lng b nh tuyn ln cn c th gia tng vi s lng ln. Ngoi ra, do nh cung cp dch v bit cu hnh mng ca khch hng nn c th thit lp nh tuyn ti u cho lu lng gia cc site khch hng. Vic cung cp bng thng cng n gin hn bi v khch hng ch phi quan tm n bng thng u vo v ra mi site m khng cn phi quan tm n ton b lu lng t site ny n site kia nh trong m hnh VPN chng ln. Kh nng m rng trong m hnh VPN ngang hng d dng hn v nh cung cp dch v ch cn thm vo mt site v thay i cu hnh trn b nh tuyn PE. Trong m hnh chng ln, nh cung cp dch v phi tham gia vo ton b tp hp cc knh o VC t site ny n site khc ca VPN khch hng.

Nh cung cp dch v c th trin khai hai kiu ng dng VPN ngang hng l chia s b nh tuyn v s dng b nh tuyn dnh ring.Phng php chia s b nh tuynCc khch hng VPN cng chia s mt b nh tuyn bin mng nh cung cp PE. phng php ny, nhiu khch hng c th kt ni n cng mt b nh tuyn PE. Do , trn b nh tuyn ny phi cu hnh mt danh sch truy nhp (Access List) cho mi giao din PE-CE m bo chc chn s cch ly gia cc khch hng VPN, ng thi ngn chn VPN ca khch hng ny thc hin cc tn cng t chi dch v DoS (Denial of Service) vo VPN ca khch hng khc. Nh cung cp dch v chia cc phn trong khng gian a ch ca n cho khch hng v qun l vic lc gi tin trn b nh tuyn PE.

Phng php s dng b nh tuyn dnh ringL phng php m mi khch hng VPN c b nh tuyn PE dnh ring. Trong phng php ny, khch hng VPN ch truy nhp n cc tuyn trong bng nh tuyn ca b nh tuyn PE dnh ring. Mi b nh tuyn s dng cc giao thc nh tuyn to ra bng nh tuyn cho mt VPN. Bng nh tuyn ch c cc tuyn c qung b bi khch hng VPN kt ni n chng, kt qu l to ra s cch ly tuyt i gia cc VPN. Vic nh tuyn trn b nh tuyn dnh ring c th c thc hin nh sau:

Giao thc nh tuyn gia PE v CE l bt k;

Giao thc hot ng gia PE v PE l BGP; PE phn phi cc tuyn nhn c t CE vo BGP, nh du vi nhn dng ID ca khch hng ri truyn cc tuyn n b nh tuyn P, v b nh tuyn ny s c cc tuyn t tt c cc VPN khch hng;

B nh tuyn P ch truyn cc tuyn thch hp n b nh tuyn PE, do PE ch nhn cc tuyn t b nh tuyn CE trong VPN.

Phng php dng chung b nh tuyn rt kh duy tr v n yu cu phi c danh sch truy nhp di v phc tp trn mi giao din ca b nh tuyn. Cn trong phng php dng b nh tuyn ring, mc d c v n gin v cu hnh v d duy tr hn nhng nh cung cp dch v phi b ra chi ph ln m bo phc v tt cho s lng ng khch hng.Tt c khch hng dng chung khng gian a ch IP, nn h phi s dng hoc l a ch tht trong mng ring ca h hoc l ph thuc vo nh cung cp dch v c c a ch IP. Trong c hai trng hp, kt ni mt khch hng mi n dch v VPN ngang hng i hi phi ng k li a ch IP trong mng khch hng. Hn ch ca m hnh VPN ngang hng l nh cung cp dch v phi p ng c nh tuyn khch hng cho ng v m bo vic hi t ca mng khch hng khi c li lin kt. Ngoi ra, b nh tuyn P ca nh cung cp dch v phi mang tt c cc tuyn ca khch hng.

1.4 Phn loi VPN v ng dng

Mng ring o VPN cung cp nhiu kh nng ng dng khc nhau. Yu cu c bn i vi VPN l phi iu khin c quyn truy nhp ca khch hng, cc nh cung cp dch v cng nh cc i tng bn ngoi khc. Da vo hnh thc ng dng v nhng kh nng m mng ring o mang li, c th phn chng thnh hai loi nh sau:

VPN truy nhp t xa (Remote Access VPN); VPN im ti im (Site-to-Site VPN).Trong mng VPN im ti im li c chia thnh hai loi l:

VPN cc b (Intranet VPN);

VPN m rng (Extranet VPN).

1.4.1 VPN truy nhp t xaCc VPN truy nhp t xa cung cp kh nng truy nhp t xa cho ngi s dng (hnh 1.2). Ti mi thi im, cc nhn vin hay chi nhnh vn phng di ng c th s dng cc phn mm VPN truy nhp vo mng ca cng ty thng qua gateway hoc b tp trung VPN (bn cht l mt server). Gii php ny v th cn c gi l gii php client/server. VPN truy nhp t xa l kiu VPN in hnh nht, bi v chng c th c thit lp vo bt k thi im no v t bt c ni no c mng Internet.

VPN truy nhp t xa m rng mng cng ty ti nhng ngi s dng thng qua c s h tng chia s chung, trong khi nhng chnh sch mng cng ty vn duy tr. Chng c th dng cung cp truy nhp an ton cho nhng nhn vin thng xuyn phi i li, nhng chi nhnh hay nhng bn hng ca cng ty. Nhng kiu VPN ny c thc hin thng qua c s h tng cng cng bng cch s dng cng ngh ISDN, quay s, IP di ng, DSL hay cng ngh cp v thng yu cu mt vi kiu phn mm client chy trn my tnh ca ngi s dng.

Mt hng pht trin kh mi trong VPN truy nhp t xa l dng VPN khng dy (Wireless), trong mt nhn vin c th truy nhp v mng ca h thng qua kt ni khng dy. Trong thit k ny, cc kt ni khng dy cn phi kt ni v mt trm khng dy (Wireless Terminal) v sau v mng ca cng ty. Trong c hai trng hp (c dy v khng dy), phn mm client trn my PC u cho php khi to cc kt ni bo mt, cn c gi l ng hm.

Mt vn quan trng l vic thit k qu trnh xc thc ban u m bo yu cu c xut pht t mt ngun tin cy. Thng th giai on ban u ny da trn cng mt chnh sch v bo mt ca cng ty. Chnh sch ny bao gm mt s qui trnh k thut v cc ng dng ch, v d nh Remote Authentication Dial-In User Service (RADIUS), Terminal Access Controller Access Control System Plus (TACACS+),

Hnh 1.2 M hnh VPN truy nhp t xaCc u im ca VPN truy nhp t xa so vi cc phng php truy nhp t xa truyn thng l:

VPN truy nhp t xa khng cn s h tr ca nhn vin mng bi v qu trnh kt ni t xa c cc ISP thc hin;

Gim c cc chi ph cho kt ni t khong cch xa bi v cc kt ni khong cch xa c thay th bi cc kt ni cc b thng qua mng Internet;

Cung cp dch v kt ni gi r cho nhng ngi s dng xa;

Do kt ni truy nhp l ni b nn cc modem kt ni hot ng tc cao hn so vi cch truy nhp khong cch xa;

VPN cung cp kh nng truy nhp tt hn n cc site ca cng ty bi v chng h tr mc thp nht ca dch v kt ni.Mc d c nhiu u im nhng mng VPN truy nhp t xa vn cn nhng nhc im c hu i cng nh:

VPN truy nhp t xa khng h tr cc dch v m bo QoS; Nguy c b mt d liu cao do cc gi c th phn pht khng n ni hoc b mt; Do thut ton m ho phc tp nn tiu giao thc tng mt cch ng k.

1.4.2 VPN im ti imVPN im ti im (Site-to-Site hay LAN-to-LAN) l gii php kt ni cc h thng mng nhng ni khc nhau vi mng trung tm thng qua VPN. Trong tnh hung ny, qu trnh xc thc ban u cho ngi s dng s l qu trnh xc thc gia cc thit b. Cc thit b ny hot ng nh Cng an ninh (Security Gateway), truyn lu lng mt cch an ton t Site ny n Site kia. Cc thit b nh tuyn hay tng la vi h tr VPN u c kh nng thc hin kt ni ny. S khc nhau gia VPN truy nhp t xa v VPN im ti im ch mang tnh tng trng. Nhiu thit b VPN mi c th hot ng theo c hai cch ny.

VPN im ti im c th c xem nh mt VPN cc b hoc m rng xt t quan im qun l chnh sch. Nu h tng mng c chung mt ngun qun l, n c th c xem nh VPN cc b. Ngc li, n c th c coi l m rng. Vn truy nhp gia cc im phi c kim sot cht ch bi cc thit b tng ng.

1.4.2.1 VPN cc bVPN cc b l mt dng cu hnh tiu biu ca VPN im ti im, c s dng bo mt cc kt ni gia cc a im khc nhau ca mt cng ty (hnh 1.3). N lin kt tr s chnh, cc vn phng, chi nhnh trn mt c s h tng chung s dng cc kt ni lun c m ho bo mt. iu ny cho php tt c cc a im c th truy nhp an ton cc ngun d liu c php trong ton b mng ca cng ty.

Hnh 1.3 M hnh VPN cc bVPN cc b cung cp nhng c tnh ca mng WAN nh kh nng m rng, tnh tin cy v h tr cho nhiu kiu giao thc khc nhau vi chi ph thp nhng vn m bo tnh mm do. Nhng u im chnh ca gii php VPN cc b bao gm:

Cc mng cc b hay din rng c th c thit lp thng qua mt hay nhiu nh cung cp dch v;

Gim c s nhn vin k thut h tr trn mng i vi nhng ni xa;

Do kt ni trung gian c thc hin thng qua Internet, nn n c th d dng thit lp thm mt lin kt ngang hng mi;

Tit kim chi ph t vic s dng ng hm VPN thng qua Internet kt hp vi cc cng ngh chuyn mch tc cao.

Tuy nhin gii php mng cc b da trn VPN cng c nhng nhc im i cng nh:

Do d liu c truyn ngm qua mng cng cng nh Internet nn vn cn nhng mi e da v mc bo mt d liu v cht lng dch v (QoS);

Kh nng cc gi d liu b mt trong khi truyn dn vn cn kh cao;

Trng hp cn truyn khi lng ln d liu nh a phng tin vi yu cu tc cao v m bo thi gian thc l thch thc ln trong mi trng Internet.

1.4.2.2 VPN m rngVPN m rng c cu hnh nh mt VPN im ti im, cung cp ng hm bo mt gia cc khch hng, nh cung cp v i tc thng qua mt c s h tng mng cng cng (hnh 1.4). Kiu VPN ny s dng cc kt ni lun c bo mt v n khng b c lp vi th gii bn ngoi nh cc trng hp VPN cc b hay truy nhp t xa.

Hnh 1.4 M hnh VPN m rngGii php VPN m rng cung cp kh nng iu khin truy nhp ti nhng ngun ti nguyn mng cn thit m rng ti nhng i tng kinh doanh. S khc nhau gia VPN cc b v VPN m rng l s truy nhp mng c cng nhn mt trong hai u cui ca VPN.

Nhng u im chnh ca mng VPN m rng bao gm:

Chi ph cho VPN m rng thp hn nhiu so vi cc gii php kt ni khc cng t c mt mc ch nh vy;

D dng thit lp, bo tr v thay i i vi mng ang hot ng; Do VPN m rng c xy dng da trn mng Internet nn c nhiu c hi trong vic cung cp dch v v chn la gii php ph hp vi cc nhu cu ca tng cng ty;

Cc kt ni Internet c nh cung cp dch v Internet bo tr nn c th gim c s lng nhn vin k thut h tr mng, v do vy gim c chi ph vn hnh ca ton mng.

Bn cnh nhng u im trn, gii php VPN m rng cng cn nhng nhc im i cng nh:

Vn bo mt thng tin gp kh khn hn trong mi trng m rng nh vy, v iu ny lm tng nguy c ri ro i vi mng cc b ca cng ty;

Kh nng mt d liu trong khi truyn qua mng cng cng vn tn ti;

Vic truyn khi lng ln d liu vi yu cu tc cao v thi gian thc vn cn l mt thch thc ln cn gii quyt.1.4.3 ng dng VPN C VPN truy nhp t xa v VPN im ti im u cung cp gii php xy dng mng ring o cho doanh nghip. Cc cng ty c th m rng mng ra nhng ni m trc y khng th m rng. Trong nhiu ng dng, VPN cho php tit kim chi ph mt cch ng k. Thay v cn nhiu kt ni n cng tr s chnh, gii php VPN tch hp lu lng vo mt kt ni duy nht, to ra c hi gim chi ph c bn trong v bn ngoi doanh nghip. Mng Internet hin nay l mt h tng tt, cho php doanh nghip thay i mng ca h theo nhiu chiu hng. i vi cc cng ty ln c th d dng nhn thy rng cc kt ni WAN qua knh thu ring l rt tn km v ang dn c thay th bi kt ni VPN. i vi dch v truy nhp t xa, thay v dng cc ng kt ni tc chm hoc cc dch v knh thu ring t tin, ngi s dng by gi c th c cung cp cc dch v truy nhp tc cao vi gi thnh r. Ngoi ra, nhng ngi dng c ng cng c th tn dng cc kt ni tc cao Ethernet trong cc khch sn, sn bay hay ni cng cng phc v cho cng vic ca mnh mt cch hiu qu. Ch ring yu t ct gim chi ph cuc gi ng di trong trng hp ny cng l mt l do rt thuyt phc s dng VPN.

Mt trong nhng li ch khc ca VPN l gip cc cng ty c th trin khai nhiu ng dng mi trn nn thng mi in t (e-Commerce) mt cch nhanh chng. Tuy nhin, trong trng hp ny mt vi yu t cng cn phi c xem xt mt cch cn thn. Cc tr ngi chnh ca Internet l bo mt, cht lng dch v, tin cy v kh nng qun l.1.5 Kt chngVPN c nh ngha nh l mng kt ni cc site khch hng m bo an ninh trn c s h tng mng chung cng vi cc chnh sch iu khin truy nhp v bo mt nh mt mng ring. Tuy c xy dng trn c s h tng sn c ca mng cng cng nhng VPN li c c cc tnh cht ca mt mng cc b nh khi s dng cc ng knh thu ring. N cho php ni lin cc chi nhnh ca mt cng ty cng nh l vi cc i tc, cung cp kh nng iu khin quyn truy nhp ca khch hng, cc nh cung cp dch v hoc cc i tng bn ngoi khc. Kh nng ng dng ca VPN l rt ln. Theo nh d on ca nhiu hng trn th gii th VPN s l dch v pht trin mnh trong tng lai. Do , vic tip cn v lm quen vi cng ngh mi ny r rng l v cng cn thit. Chng ny trnh by nhng khi nim c bn v VPN, cc chc nng v c im ca VPN, cc m hnh xy dng VPN cng nh l phn loi VPN theo hnh thc v phm vi ng dng ca chng. Nhng ni dung c cp ch mang tnh khi qut nhm gip ngi c c c ci nhn tng quan v VPN. Cc vn k thut lin quan n vic thc hin VPN s c trnh by trong cc chng sau.CHNG 2 CC GIAO THC NG HM

C th ni ng hm l mt trong nhng khi nim nn tng ca VPN. Giao thc ng hm thc hin vic ng gi d liu vi cc phn tiu tng ng truyn qua Internet. Trong chng ny gii thiu v cc giao thc ng hm ph bin ang tn ti v s dng cho IP-VPN, bao gm L2F, PPTP v L2TP. Ring giao thc IPSec s c trnh by chi tit trong chng 3 cng vi nhng c im k thut lin quan trc tip n vic thc hin IP-VPN.

Ni dung chng ny bao gm:

Gii thiu cc giao thc ng hm Giao thc chuyn tip lp 2 L2F Giao thc ng hm im ti im PPTP Giao thc ng hm lp 2 L2TP1.6 Gii thiu cc giao thc ng hm

Cc giao thc ng hm l nn tng ca cng ngh VPN. C nhiu giao thc ng hm khc nhau, v vic s dng giao thc no lin quan n cc phng php xc thc v mt m i km. Cc giao thc ng hm ph bin hin nay l:

Giao thc chuyn tip lp 2 (L2F Layer Two Forwarding); Giao thc ng hm im ti im (PPTP Point to Point Tunneling Protocol); Giao thc ng hm lp 2 (L2TP Layer Two Tunneling Protocol); Giao thc bo mt IP (IPSec Internet Protocol Security).

L2F v PPTP u c pht trin da trn giao thc PPP (Point to Point Protocol). PPP l mt giao thc truyn thng ni tip lp 2, c th s dng ng gi d liu lin mng IP v h tr a giao thc lp trn. Giao thc L2F do Cisco pht trin c lp, cn PPTP l do nhiu cng ty hp tc pht trin. Trn c s L2F v PPTP, IETF pht trin giao thc ng hm L2TP. Hin nay cc giao thc PPTP v L2TP c s dng ph bin hn L2F.

Trong cc giao thc ng hm ni trn, IPSec l gii php ti u v mt an ninh d liu. N h tr cc phng php xc thc v mt m mnh nht. Ngoi ra, IPSec cn c tnh linh hot cao, khng b rng buc bi bt c thut ton xc thc hay mt m no. IPSec c th s dng ng thi cng vi cc giao thc ng hm khc tng tnh an ton cho h thng.

Mc d c nhng u im vt tri so vi cc giao thc ng hm khc v kh nng m bo an ninh d liu, IPSec cng c mt s nhc im. Th nht, IPSec l mt khung tiu chun mi v cn ang c tip tc pht trin, do s lng cc nh cung cp sn phm h tr IPSec cha nhiu. Th hai, tn dng kh nng m bo an ninh d liu ca IPSec th cn phi s dng mt c s h tng kha cng khai PKI (Public Key Infrastructure) phc tp gii quyt cc vn nh chng thc s hay ch k s.

Khc vi IPSec, cc giao thc PPTP v L2TP l cc chun c hon thin, nn sn phm h tr chng tng i ph bin. PPTP c th trin khai vi mt h thng mt khu n gin m khng cn s dng PKI. Ngoi ra, PPTP v L2TP cn c mt s u im khc so vi IPSec nh kh nng h tr a giao thc lp trn. V vy, trong khi IPSec cn ang hon thin th PPTP v L2TP vn c s dng rng ri. C th l PPTP v L2TP thng c s dng trong cc ng dng truy nhp t xa.

1.7 Giao thc chuyn tip lp 2 L2F

Giao thc L2F c pht trin sm nht, l phng php truyn thng cho nhng ngi s dng xa truy nhp vo mt mng cng ty thng qua thit b truy nhp t xa. L2F cung cp gii php cho dch v quay s o bng cch thit lp mt ng hm bo mt thng qua c s h tng cng cng nh Internet. N cho php ng gi cc gi PPP trong khun dng L2F v nh ng hm lp lin kt d liu.

1.7.1 Cu trc gi L2FKhun dng gi tin L2F c cu trc nh trn hnh 2.1.1bit1bit1bit1bit8bit1bit3bit8bit8bit

FKPSReservedCVersionProtocolSequence

Multiplex IDClient ID

LengthOffset

Key

Data

Checksum

Hnh 2.1 Khun dng gi ca L2F ngha cc trng trong gi L2F nh sau: F: ch nh trng Offset c mt; K: ch nh trng Key c mt; P (Priority): thit lp u tin cho gi; S: ch nh trng Sequence c mt; Reserved: lun c t l 00000000; Version: phin bn ca L2F dng to gi; Protocol: xc nh giao thc ng gi L2F; Sequence: s chui c a ra nu trong tiu L2F bit S bng 1.

Multiplex ID: nhn dng mt kt ni ring trong mt ng hm (tunnel); Client ID: gip tch ng hm ti nhng im cui; Length: chiu di ca gi (tnh bng byte) khng bao gm phn checksum; Offset: xc nh s byte cch tiu L2F, ti d liu ti tin c bt u. Trng ny c mt khi bit F bng 1; Key: l mt phn ca qu trnh xc thc (c mt khi bit K bng 1); Checksum: tng kim tra ca gi (c mt khi bit C bng 1).

1.7.2 Hot ng ca L2F

L2F ng gi nhng gi tin lp 2 (trong trng hp ny l PPP), sau truyn chng xuyn qua mng. H thng s dng L2F gm cc thnh phn sau (hnh 2.2): My ch truy nhp mng NAS (Network Access Server): hng lu lng n v i gia my khch xa (Remote Client) v Home Gateway. Mt h thng ERX c th hot ng nh NAS.

ng hm (Tunnel): nh hng ng i gia NAS v Home Gateway. Mt ng hm gm mt s kt ni.

Home Gateway: ngang hng vi NAS, l phn t ca ng thuc mng ring.

Kt ni (Connection): l mt kt ni PPP trong ng hm. Trong CLI, mt kt ni L2F c xem nh l mt phin.

im ch (Destination): l im kt thc u xa ca ng hm. Trong trng hp ny th Home Gateway l im ch.

Hnh 2.2 M hnh h thng s dng L2FCc hot ng ca L2F bao gm: thit lp kt ni, ng hm v phin lm vic. Cc bc thc hin c th nh sau:

1) Mt ngi s dng xa quay s ti h thng NAS v khi u mt kt ni PPP ti ISP.

2) H thng NAS v my khch trao i cc gi giao thc iu khin lin kt LCP (Link Control Protocol).

3) NAS s dng c s d liu cc b lin quan ti tn min (domain name) hay xc thc RADIUS quyt nh xem ngi s dng c hay khng yu cu dch v L2F.

4) Nu ngi s dng yu cu L2F th qu trnh tip tc, NAS thu nhn a ch ca Gateway ch (Home Gateway).

5) Mt ng hm c thit lp t NAS ti Gateway ch nu gia chng cha c ng hm no. S thnh lp ng hm bao gm giai on xc thc t ISP ti Gateway ch chng li tn cng bi nhng k th ba.

6) Mt kt ni PPP mi c to ra trong ng hm, iu ny c tc ng ko di phin PPP t ngi s dng xa ti Home Gateway. Kt ni ny c thit lp nh sau: Home Gateway tip nhn cc la chn v tt c thng tin xc thc PAP/CHAP nh tho thun bi u cui ngi s dng v NAS. Home Gateway chp nhn kt ni hay tho thun li LCP v xc thc li ngi s dng.

7) Khi NAS tip nhn lu lng d liu t ngi s dng, n ng gi lu lng vo trong cc khung L2F v hng chng vo trong ng hm.

8) Ti Home Gateway khung L2F c tch b, v d liu ng gi c hng ti mng cng ty.

Khi h thng thit lp im ch, ng hm v nhng phin kt ni, ta phi iu khin v qun l lu lng L2F nh sau:

Ngn cn to nhng im ch, ng hm v phin mi.

ng v m li tt c hay chn la nhng im ch, ng hm v phin.

C kh nng kim tra tng UDP.

Thit lp thi gian ri cho h thng v lu gi c s d liu vo ca cc ng hm v kt ni.

S thay i mt im ch lm nh hng ti tt c nhng ng hm v phin ti im ch . S thay i mt ng hm lm nh hng ti tt c cc phin trong ng hm . V d, s kt thc im ch ng tt c cc ng hm v phin ti im ch .

L2F cung cp mt s lnh thc hin cc chc nng ca n, v d:

L2F checksum: kim tra s ton vn d liu trong cc khung L2F s dng kim tra tng UDP, v d host 1(config)#l2f checksum

L2F destruct-timeout: thit lp thi gian ri, gi tr thit lp trong di 10 3600 giy, v d host1 (config)#l2f destruct-timeout 1200

1.7.3 u nhc im ca L2F

Giao thc L2F c cc u im sau y:

Cho php thit lp ng hm a giao thc;

c h tr bi nhiu nh cung cp.

Cc nhc im chnh ca L2F l:

Khng c m ho; Hn ch trong vic xc thc ngi dng;

Khng c iu khin lung cho ng hm.

1.8 Giao thc ng hm im ti im PPTP

Giao thc ng hm im ti im c a ra u tin bi mt nhm cc cng ty c gi l PPTP Forum. tng c s ca giao thc ny l tch cc chc nng chung v ring ca truy nhp t xa, li dng c s h tng Internet sn c to kt ni bo mt gia ngi dng xa (client) v mng ring. Ngi dng xa ch vic quay s ti nh cung cp dch v Internet a phng l c th to ng hm bo mt ti mng ring ca h.Giao thc PPTP c xy dng da trn chc nng ca PPP, cung cp kh nng quay s truy nhp to ra mt ng hm bo mt thng qua Internet n site ch. PPTP s dng giao thc ng gi nh tuyn chung GRE c m t li ng v tch gi PPP. Giao thc ny cho php PPTP mm do x l cc giao thc khc khng phi IP nh IPX, NETBEUI.

1.8.1 Khi qut v hot ng ca PPTP

PPP tr thnh giao thc truy nhp vo Internet v cc mng IP rt ph bin hin nay. Lm vic lp lin kt d liu trong m hnh OSI, PPP bao gm cc phng thc ng, tch gi cho cc loi gi d liu khc nhau truyn ni tip. PPP c th ng cc gi IP, IPX, NETBEUI v truyn i trn kt ni im-im t my gi n my nhn.

PPTP ng gi cc khung d liu ca giao thc PPP vo cc IP datagram truyn qua mng IP (Internet hoc Intranet). PPTP dng mt kt ni TCP (gi l kt ni iu khin PPTP) khi to, duy tr, kt thc ng hm, v mt phin bn ca giao thc GRE ng gi cc khung PPP. Phn ti tin ca khung PPP c th c mt m v/hoc nn.

PPTP s dng PPP thc hin cc chc nng:

Thit lp v kt thc kt ni vt l.

Xc thc ngi dng.

To cc gi d liu PPP.

PPTP gi nh tn ti mt mng IP gia PPTP client (VPN client s dng PPTP) v PPTP server (VPN server s dng PPTP). PPTP client c th c ni trc tip qua vic quay s ti my ch truy nhp mng NAS thit lp kt ni IP. Khi mt kt ni PPP c thit lp th ngi dng thng c xc thc. y l giai on tu chn trong PPP, tuy nhin n lun lun c cung cp bi cc ISP. Vic xc thc trong qu trnh thit lp kt ni da trn PPTP s dng cc c ch xc thc ca kt ni PPP. Cc c ch xc thc c th l:

EAP (Extensible Authentication Protocol) giao thc xc thc m rng;

CHAP (Challenge Handshake Authentication Protocol) giao thc xc thc i hi bt tay;

PAP (Password Authentication Protocol) giao thc xc thc mt khu. Vi PAP mt khu c gi qua kt ni di dng vn bn n gin v khng c bo mt. CHAP l mt giao thc xc thc mnh hn, s dng phng thc bt tay ba chiu. CHAP chng li cc v tn cng quay li bng cch s dng cc gi tr thch (Challenge Value) duy nht v khng th on trc c.

PPTP cng tha hng vic mt m v/hoc nn phn ti tin ca PPP. mt m phn ti tin PPP c th s dng phng thc m ho im ti im MPPE (Microsoft Point to Point Encryption). MPPE ch cung cp mt m mc truyn dn, khng cung cp mt m u cui n u cui. Nu cn s dng mt m u cui n u cui th c th s dng IPSec mt m lu lng IP gia cc u cui sau khi ng hm PPTP c thit lp. Sau khi PPP thit lp kt ni, PPTP s dng cc quy lut ng gi ca PPP ng cc gi truyn trong ng hm. tn dng u im ca kt ni to ra bi PPP, PPTP nh ngha hai loi gi l iu khin v d liu, sau gn chng vo hai knh ring l knh iu khin v knh d liu. PPTP phn tch cc knh iu khin v knh v knh d liu thnh lung iu khin vi giao thc TCP v lung d liu vi giao thc IP. Kt ni TCP to gia my trm PPTP (client) v my ch PPTP (server) c s dng tryn thng bo iu khin. Cc gi d liu l d liu thng thng ca ngi dng. Cc gi iu khin c gi theo chu k ly thng tin v trng thi kt ni v qun l bo hiu gia ng dng khch PPTP v my ch PPTP. Cc gi iu khin cng c dng gi cc thng tin qun l thit b, thng tin cu hnh gia hai u ng hm.

Knh iu khin c yu cu cho vic thit lp mt ng hm gia my trm v my ch PPTP. My ch PPTP l mt server s dng giao thc PPTP vi mt giao din ni vi Internet v mt giao din khc ni vi Intranet, cn phn mm client c th nm my ngi dng t xa hoc ti my ch ca ISP.

1.8.2 Duy tr ng hm bng kt ni iu khin PPTP

Kt ni iu khin PPTP l kt ni gia a ch IP ca my trm PPTP (c cng TCP c cp pht ng) v a ch IP ca my ch PPTP (s dng cng TCP dnh ring 1723). Kt ni iu khin PPTP mang cc bn tin iu khin v qun l c s dng duy tr ng hm PPTP. Cc bn tin ny bao gm PPTP Echo-Request v PPTP Echo-Reply nh k pht hin cc li kt ni gia my trm v my ch PPTP. Cc gi ca kt ni iu khin PPTP bao gm tiu IP, tiu TCP, bn tin iu khin PPTP v tiu , phn ui ca lp lin kt d liu (hnh 2.3).

Hnh 2.3 Gi d liu kt ni iu khin PPTP1.8.3 ng gi d liu ng hm PPTP

ng gi khung PPP v GRED liu ng hm PPTP c ng gi thng qua nhiu mc. Hnh 2.4 l cu trc d liu c ng gi.

Hnh 2.4 ng gi d liu ng hm PPTPPhn ti ca khung PPP ban u c mt m v ng gi vi tiu PPP to ra khung PPP. Khung PPP sau c ng gi vi phn tiu ca phin bn giao thc GRE sa i. GRE l giao thc ng gi chung, cung cp c ch ng gi d liu nh tuyn qua mng IP. i vi PPTP, phn tiu ca GRE c sa i mt s im nh sau:

Mt trng xc nhn di 32 bit c thm vo.

Mt bit xc nhn c s dng ch nh s c mt ca trng xc nhn 32 bit.

Trng Key c thay th bng trng di Payload 16 bit v trng ch s cuc gi 16 bit. Trng ch s cuc gi c thit lp bi my trm PPTP trong qu trnh khi to ng hm PPTP.

ng gi IP

Phn ti PPP ( c mt m) v cc tiu GRE sau c ng gi vi mt tiu IP cha cc thng tin a ch ngun v ch thch hp cho my trm v my ch PPTP.

ng gi lp lin kt d liu

c th truyn qua mng LAN hoc WAN, gi IP cui cng s c ng gi vi mt tiu v phn ui ca lp lin kt d liu giao din vt l u ra. V d, nu gi IP c gi qua giao din Ethernet, n s c gi vi phn tiu v ui Ethernet. Nu gi IP c gi qua ng truyn WAN im ti im (nh ng in thoi tng t hoc ISDN), n s c ng gi vi phn tiu v ui ca giao thc PPP.

S ng gi

Hnh 2.5 l v d s ng gi PPTP t mt my trm qua kt ni truy nhp VPN t xa s dng modem tng t.

Hnh 2.5 S ng gi PPTPQu trnh ng gi c m t c th nh sau:

Cc gi IP, IPX hoc khung NetBEUI c a ti giao din o i din cho kt ni VPN bng giao thc tng ng s dng NDIS (Network Driver Interface Specification).

NDIS a gi d liu ti NDISWAN, ni thc hin mt m, nn d liu v cung cp tiu PPP. Phn tiu PPP ny ch gm trng m s giao thc PPP (PPP Protocol ID Field), khng c cc trng Flags v FCS (Frame Check Sequence). Gi nh trng a ch v iu khin c tha thun giao thc iu khin ng truyn LCP (Link Control Protocol) trong qu trnh kt ni PPP.

NDISWAN gi d liu ti giao thc PPTP, ni ng gi khung PPP vi phn tiu GRE. Trong tiu GRE, trng ch s cuc gi c t gi tr thch hp xc nh ng hm.

Giao thc PPTP sau s gi gi va hnh thnh ti TCP/IP.

TCP/IP ng gi d liu ng hm PPTP vi phn tiu IP, sau gi kt qu ti giao din i din cho kt ni quay s ti ISP cc b s dng NDIS.

NDIS gi gi tin ti NDISWAN, ni cung cp cc phn tiu v ui PPP.

NDISWAN gi khung PPP kt qu ti cng WAN tng ng i din cho phn cng quay s (v d, cng khng ng b cho kt ni modem).

1.8.4 X l d liu ti u cui ng hm PPTP

Khi nhn c d liu ng hm PPTP, my trm v my ch PPTP s thc hin cc bc sau:

X l v loi b phn tiu v ui ca lp lin kt d liu;

X l v loi b tiu IP;

X l v loi b tiu GRE v PPP;

Gii m v/hoc gii nn phn ti PPP (nu cn thit);

X l phn ti tin nhn hoc chuyn tip.

1.8.5 Trin khai VPN da trn PPTP trin khai VPN da trn giao thc PPTP yu cu h thng ti thiu phi c cc thnh phn thit b nh ch ra trn hnh 2.6, c th bao gm: Mt my ch truy nhp mng dng cho phng thc quay s truy nhp bo mt vo VPN;

Mt my ch PPTP;

My trm PPTP vi phn mm client cn thit.

Hnh 2.6 Cc thnh phn ca h thng cung cp VPN da trn PPTPCc my ch PPTP c th t ti mng ca cng ty v do nhn vin trong cng ty qun l.

My ch PPTP

My ch PPTP thc hin hai chc nng chnh: ng vai tr l im kt ni ca ng hm PPTP v chuyn cc gi n t ng hm ti mng LAN ring. My ch PPTP chuyn cc gi n my ch bng cch x l gi PPTP c c a ch mng ca my tnh ch. My ch PPTP cng c kh nng lc gi. Bng cch s dng c ch lc gi PPTP my ch c th ngn cm, ch cho php truy nhp vo Internet, mng ring hay c hai.

Thit lp my ch PPTP ti site mng c mt hn ch nu nh my ch PPTP nm sau tng la. PPTP c thit k sao cho ch c mt cng TCP 1723 c s dng chuyn d liu i. S khim khuyt ca cu hnh cng ny c th lm cho tng la d b tn cng hn. Nu nh tng la c cu hnh lc gi th phi thit lp n cho php GRE i qua.

Mt thit b khc c khi xng nm 1998 bi hng 3Com c chc nng tng t my ch PPTP gi l chuyn mch ng hm. Mc ch ca chuyn mch ng hm l m rng ng hm t mt mng n mt mng khc, tri rng ng hm t mng ca ISP n mng ring. Chuyn mch ng hm c th c s dng ti tng la lm tng kh nng qun l truy nhp t xa vo ti nguyn ca mng ni b. N c th kim tra cc gi n v v, giao thc ca cc khung PPP hoc tn ca ngi dng t xa. Phn mm client PPTP

Nu nh cc thit b ca ISP h tr PPTP th khng cn phn cng hay phn mm b sung no cho cc my trm, ch cn mt kt ni PPP chun. Nu nh cc thit b ca ISP khng h tr PPTP th mt phn mm ng dng client vn c th to kt ni bo mt bng cch u tin quay s kt ni ti ISP bng PPP, sau quay s mt ln na thng qua cng PPTP o c thit lp my trm.

Phn mm client PPTP c sn trong Windows 9x, NT v cc h iu hnh sau ny. Khi chn client PPTP cn phi so snh cc chc nng ca n vi my ch PPTP c. Khng phi tt c cc phn mm client PPTP u h tr MS-CHAP, nu thiu cng c ny th khng th tn dng c u im m ho trong RRAS.

My ch truy nhp mng

My ch truy nhp mng NAS cn c tn gi khc l my ch truy nhp t xa (Remote Access Server) hay b tp trung truy nhp (Access Concentrator). NAS cung cp kh nng truy nhp ng dy da trn phn mm, c kh nng tnh cc v c kh nng chu ng li ti ISP POP. NAS ca ISP c thit k cho php mt s lng ln ngi dng c th quay s truy nhp vo cng mt lc.

Nu mt ISP cung cp dch v PPTP th cn phi ci mt NAS cho php PPTP h tr cc client chy trn cc nn khc nhau nh Unix, Windows, Macintosh, v.v. Trong trung hp ny, my ch ISP ng vai tr nh mt client PPTP kt ni vi my ch PPTP ti mng ring v my ch ISP tr thnh mt im cui ca ng hm, im cui cn li l my ch ti u mng ring.

1.8.6 u nhc im v kh nng ng dng ca PPTP

u im ca PPTP l c thit k hot ng lp 2 (lin kt d liu) trong khi IPSec chy lp 3 ca m hnh OSI. Bng cch h tr vic truyn d liu lp 2, PPTP c th truyn trong ng hm bng cc giao thc khc IP trong khi IPSec ch c th truyn cc gi IP trong ng hm.

Tuy nhin, PPTP l mt gii php tm thi v hu ht cc nh cung cp u c k hoch thay th PPTP bng L2TP khi m giao thc ny c chun ho. PPTP thch hp cho quay s truy nhp vi s lng ngi dng gii hn hn l cho VPN kt ni LAN-LAN. Mt vn ca PPTP l x l xc thc ngi dng thng qua Windows NT hay thng qua RADIUS. My ch PPTP cng qu ti vi mt s lng ngi dng quay s truy nhp hay mt lu lng ln d liu tryn qua, m iu ny l mt yu cu ca kt ni LAN-LAN. Khi s dng VPN da trn PPTP m c h tr thit b ca ISP th mt s quyn qun l phi chia s cho ISP. Tnh bo mt ca PPTP khng mnh bng IPSec. Tuy nhin, qun bo mt trong PPTP li n gin hn.

1.9 Giao thc ng hm lp 2 L2TP1.9.1 Khi qut v hot ng ca L2TP

trnh vic hai giao thc ng hm khng tng thch cng tn ti gy kh khn cho ngi s dng, IETF kt hp hai giao thc L2F v PPTP v pht trin thnh L2TP. L2TP c xy dng trn c s tn dng cc u im ca c PPTP v L2F, ng thi c th s dng c trong tt c cc trng hp ng dng ca hai giao thc ny. L2TP c m t trong khuyn ngh RFC 2661.

Mt ng hm L2TP c th khi to t mt PC xa quay v L2TP Network Server (LNS) hay t L2TP Access Concentrator (LAC) v LNS. Mc d L2TP vn dng PPP, n nh ngha c ch to ng hm ca ring n, ty thuc vo phng tin truyn ch khng dng GRE.

L2TP ng gi cc khung PPP truyn qua mng IP, X.25, Frame Relay hoc ATM. Tuy nhin, hin nay mi ch c L2TP trn mng IP c nh ngha. Khi truyn qua mng IP, cc khung L2TP c ng gi nh cc bn tin UDP. L2TP c th c s dng nh mt giao thc ng hm thng qua Internet hoc cc mng ring Intranet. L2TP dng cc bn tin UDP qua mng IP cho cc d liu ng hm cng nh cc d liu duy tr ng hm. Phn ti ca khung PPP ng gi c th c mt m v nn. Mt m trong cc kt ni L2TP thng c thc hin bi IPSec ESP (ch khng phi MPPE nh i vi PPTP). Cng c th to kt ni L2TP khng s dng mt m IPSec. Tuy nhin, y khng phi l kt ni IP-VPN v d liu ring c ng gi bi L2TP khng c mt m. Cc kt ni L2TP khng mt m c th s dng tm thi sa cc li kt ni L2TP dng IPSec.

L2TP gi nh tn ti mng IP gia my trm (VPN client dng giao thc ng hm L2TP v IPSec) v my ch L2TP. My trm L2TP c th c ni trc tip vi mng IP truy nhp ti my ch L2TP hoc gin tip thng qua vic quay s ti my ch truy nhp mng NAS thit lp kt ni IP. Vic xc thc trong qu trnh hnh thnh ng hm L2TP phi s dng cc c ch xc thc trong kt ni PPP nh EAP, MS-CHAP, CHAP, PAP. My ch L2TP l my ch IP-VPN s dng giao thc L2TP vi mt giao din ni vi Internet v mt giao din khc ni vi mng Intranet.

L2TP c th dng hai kiu bn tin l iu khin v d liu. Cc bn tin iu khin chu trch nhim thit lp, duy tr v hy cc ng hm. Cc bn tin d liu ng gi cc khung PPP c chuyn trn ng hm. Cc bn tin iu khin dng c ch iu khin tin cy bn trong L2TP m bo vic phn phi, trong khi cc bn tin d liu khng c gi li khi b mt trn ng truyn.1.9.2 Duy tr ng hm bng bn tin iu khin L2TP

Khng ging PPTP, vic duy tr ng hm L2TP khng c thc hin thng qua mt kt ni TCP ring bit. Cc lu lng iu khin v duy tr cuc gi c gi i nh cc bn tin UDP gia my trm v my ch L2TP (u s dng cng UDP 1701).

Cc bn tin iu khin L2TP qua mng IP c gi nh cc gi UDP. Gi UDP li c mt m bi IPSec ESP nh trn hnh 2.7.

Hnh 2.7 Bn tin iu khin L2TPV khng s dng kt ni TCP, L2TP dng th t bn tin m bo vic truyn cc bn tin L2TP. Trong bn tin iu khin L2TP, trng Next-Received (tng t nh TCP Acknowledgment) v Next-Sent (tng t nh TCP Sequence Number) c s dng duy tr th t cc bn tin iu khin. Cc gi khng ng th t b loi b. Cc trng Next-Sent v Next-Received cng c th c s dng truyn dn tun t v iu khin lung cho cc d liu ng hm.

L2TP h tr nhiu cuc gi trn mi ng hm. Trong bn tin iu khin L2TP v phn tiu L2TP ca d liu ng hm c mt m s ng hm (Tunnel ID) xc nh ng hm, v mt m nhn dng cuc gi (Call ID) xc nh cuc gi trong ng hm .

1.9.3 ng gi d liu ng hm L2TP

D liu ng hm L2TP c thc hin thng qua nhiu mc ng gi nh sau: ng gi L2TP. Phn ti PPP ban u c ng gi vi mt tiu PPP v mt tiu L2TP.

ng gi UDP. Gi L2TP sau c ng gi vi mt tiu UDP, cc a ch cng ngun v ch c t bng 1701.

ng gi IPSec. Tu thuc vo chnh sch IPSec, gi UDP c mt m v ng gi vi tiu IPSec ESP, ui IPSec ESP, ui IPSec Authentication.

ng gi IP. Gi IPSec c ng gi vi tiu IP cha a ch IP ngun v ch ca my trm v my ch.

ng gi lp lin kt d liu. truyn i c trn ng truyn LAN hoc WAN, gi IP cui cng s c ng gi vi phn tiu v ui tng ng vi k thut lp lin kt d liu ca giao din vt l u ra. V d, khi gi IP c gi vo giao din Ethernet, n s c ng gi vi tiu v ui Ethernet. Khi cc gi IP c gi trn ng truyn WAN im ti im (chng hn ng dy in thoi ISDN), chng c ng gi vi tiu v ui PPP.

Hnh 2.8 ch ra cu trc cui cng ca gi d liu ng hm L2TP trn nn IPSec.

Hnh 2.8 ng gi d liu ng hm L2TPHnh 2.9 l s ng gi L2TP t mt my trm VPN thng qua kt ni truy nhp t xa s dng modem tng t.

Hnh 2.9 S ng gi L2TP Qu trnh ng gi c thc hin thng qua cc bc nh sau:

Gi tin IP, IPX hoc NetBEUI c a ti giao din o i din cho kt ni VPN s dng NDIS bng giao thc thch hp.

NDIS a cc gi ti NDISWAN, ti y c th nn v cung cp tiu PPP ch bao gm trng ch s giao thc PPP. Cc trng Flag hay FCS khng c thm vo.

NDISWAN gi khung PPP ti giao thc L2TP, ni ng gi khung PPP vi mt tiu L2TP. Trong tiu L2TP, ch s ng hm v ch s cuc gi c thit lp vi cc gi tr thch hp xc nh ng hm.

Giao thc L2TP gi gi thu c ti TCP/IP vi thng tin gi gi L2TP nh mt bn tin UDP t cng UDP 1701 ti cng UDP 1701 theo cc a ch IP ca my trm v my ch.

TCP/IP xy dng gi IP vi cc tiu IP v UDP thch hp. IPSec sau s phn tch gi IP v so snh n vi chnh sch IPSec hin thi. Da trn nhng thit lp trong chnh sch, IPSec ng gi v mt m phn bn tin UDP ca gi IP s dng cc tiu v ui ESP ph hp. Tiu IP ban u vi trng Protocol c t l 50 v thm vo pha trc ca gi ESP. TCP/IP sau gi gi thu c ti giao din i din cho kt ni quay s ti ISP cc b s dng NDIS.

NDIS gi s ti NDISWAN.

NDISWAN cung cp tiu v ui PPP, sau gi khung PPP thu c ti cng thch hp i din cho phn cng dial-up.

1.9.4 X l d liu ti u cui ng hm L2TP trn nn IPSec

Khi nhn c d liu ng hm L2TP trn nn IPSec, my trm v my ch L2TP s thc hin cc bc sau:

X l v loi b tiu v ui ca lp lin kt d liu.

X l v loi b tiu IP.

Dng phn ui IPSec ESP Auth xc thc ti IP v tiu IPSec ESP.

Dng tiu IPSec ESP gii m phn gi mt m.

X l tiu UDP v gi gi ti L2TP.

L2TP dng ch s ng hm v ch s cuc gi trong tiu L2TP xc nh ng hm L2TP c th.

Dng tiu PPP xc nh ti PPP v chuyn tip n ti ng giao thc x l.

1.9.5 Trin khai VPN da trn L2TP

H thng cung cp VPN da trn L2TP bao gm cc thnh phn c bn sau: b tp trung truy nhp mng, my ch L2TP v cc my trm L2TP (hnh 2.10).

Hnh 2.10 Cc thnh phn ca h thng cung cp VPN da trn L2TP

My ch L2TP

My ch L2TP c hai chc nng chnh: ng vai tr l im kt thc ca ng hm L2TP v chuyn cc gi n t ng hm n mng LAN ring hay ngc li. My ch chuyn cc gi n my tnh ch bng cch x l gi L2TP c c a ch mng ca my tnh ch.

Khng ging nh my ch PPTP, my ch L2TP khng c kh nng lc cc gi. Chc nng lc gi trong L2TP c thc hin bi tng la.Tuy nhin trong thc t, ngi ta thng tch hp my ch mng v tng la. Vic tch hp ny mang li mt s u im hn so vi PPTP, l:

L2TP khng i hi ch c mt cng duy nht gn cho tng la nh trong PPTP. Chng trnh qun l c th tu chn cng gn cho tng la, iu ny gy kh khn cho k tn cng khi c gng tn cng vo mt cng trong khi cng c th thay i.

Lung d liu v thng tin iu khin c truyn trn cng mt UDP nn vic thit lp tng la s n gin hn. Do mt s tng la khng h tr GRE nn chng tng thch vi L2TP hn l vi PPTP.

Phn mm client L2TP

Nu nh cc thit b ca ISP h tr L2TP th khng cn phn cng hay phn mm b sung no cho cc my trm, ch cn kt ni chun PPP l . Tuy nhin, vi cc thit lp nh vy th khng s dng c m ho ca IPSec. Do vy ta nn s dng cc phn mm client tng thch L2TP cho kt ni L2TP VPN.

Mt s c im ca phn mm client L2TP l: Tng thch vi cc thnh phn khc ca IPSec nh my ch m ho, giao thc chuyn kho, gii thut m ho,

a ra mt ch bo r rng khi IPSec ang hot ng; Hm bm (hashing) x l c cc a ch IP ng; C c ch bo mt kho (m ho kho vi mt khu); C c ch chuyn i m ho mt cch t ng v nh k; Chn hon ton cc lu lng khng IPSec.

B tp trung truy nhp mng

ISP cung cp dch v L2TP cn phi ci mt NAS cho php L2TP h tr cc my trm L2TP chy trn nn cc h iu hnh khc nhau nh Unix, Windows, Macintosh, v.v.Cc ISP cng c th cung cp cc dch v L2TP m khng cn phi thm cc thit b h tr L2TP vo my ch truy nhp ca h, iu ny i hi tt c ngi dng phi c phn mm client L2TP ti my ca h. Khi ngi dng c th s dng dch v ca nhiu ISP trong trng hp m hnh mng ca h rng ln v mt a l.

1.9.6 u nhc im v kh nng ng dng ca L2TP

L2TP l mt th h giao thc quay s truy nhp VPN pht trin sau. N phi hp nhng c tnh tt nht ca PPTP v L2F. Hu ht cc nh cung cp sn phm PPTP u a ra cc sn phm tng thch vi L2TP.

Mc d L2TP ch yu chy trn mng IP, nhng kh nng chy trn cc mng cng ngh khc nh Frame Relay hay ATM lm cho n thm ph bin. L2TP cho php mt lng ln khch hng t xa c kt ni vo VPN cng nh l cc kt ni LAN-LAN c dung lng ln. L2TP c c ch iu khin lung lm gim tc nghn trn ng hm L2TP.

Vic la chn mt nh cung cp dch v L2TP c th thay i tu theo yu cu thit k mng. Nu thit k mt VPN i hi m ho u cui ti u cui th cn ci cc client tng thch L2TP ti cc trm t xa v tho thun vi ISP l s x l m ho t my u xa n tn my ch ca VPN. Nu xy dng mt mng vi mc bo mt thp hn, kh nng chu ng li cao hn v ch mun bo mt d liu khi n i trong ng hm trn Inernet th tho thun vi ISP h h tr LAC v m ho d liu ch t on LAC n LNS ca mng ring.

L2TP cho php thit lp nhiu ng hm vi cng LAC v LNS. Mi ng hm c th gn cho mt ngi dng xc nh hoc mt nhm ngi dng v gn cho cc mi trng khc nhau tu theo thuc tnh cht lng dch v QoS ca ngi s dng. 1.10 Kt chng

Mc bo m an ninh ca s liu khi truyn qua mng ph thuc nhiu vo gii php thc hin VPN ca doanh nghip. Chng 2 tp trung vo nhng vn k thut ca gii php mng ring o s dng ng hm. K thut ng hm ng mt vai tr rt quan trng trong vic trin khai VPN trn nn mng vin thng cng cng. Cc giao thc ng hm c gii thiu y bao gm L2F, PPTP v L2TP. Mi giao thc c trnh by tng i chi tit, t s ng gi d liu, nguyn l hot ng, qu trnh x l d liu ti u cui ng hm cho n nhng c im trin khai trn thc t. Trong ni dung trnh by cng a ra nhng phn tch cc c tnh v u nhc im ca tng giao thc nhm th hin r kh nng v phm vi ng dng ca chng.CHNG 3 MNG RING O TRN NN IPSec Cng vi s pht trin v m rng ca Internet th vic trao i thng tin gia cc chi nhnh, vn phng xa trong mt cng ty hay vi cc i tc kinh doanh bn ngoi khng cn l vn kh khn nh trc na. Tuy nhin, i i vi vic h tr kinh doanh hiu qu th nguy c mt an ninh d liu hay b tn cng ph hoi qua mng cng l iu rt d xy ra. Chnh v vy, vn m bo an ton cho d liu khi truyn qua mng cng cng tr nn c ngha c bit quan trng.

Giao thc IPSec (Internet Protocol Security) c pht trin gii quyt vn bo m an ninh cho thng tin truyn trn mng Internet v c coi l giao thc ti u nht cho vic thc hin IP-VPN. Chng ny trnh by cc c im quan trng nht ca IPSec, hot ng ca cc giao thc v tiu chun lin quan cng nh l nhng thut ton v k thut h tr cho vic thc hin VPN trn nn IPSec.Ni dung chng ny bao gm:

Gii thiu v IPSec ng gi thng tin IPSec Lin kt an ninh SA v hot ng trao i kha IKE

Mt s vn k thut trong thc hin VPN trn IPSec

V d thc hin VPN trn nn IPSec

Cc vn cn tn ti trong IPSec1.11 Gii thiu v IPSec Giao thc IPSec c IETF pht trin thit lp tnh bo mt trong mng IP cp gi. IPSec c nh ngha l mt h giao thc trong tng mng cung cp cc dch v bo mt, xc thc, ton vn d liu v iu khin truy nhp. N l mt tp hp cc tiu chun m lm vic cng nhau, c gii thiu ln u tin trong cc RFC 1825 1829 vo nm 1995.

IPSec cho php mt ng hm bo mt thit lp gia hai mng ring v xc thc hai u ca ng hm ny. Cc thit b gia hai u ng hm c th l mt cp host, mt cp Cng an ninh (thit b nh tuyn, firewall, b tp trung VPN) hoc cp thit b gm mt host v mt Cng an ninh. ng hm ng vai tr l mt knh truyn bo mt gia hai u v cc gi d liu yu cu an ninh c truyn trn . IPSec cng thc hin ng gi d liu v x l cc thng tin thit lp, duy tr v hy b knh truyn khi khng dng n na. Cc gi tin truyn trong ng hm c khun dng ging nh cc gi tin bnh thng khc v khng lm thay i cc thit b, kin trc cng nh nhng ng dng hin c trn mng trung gian, qua cho php gim ng k chi ph trin khai v qun l.

IPSec c hai c ch c bn m bo an ninh d liu l tiu xc thc (AH Authentication Header) v ng gi ti tin an ton (ESP Encapsulating Security Payload), trong IPSec phi h tr ESP v c th h tr AH. C AH v ESP u cung cp cc phng tin cho iu khin truy nhp da vo s phn phi ca cc kha mt m v qun l cc lung lu lng c lin quan n nhng giao thc an ninh ny.

AH cho php xc thc ngun gc d liu, kim tra tnh ton vn d liu v dch v ty chn chng pht li ca cc gi IP truyn gia hai h thng. AH khng cung cp tnh bo mt, iu ny c ngha l n gi i thng tin di dng bn r. ESP l mt giao thc cung cp tnh an ninh ca cc gi tin c truyn, bao gm mt m d liu, xc thc ngun gc d liu, kim tra tnh ton vn phi kt ni ca d liu. ESP m bo tnh b mt ca thng tin thng qua vic mt m gi tin IP. Tt c lu lng ESP u c mt m gia hai h thng. Vi c im ny th ESP c xu hng c s dng nhiu hn tng tnh bo mt cho d liu.

Cc giao thc AH v ESP c th c p dng mt mnh hay kt hp vi nhau cung cp tp cc giao thc an ninh mong mun trong IPv4 v IPv6, nhng cch chng cung cp cc dch v l khc nhau. i vi c hai giao thc ny, IPSec khng nh ngha cc thut ton an ninh c th, m thay vo l mt khung lm vic cho php s dng cc thut ton tiu chun. IPSec s dng cc thut ton m xc thc bn tin trn c s hm bm (HMAC), MD5 (Message Digest 5) hay SHA-1 thc hin chc nng ton vn bn tin; DES hay 3DES mt m d liu; kha chia s trc, ch k s RSA v s ngu nhin mt m RSA xc thc cc bn. Ngoi ra, cc chun cn nh ngha vic s dng mt s thut ton khc nh IDEA, Blowfish v RC4.

IPSec c th s dng giao thc trao i kho IKE (Internet Key Exchange) xc thc hai bn, thng lng cc chnh sch bo mt v xc thc thng qua vic xc nh thut ton thit lp knh truyn, trao i kha cho mi phin kt ni v dng trong mi phin truy nhp. Mng dng IPSec bo mt cc dng d liu c th t ng kim tra tnh xc thc ca thit b bng chng thc s ca hai ngi dng trao i thng tin qua li. Vic thng lng ny cui cng dn n thit lp mt lin kt an ninh (SA Security Association) gia cc cp bo mt. Lin kt an ninh SA c cha tp cc chnh sch, tham s, thut ton, giao thc cho qu trnh ng gi d liu gia cc bn tham gia vo phin IPSec. Ti mi u ng hm IPSec, SA c s dng xc nh loi lu lng cn c x l IPSec, giao thc an ninh c s dng (AH hay ESP), thut ton v kha c s dng cho qu trnh mt m v xc thc. Thng tin lin kt an ninh c lu trong c s d liu lin kt an ninh, v khi kt hp mt a ch ch vi giao thc an ninh th c duy nht mt SA.IPSec c pht trin nhm vo h giao thc IP k tip l IPv6, nhng do vic trin khai IPv6 cn chm v s cn thit phi bo mt cc gi IP nn IPSec c thay i cho ph hp vi IPv4. Vic h tr IPSec ch l tu chn ca IPv4 nhng i vi IPv6 th l c sn. IPSec l s la chn cho bo mt tng th cc VPN v l phng n ti u cho mng ca cng ty. N m bo truyn thng tin cy trn mng IP cng cng i vi cc ng dng VPN. 1.12 ng gi thng tin IPSec 1.12.1 Cc ch hot ngIPSec cung cp hai ch xc thc v m ha mc cao thc hin ng gi thng tin, l ch truyn ti (Transport Mode) v ch ng hm (Tunnel Mode). Sau y chng ta s xt n hai ch ny trc khi tm hiu v cc giao thc AH v ESP.1.12.1.1 Ch truyn tiTrong ch truyn ti, vn an ninh c cung cp bi cc giao thc lp cao trong m hnh OSI (t lp 4 tr ln). Ch ny bo v phn ti tin ca gi nhng vn phn tiu IP ban u dng gc nh trong nguyn bn (hnh 3.1). a ch IP ban u ny c s dng nh tuyn gi qua Internet.

Hnh 3.1 X l gi tin IP ch truyn tiCh truyn ti c u im l ch thm vo gi IP ban u mt s t byte. Nhc im ca ch ny l n cho php cc thit b trong mng nhn thy a ch ngun v ch ca gi tin v c th thc hin mt s x l (v d nh phn tch lu lng) da trn cc thng tin ca tiu IP. Tuy nhin nu d liu c mt m bi ESP th s khng bit c thng tin c th bn trong gi IP l g. Theo IETF th ch truyn ti ch c th c s dng khi hai h thng u cui IP-VPN c thc hin IPSec.

1.12.1.2 Ch ng hmTrong ch ng hm, ton b gi IP ban u bao gm c tiu c xc thc hoc mt m, sau c ng gi vi mt tiu IP mi (hnh 3.2). a ch IP bn ngoi c s dng cho nh tuyn gi IP qua Internet.

Hnh 3.2 X l gi tin IP ch ng hmCh ny cho php cc thit b mng nh b nh tuyn thc hin x l IPSec thay cho cc trm cui (host). Trong v d trn hnh 3.3, b nh tuyn A x l cc gi t trm A, gi chng vo ng hm. B nh tuyn B x l cc gi nhn c trong ng hm, a v dng ban u v chuyn chng ti trm B. Nh vy, cc trm cui khng cn thay i m vn c c tnh an ninh d liu ca IPSec. Ngoi ra, nu s dng ch ng hm, cc thit b trung gian trong mng s ch nhn thy c cc a ch hai im cui ca ng hm ( y l cc b nh tuyn A v B). Khi s dng ch ng hm, cc u cui ca IPSec-VPN khng cn phi thay i ng dng hay h iu hnh.

Hnh 3.3 Thit b mng thc hin IPSec trong ch ng hm1.12.2 Giao thc tiu xc thc AH

1.12.2.1 Gii thiu

Giao thc tiu xc thc AH c nh ngha trong RFC 1826 v sau pht trin li trong RFC 2402. AH cung cp kh nng xc thc ngun gc d liu (Data Origin Authentication), kim tra tnh ton vn d liu (Data Integrity) v dch v chng pht li (Anti-replay Service). n y, cn lm r hn hai khi nim ton vn d liu v chng pht li. Ton vn d liu l kim tra nhng thay i ca tng gi tin IP, khng quan tm n v tr cc gi trong lung lu lng. Cn dch v chng pht li l kim tra s pht lp li mt gi tin ti a ch ch nhiu hn mt ln. AH cho php xc thc cc trng ca tiu IP cng nh d liu ca cc giao thc lp trn. Tuy nhin, do mt s trng ca tiu IP thay i trong khi truyn v pha pht khng d on trc c gi tr ca chng khi ti pha thu, gi tr ca cc trng ny khng bo v c bng AH. C th ni AH ch bo v mt phn ca tiu IP m thi. AH khng cung cp bt c x l no bo mt d liu ca cc lp trn, tt c u c truyn di dng vn bn r. AH nhanh hn ESP, nn c th chn AH trong trng hp cn yu cu chc chn v ngun gc v tnh ton vn ca d liu, cn tnh bo mt d liu th khng yu cu cao.

Giao thc AH cung cp chc nng xc thc bng cch thc hin mt hm bm mt chiu (One-way Hash Function) i vi d liu ca gi to ra mt on m xc thc (Hash hay Message Digest). on m ny c chn vo thng tin ca gi truyn i. Khi , bt c thay i no i vi ni dung ca gi trong qu trnh truyn i u c pha thu pht hin khi n thc hin cng mt hm bm mt chiu i vi gi d liu nhn c v i chiu vi gi tr m xc thc truyn cng vi gi d liu. Hm bm c thc hin trn ton b gi d liu, tr mt s trng trong tiu IP c gi tr thay i trong qu trnh truyn (v d nh trng thi gian sng TTL ca gi tin).

1.12.2.2 Cu trc gi tin AH

Cc thit b s dng AH s chn mt tiu vo gia lu lng cn quan tm ca gi IP, gia phn tiu IP v tiu lp 4. Bi v AH c lin kt vi IPSec, IP-VPN c th nh dng chn lu lng no cn c bo v v lu lng no khng cn phi s dng gii php an ton gia cc bn. V d nh c th chn x l an ton lu lng email nhng khng cn i vi cc dch v web. Qu trnh x l chn tiu AH c minh ha trn hnh 3.4.

Hnh 3.4 Cu trc tiu AH cho gi tin IPSec ngha cc trng trong tiu AH nh sau:

Next Header (tiu tip theo). C di 8 bit nhn dng loi d liu ca phn ti tin theo sau AH. Gi tr ny c chn la t tp cc gi tr s giao thc IP c nh ngha bi IANA (TCP 6, UDP 17).

Payload Length ( di ti tin). C di 8 bit v cha di ca tiu AH c biu din trong cc t 32 bit, tr i 2. V d, trong trng hp ca thut ton ton vn mang li mt gi tr xc minh 96 bit (3 x 32 bit), cng vi 3 t 32 bit c nh, th trng di ny c gi tr l 4. Vi IPv6, tng di ca tiu phi l bi ca cc khi 8 bit.

Reserved (d tr). Trng 16 bit ny d tr cho ng dng trong tng lai. Gi tr ca trng ny c th t bng 0 v c tham gia trong vic tnh d liu xc thc. Security Parameters Index (SPI ch s thng s an ninh). Trng ny c di 32 bit, cng vi a ch IP ch v giao thc an ninh ESP cho php nhn dng duy nht SA cho gi d liu. Cc gi tr SPI t 1 n 255 c dnh ring s dng trong tng lai. SPI l trng bt buc v thng c la chn bi pha thu khi thit lp SA. Gi tr SPI bng 0 c s dng cc b v c th dng ch ra rng cha c SA no tn ti. Sequence Number (s th t). y l trng 32 bit khng du cha mt gi tr m khi mi gi c gi i th tng mt n v. Trng ny l bt buc v lun c a vo bi bn gi ngay c khi bn nhn khng s dng dch v chng pht li. B m bn gi v nhn c khi to ban u l 0, gi u tin c s th t l 1. Nu dch v chng pht li c s dng th ch s ny khng th lp li. Khi , trnh trng hp b m b trn v lp li cc s th t, s c mt yu cu kt thc phin truyn thng v mt SA mi c thit lp trc khi truyn gi th ca SA hin hnh. Authentication Data (d liu xc thc). Cn c gi l gi tr kim tra tnh ton vn ICV (Integrity Check Value), c di thay i v bng s nguyn ln ca 32 bit i vi IPv4 hay 64 bit i vi IPv6. N c th cha m lp y cho l bi s ca cc khi bit nh trn. ICV c tnh ton s dng thut ton xc thc, bao gm m xc thc bn tin (MAC Message Authentication Code). MAC n gin c th l thut ton m ha MD5 hoc SHA-1. Cc kha dng cho m ha AH l kha xc thc b mt c chia s gia cc i tng truyn thng, c th l mt s ngu nhin, khng th on trc c. Tnh ton ICV c thc hin i vi gi tin mi a vo. Bt k trng no c th bin i ca tiu IP u c ci t bng 0, d liu lp trn c gi s l khng bin i. Mi bn u cui VPN s tnh ton gi tr ICV ny mt cch c lp. Nu ICV tnh ton c pha thu v ICV do pha pht truyn n so snh vi nhau m khng ph hp th gi tin b loi b. Bng cch nh vy s m bo rng gi tin khng b gi mo.

1.12.2.3 X l AH trong ch truyn ti v ng hm Hot ng ca AH c thc hin qua cc bc nh sau:

Bc 1: Ton b gi IP (bao gm c tiu v ti tin) c thc hin qua mt hm bm mt chiu.

Bc 2: M bm thu c dng xy dng mt tiu AH, a tiu ny vo gi d liu ban u.

Bc 3: Gi d liu sau khi thm tiu AH c truyn ti i tc IPSec.

Bc 4: Bn thu thc hin hm bm vi tiu v ti tin IP, kt qu thu c mt m bm.

Bc 5: Bn thu tch m bm trong tiu AH.

Bc 6: Bn thu so snh m bm m n tnh c vi m bm tch ra t tiu AH. Hai m ny phi hon ton ging nhau. Nu chng khc nhau, bn thu lp tc pht hin tnh khng ton vn ca d liu.

Vic x l AH ph thuc vo ch hot ng ca IPSec v phin bn s dng ca giao thc IP. Khun dng ca gi tin IPv4 trc v sau khi x l AH trong hai ch truyn ti v ng hm c th hin trn hnh 3.5.

Hnh 3.5 Khun dng gi tin IPv4 trc v sau khi x l AH

Khun dng ca gi tin IPv6 trc v sau khi x l AH c th hin trn hnh 3.6.

Hnh 3.6 Khun dng gi tin IPv6 trc v sau khi x l AH1.12.3 Giao thc ng gi ti tin an ton ESP

1.12.3.1 Gii thiu

Giao thc ESP c nh ngha trong RFC 1827 v sau c pht trin thnh RFC 2408. Cng nh AH, giao thc ny c pht trin hon ton cho IPSec. ESP c s dng khi c yu cu v bo mt ca lu lng IPSec cn truyn. N cung cp tnh bo mt d liu bng vic mt m ha cc gi tin. Thm vo , ESP cng cho php xc thc ngun gc d liu, kim tra tnh ton vn d liu, dch v chng pht li v mt s gii hn v lung lu lng cn bo mt. Tp cc dch v cung cp bi ESP ph thuc vo cc la chn ti thi im thit lp lin kt an ninh, trong dch v bo mt c cung cp c lp vi cc dch v khc. Tuy nhin, nu khng kt hp s dng cc dch v xc thc v ton vn d liu th hiu qu bo mt s khng c m bo. Hai dch v xc thc v ton vn d liu lun i km nhau. Dch v chng pht li ch c th thc hin nu nh dch v xc thc c la chn.

Hnh 3.7 minh ha c ch ng gi ESP.

Hnh 3.7 C ch ng gi ESP

Hot ng ca ESP khc so vi AH. ESP ng gi tt c hoc mt phn d liu gc. Do h tr tt kh nng bo mt nn ESP c xu hng c s dng rng ri hn AH.

1.12.3.2 Cu trc gi tin ESP

Cu trc gi tin ESP c th hin trn hnh 3.8. Cc trng trong gi tin ESP c th l bt buc hay ty chn. Nhng trng bt buc lun c mt trong tt c cc gi ESP. Vic la chn mt trng ty chn c nh ngha trong qu trnh thit lp lin kt an ninh. Nh vy, khun dng ESP i vi mt SA l c nh trong khong thi gian tn ti ca SA .

Hnh 3.8 Khun dng gi ESP

Sau y l ngha ca cc trng trong cu trc gi tin ESP. SPI (ch s thng s an ninh). L mt s bt k 32 bit, cng vi a ch IP ch v giao thc an ninh ESP cho php nhn dng duy nht SA cho gi d liu. Cc gi tr SPI t 0 n 255 c dnh ring s dng trong tng lai. SPI l trng bt buc v thng c la chn bi pha thu khi thit lp SA. Sequence Number (s th t). Tng t nh trng s th t ca AH. Payload Data (d liu ti tin). y l trng bt buc, bao gm mt s lng bin i cc byte d liu gc hoc mt phn d liu yu cu bo mt c m t trong trng Next Header. Trng ny c m ha cng vi thut ton m ha la chn trong sut qu trnh thit lp SA. Nu thut ton yu cu cc vect khi to th n cng c bao gm y. Thut ton thng c dng m ha ESP l DES-CBC. i khi cc thut ton khc cng c h tr nh 3DES hay CDMF.

Padding (m). C nhiu nguyn nhn dn n s c mt ca trng m nh:

Nu thut ton mt m s dng yu cu bn r (Clear-text) phi l s nguyn ln cc khi byte (v d trng hp m khi) th trng m c s dng in y vo phn bn r ny (bao gm c Payload Data, Pad Length, Next Header v Padding) sao cho t ti kch thc theo yu cu. Trng m cng cn thit m bo phn d liu mt m (Cipher-text) s kt thc bin gii s nguyn ln ca 4 byte nhm phn bit r rng vi trng d liu xc thc (Authentication Data).

Ngoi ra, trng m cn c th s dng che du di thc ca ti tin, tuy nhin mc ch ny cn phi c cn nhc v n nh hng ti bng thng truyn dn.

Pad length ( di m). Trng ny xc nh s byte m c thm vo. Pad length l trng bt buc vi cc gi tr ph hp nm trong khong t 0 n 255 byte.

Next Header (tiu tip theo). Next Header l trng bt buc v c di 8 bit. N xc nh kiu d liu cha trong phn ti tin, v d mt tiu m rng (Extension Header) trong IPv6 hoc nhn dng ca mt giao thc lp trn khc. Gi tr ca trng ny c la chn t tp cc gi tr IP Protocol Number nh ngha bi IANA. Authentication Data (d liu xc thc). Trng ny c di bin i, cha mt gi tr kim tra tnh ton vn ICV tnh trn d liu ca ton b gi ESP tr trng Authentication Data. di ca trng ny ph thuc vo thut ton xc thc c s dng. Trng ny l ty chn, v ch c thm vo nu dch v xc thc c la chn cho SA ang xt. Thut ton xc thc phi ch ra di ICV, cc bc x l cng nh cc lut so snh cn thc hin kim tra tnh ton vn ca gi tin.

1.12.3.3 X l ESP trong ch truyn ti v ng hm Vic x l ESP ph thuc vo ch hot ng ca IPSec v phin bn s dng ca giao thc IP. Khun dng ca gi tin IPv4 trc v sau khi x l ESP trong hai ch truyn ti v ng hm c th hin trn hnh 3.9.

Hnh 3.9 Khun dng gi tin IPv4 trc v sau khi x l ESP

Khun dng ca gi tin IPv6 trc v sau khi x l ESP c th hin trn hnh 3.10.

Hnh 3.10 Khun dng gi tin IPv6 trc v sau khi x l ESP

IPSec c th h tr c AH v ESP trong mt t hp cho php ca hai ch truyn ti v ng hm. V d, c th s dng ch ng hm m ho v xc thc cc gi v tiu ca n ri gn AH hoc ESP, hoc c hai trong ch truyn ti bo mt cho tiu mi c to ra. AH v ESP khng th s dng chung trong ch ng hm bi v ESP c c ch tu chn xc thc. Tu chn ny c s dng trong ch ng hm khi cc gi cn phi m ho v xc thc.

1.12.3.4 M ha vi ESP

Cc thut ton m haCc thut ton mt m c xc nh bi SA. ESP lm vic vi cc thut ton mt m i xng. V cc gi IP c th n khng ng th t, nn mi gi phi mang thng tin cn thit pha thu c th thit lp ng b mt m (Cryptographic Synchronization) gii m. D liu ny c th c ch nh trong trng Payload, chng hn di dng cc vect khi to IV (Initialization Vector), hoc thu c t tiu ca gi. Vi s c mt ca trng Padding, cc thut ton mt m s dng vi ESP c th c cc c tnh khi (Block) hoc lung (Stream). V dch v mt m l ty chn nn thut ton mt m l khng bt buc.

Cc thut ton xc thc s dng tnh ICV c xc nh bi SA. i vi truyn thng im ti im, cc thut ton xc thc thch hp c th l hm bm mt chiu (MD5, SHA-1). V dch v xc thc l ty chn nn thut ton xc thc l khng bt buc.

Cc thut ton sau y c th c s dng vi ESP:

DES, 3DES trong ch CBC; HMAC vi MD5; HMAC vi SHA-1; Khng thut ton xc thc; Khng thut ton mt m.

Ngoi nhng thut ton k trn, mt s thut ton khc c th c h tr. Lu l t nht mt trong hai dch v mt m hoc xc thc phi c thc hin, do hai thut ton xc thc v mt m khng c ng thi khng c.

Qu trnh gii m

Nu ESP s dng mt m th s phi thc hin qu trnh gii m gi. Nu dch v mt m khng c s dng, ti pha thu khng c qu trnh gii m ny. Qu trnh gii m gi din ra nh sau:

Gii m ESP (bao gm trng Payload Data, Padding, Pad Length, Next Header) s dng kha. Thut ton mt m v kiu thut ton c xc nh bi SA.

X l phn m (Padding) theo c t ca thut ton. Pha thu cn tm v loi b phn m trc khi chuyn d liu gii m ln lp trn.

Xy dng li cu trc gi IP ban u t tiu IP gc v thng tin giao thc lp cao trong ti tin ca ESP ( ch truyn ti), hoc tiu IP ngoi v ton b gi IP gc trong ti tin ca ESP ( ch ng hm).

Nu dch v xc thc cng c la chn th qu trnh kim tra ICV v mt m c th tin hnh ni tip hoc song song. Nu tin hnh ni tip th kim tra ICV phi c thc hin trc. Nu tin hnh song song th kim tra ICV phi hon thnh trc khi gi gii m c chuyn ti bc x l tip theo. Trnh t ny gip loi b nhanh chng cc gi khng hp l.

Qu trnh gii m c th khng thnh cng v mt s l do nh sau:

SA c la chn khng ng (do cc thng s SPI, a ch ch hay trng Protocol Type b sai); di phn m hoc gi tr ca n b sai; Gi ESP mt m b li.

1.13 Lin kt an ninh v hot ng trao i kha

1.13.1 Lin kt an ninh

1.13.1.1 Cc kiu lin kt an ninh IPSec cung cp nhiu la chn thc hin cc gii php mt m v xc thc lp mng. Phn ny s nh ngha cc th tc qun l an ninh cho c IPv4 v IPv6 thc thi AH, ESP hoc c hai, ph thuc vo la chn ca ngi s dng. Khi thit lp kt ni IPSec, hai bn phi xc nh chnh xc cc thut ton no s c s dng, loi dch v no cn m bo an ninh. Sau bt u x l thng lng chn mt tp cc tham s v cc gii thut p dng cho m ha bo mt hay xc thc. Nh trn gii thiu, dch v bo mt quan h gia hai hay nhiu thc th tha thun truyn thng an ton c gi l lin kt an ninh SA.

Lin kt an ninh l mt kt ni n cng, ngha l vi mi cp truyn thng A v B c t nht hai SA (mt t A ti B v mt t B ti A). Khi lu lng cn truyn trc tip hai chiu qua VPN, giao thc trao i kha IKE thit lp mt cp SA trc tip v sau c th thit lp thm nhiu SA khc. Mi SA c mt thi gian sng ring. SA c nhn dng duy nht bi b ba gm c: ch s thng s an ninh (SPI), a ch IP ch v mt ch th giao thc an ninh (AH hay ESP). V nguyn tc, a ch IP ch c th l mt a ch n hng (Unicast), a ch qung b (Broadcast) hay a ch nhm (Multicast). Tuy nhin, c ch qun l SA ca IPSec hin nay ch c nh ngha cho nhng SA n hng.

Lin kt an ninh c hai kiu l truyn ti v ng hm, ph thuc vo ch ca giao thc s dng. SA kiu truyn ti l mt lin kt an ninh gia hai trm, hoc c yu cu gia hai h thng trung gian dc trn ng truyn. Trong trng hp khc, kiu truyn ti cng c th c s dng h tr IP-in-IP hay ng hm GRE qua cc SA kiu truyn ti. SA kiu ng hm l mt SA c bn c ng dng ti mt ng hm IP. SA gia hai cng an ninh l mt SA kiu ng hm in hnh, ging nh mt SA gia mt trm v mt cng an ninh. Tuy nhin, trong nhng trng hp m lu lng c nh hnh t trc nh nhng lnh SNMP, cng an ninh lm nhim v nh trm v kiu truyn ti c cho php.SA cung cp nhiu la chn cho cc dch v IPSec, n ph thuc vo giao thc an ninh c chn (AH hay ESP), kiu SA, im kt thc ca SA v mt s tuyn chn ca cc dch v ty bn trong giao thc s dng. V d nh khi s dng AH xc minh ngun gc d liu v tnh ton vn phi kt ni cho gi IP, c th s dng dch v chng pht li hoc khng ty thuc vo cc bn.

Khi mt bn IP-VPN mun gi lu lng IPSec ti u bn kia, n kim tra xem tn ti mt SA trong c s d liu hay cha hai bn c th s dng dch v an ninh theo yu cu. Nu tm thy mt SA tn ti, n SPI ca SA ny trong tiu IPSec, thc hin cc thut ton m ha v gi gi tin i. Bn thu s ly SPI, a ch ch, giao thc IPSec (AH hay ESP) v tm SA trong c s d liu ph hp x l gi tin . Lu rng vi mt u cui IP-VPN c th ng thi tn ti nhiu kt ni IPSec, v vy cng c ngha l tn ti nhiu SA.

1.13.1.2 Kt hp cc lin kt an ninhCc gi IP truyn qua mt SA ring bit c cung cp s bo v mt cch an ton bi giao thc an ninh, c th l AH hoc ESP nhng khng phi l c hai. i khi mt chnh sch an ninh c th cn n s kt hp ca cc dch v cho mt lung giao thng c bit m khng th thc hin c vi mt SA n l. Trong trng hp cn giao cho nhiu SA thc hin chnh sch an ninh theo yu cu. Thut ng cm SA c s dng ch mt chui cc SA c thit lp x l lu lng nhm tha mn mt tp chnh sch an ninh.

i vi kiu ng hm, c ba trng hp in hnh ca kt hp cc lin kt an ninh c trnh by sau y.C hai im cui ca cc SA u trng nhauMi ng hm bn trong hay ngoi l AH hay ESP, mc d Host 1 c th nh r c hai ng hm l nh nhau, tc l AH bn trong AH v ESP bn trong ESP (hnh 3.11).

Hnh 3.11 Kt hp cc SA kiu ng hm khi hai im cui trng nhau

Mt im cui ca cc SA trng nhaung hm bn trong hay bn ngoi c th l AH hay ESP (hnh 3.12).

Hnh 3.12 Kt hp cc SA kiu ng hm khi mt im cui trng nhau

Khng c im cui no ca cc SA trng nhauMi ng hm bn trong hay bn ngoi l AH hay ESP (hnh 3.13).

Hnh 3.13 Kt hp cc SA kiu ng hm khi khng c im cui trng nhau

Chi tit v kt hp cc SA c c trnh by trong RFC 2401.

1.13.1.3 C s d liu lin kt an ninhC hai c s d liu lin quan n an ninh l:

C s d liu chnh sch an ninh SPD (Security Policy Database) C s d liu lin kt an ninh SAD (Security Association Database).

SPD ch ra nhng dch v an ninh c ngh cho lu lng IP, ph thuc vo cc yu t nh ngun, ch, chiu i ra hay i vo. N cha ng mt danh sch nhng li vo chnh sch tn ti ring r cho lu lng i vo v i ra. Cc li vo ny c th xc nh mt vi lu lng khng qua x l IPSec, mt vi phi c loi b v cn li th c x l bi IPSec. Cc li vo ny l tng t cho firewall hay b lc gi.

SAD cha thng s v mi SA, ging nh cc tnh ton v kha AH hay ESP, s trnh t, kiu giao thc v thi gian sng ca SA. i vi x l i ra, mt li vo SPD tr ti mt li vo trong SAD v SAD s quyt nh SA no c s dng cho gi. i vi x l i vo, SAD c tham kho quyt nh gi c x l nh th no.

1.13.2 Hot ng trao i kha IKE

Kt ni IPSec ch c hnh thnh khi SA c thit lp. Tuy nhin bn thn IPSec khng c c ch thit lp SA. Chnh v vy, IETF chn phng n chia qu trnh thit lp kt ni IPSec ra lm hai phn: IPSec cung cp vic x l mc gi, cn IKMP (Internet Key Management Protocol) chu trch nhim tha thun cc lin kt an ninh. Sau khi cn nhc mt s phng n, trong c IKE (Internet Key Exchange), SKIP (Simple Key Internet Protocol) v Photuis, IETF quyt nh chn IKE l chun cu hnh SA cho IPSec.

Mt ng hm IPSec-VPN c thit lp gia hai bn qua cc bc nh sau:

Bc 1. Quyt nh lu lng no cn c quan tm bo v ti mt giao din yu cu thit lp phin thng tin IPSec; Bc 2. Thng lng ch chnh (Main Mode) hoc ch linh hot (Aggressive Mode) s dng IKE, kt qu l to ra lin kt an ninh IKE (IKE SA) gia cc bn IPSec; Bc 3. Thng lng ch nhanh (Quick Mode) s dng IKE, kt qu l to ra hai IPSec SA gia hai bn IPSec; Bc 4. D liu bt u truyn qua ng hm m ha s dng k thut ng gi ESP hay AH (hoc c hai); Bc 5. Kt thc ng hm IPSec-VPN (nguyn nhn c th l do IPSec SA kt thc, ht hn hoc b xa).

Tuy qu trnh thit lp kt ni gm bn bc, cc bc th hai v ba l quan trng hn c. Hai bc ny nh ra mt cch r rng rng IKE c tt c hai pha. Pha th nht s dng ch chnh hoc ch linh hot trao i gia cc bn, cn pha th hai c hon thnh nh s dng ch trao i nhanh (hnh 3.14).

Hnh 3.14 Cc pha v ch trao i kha IKE

Sau y chng ta s i xem xt c th cc bc v mc ch ca cc pha IKE.

1.13.2.1 Bc th nht

Vic quyt nh lu lng no cn bo v l mt phn trong chnh sch an ninh ca VPN. Chnh sch s c s dng quyt nh lu lng no cn bo v. Nhng lu lng khc khng cn bo v s c gi di dng bn r (Clear-text).

Chnh sch an ninh c phn nh trong mt danh sch truy nhp. Cc bn phi cha danh sch ging nhau, v c th c nhiu danh sch truy nhp cho nhng mc ch khc nhau gia cc bn. Nhng danh sch ny c gi l danh sch iu khin truy nhp ACL (Access Control List). N n gin l danh sch truy nhp IP m rng ca cc b nh tuyn s dng bit lu lng no cn mt m. ACL lm vic da vo cc cu lnh khc nhau l Permit (cho php) v Deny (t chi). Hnh 3.15 trnh by hot ng iu khin truy nhp mt m theo ACL khi thc hin cc lnh Permit v Deny ti ngun v ch.

Hnh 3.15 Hot ng iu khin truy nhp mt m theo ACL

Cc t kha Permit v Deny c ngha khc nhau gia thit b ngun v ch. Ti bn ngun ngha ca chng nh sau: Permit: chuyn lu lng ti IPSec xc thc, mt m ha hoc c hai. IPSec thay i gi tin bng cch chn tiu AH hoc ESP, c th mt m mt phn hoc tt c gi tin ngun v truyn chng ti bn ch.

Deny: cho qua lu lng v a cc gi tin bn r ti bn nhn.

Ti bn ch ngha ca cc t kha Permit v Deny nh sau:

Permit: chuyn lu lng ti IPSec xc thc, gii m hoc c hai. ACL s dng thng tin trong tiu quyt nh. Trong logic ca ACL, nu nh tiu cha ngun, ch, giao thc ng th gi tin c x l bi IPSec ti pha gi v nh vy phi c x l pha thu.

Deny: cho qua vi gi s rng lu lng c gi dng bn r.

Khi nhng t kha Permit v Deny c s dng kt hp mt cch chnh xc gia ngun v ch, d liu c truyn v bo v thnh cng. Khi chng khng kt hp chnh xc, d liu s b loi b. 1.13.2.2 Bc th hai

Bc th hai ny chnh l hot ng IKE pha mt. Mc ch ca pha ny l:

Thng lng mt tp cc tham s c s dng xc thc hai bn v mt m mt phn ch chnh, cn ton b trao i thc hin trong ch nhanh. Khng c bn tin no ch linh hot c mt m nu ch linh hot c s dng thng lng.

Hai bn tham gia VPN xc thc vi nhau.

To kha s dng lm tc nhn sinh ra kha m v m ha d liu ngay sau khi vic thng lng kt thc.

Tt c thng tin thng lng trong ch chnh hay linh hot, bao gm kha s dng sau to kha cho qu trnh mt m d liu, c lu vi tn gi l lin kt an ninh IKE hay ISAKMP (Internet Security Association and Key Management Protocol). Bt k bn no trong hai bn cng ch c mt lin kt an ninh ISAKMP.

Hnh 3.16 IKE pha mt s dng ch chnh

Ch chnh c 6 trao i bn tin (3 trao i hai chiu) gia bn khi to v bin nhn (hnh 3.16). Trao i th nht. Cc thut ton mt m v xc thc (s dng bo v cc trao i IKE) s c thng lng v tha thun gia cc i tc.

Trao i th hai. S dng trao i Diffie-Hellman to kha b mt chia s (shared secret keys), trao i cc s ngu nhin (nonces) khng nh xc thc ca mi i tc. Kha b mt chia s c s dng to ra tt c cc kha bo mt v xc thc khc.

Trao i th ba. Kim tra xc thc cc bn (i tc). Kt qu ca ch chnh l to ra mt ng truyn thng an ton cho cc trao i tip theo gia hai i tc.

Ch nhanh thc hin 3 trao i bn tin. Hu ht cc hot ng u c thc hin trong trao i th nht: tha thun cc tp chnh sch IKE, to kha cng cng Diffie-Hellman, v mt gi xc thc c th s dng xc thc thng qua mt bn th ba. Bn nhn gi tr li mi th cn thit hon thnh vic trao i. Cui cng bn khi to khng nh vic trao i.

Cc tp chnh sch IKE

Khi thit lp mt kt ni VPN an ton gia hai trm A v B thng qua Internet, mt ng hm c thit lp gia cc b nh tuyn A v B. Thng qua ng hm, cc giao thc mt m, xc thc v mt s giao thc khc c tha thun. Thay v phi tha thun tng giao thc mt, cc giao thc c nhm thnh cc tp v c gi l tp chnh sch IKE (IKE Policy Set). Cc tp chnh sch IKE c trao i trong IKE pha mt, trao i th nht. Nu mt chnh sch thng nht c tm thy hai pha th trao i c tip tc. Nu khng tm thy chnh sch thng nht no, ng hm s b loi b. V d, b nh tuyn A gi cc tp chnh sch IKE Policy 10 v 20 ti B. B nh tuyn B so snh tp chnh sch ca n, IKE Policy 15, vi cc tp chnh sch nhn c t A. Trong trng hp ny, mt chnh sch thng nht c tm thy: IKE Policy 10 ca b nh tuyn A v IKE Policy 15 ca b nh tuyn B l tng ng. Trong ng dng im-im, mi bn ch cn nh ngha mt tp chnh sch IKE. Tuy nhin mng trung tm c th phi nh ngha nhiu chnh sch IKE p ng nhu cu ca tt c cc i tc t xa.

Trao i kha Diffie-Hellman

Trao i kha Diffie-Hellman l phng php mt m kha cng khai cho php hai bn thit lp mt kha b mt chung qua mt mi trng truyn thng khng an ton. C 7 thut ton hay nhm Diffie-Hellman c nh ngha (DH 1(7). Trong IKE pha mt, cc bn phi tha thun nhm Diffie-Hellman c s dng. Khi hon tt vic tha thun nhm, kha b mt chung s c tnh.

Xc thc i tc

Trao i cui cng ca IKE pha mt c mc ch l xc thc i tc, ngha l kim tra xem ai ang pha bn kia ca ng hm VPN. Cc thit b hai u ng hm VPN phi c xc thc trc khi ng truyn thng c coi l an ton. C ba phng php h tr vic xc thc ngun gc d liu l s dng kha chia s trc, ch k s RSA v s ngu nhin mt m RSA.

1.13.2.3 Bc th ba

Bc th ba chnh l IKE pha hai. Mc ch ca pha ny l tha thun cc thng s an ninh IPSec s dng cho vic bo v ng hm. Ch c mt ch nhanh c s dng cho IKE pha hai. IKE pha hai thc hin cc chc nng sau:

Tha thun cc thng s an ninh IPSec, cc tp chuyn i IPSec; Thit lp cc lin kt an ninh IPSec; nh k tha thun li IPSec SA m bo tnh an ninh ca ng hm; Thc hin mt trao i Diffie-Hellman b sung (cc SA v kha mi c to ra, lm tng tnh an ninh cho ng hm).

Ch nhanh cng c s dng tha thun li mt lin kt an ninh mi khi lin kt an ninh c ht hn. Khi cc bn c th khng cn quay tr li bc th hai na m vn m bo thit lp mt SA cho phin truyn thng mi.

Cc tp chuyn i IPSec

Mc ch cui cng ca IKE pha hai l thit lp mt phin IPSec an ton gia hai im cui VPN. Trc khi thc hin c iu , mi cp im cui ln lt tha thun mc an ninh cn thit (v d cc thut ton xc thc v mt m dng trong phin). Thay v phi tha thun ring tng giao thc hay thut ton n l, cc giao thc v thut ton ny c nhm thnh cc tp, gi l tp chuyn i IPSec (Transform Set). Cc tp chuyn i ny c trao i gia hai pha trong ch nhanh. Nu tm thy mt tp chuyn i tng ng hai pha th qu trnh thit lp phin tip tc, ngc li th phin s b loi b.

Hnh 3.17 Trao i cc tp chuyn i IPSec

Trn hnh 3.17 l v d v vic trao i cc tp chuyn i IPSec. B nh tuyn A gi tp chuyn i 30 v 40 ti B, b nh tuyn B kim tra thy tp chuyn i 50 ph hp vi tp chuyn i 30 ca A, cc thut ton xc thc v mt m trong cc tp chuyn i ny hnh thnh mt lin kt an ninh.

Thit lp lin kt an ninh

Khi mt tp chuyn i c thng nht gia hai bn, mi thit b IP-VPN s a thng tin ny vo mt c s d liu. Thng tin ny c bit n nh l mt lin kt an ninh SA. Thit b IP-VPN sau s nh s mi SA bng mt ch s SPI. Khi c yu cu gi gi tin gia hai u VPN, cc thit b s da vo a ch i tc, cc ch s SPI, thut ton IPSec c dng x l gi tin trc khi truyn trong ng hm.

Thi gian sng ca mt lin kt an ninh

Thi gian sng ca mt lin kt an ninh cng ln th cng c nhiu kh nng mt an ton. m an ton cho phin truyn thng th cc kha v cc SA phi c thay i thng xuyn. C hai cch tnh thi gian sng ca SA l theo s lng d liu c truyn i v theo giy. Cc kha v SA c hiu lc cho n khi ht thi gian tn ti ca SA hoc n khi ng hm b ngt, khi SA b xa b.

1.13.2.4 Bc th t

Sau khi hon thnh IKE pha hai v ch nhanh thit lp lin kt an ninh IPSec SA, lu lng c th c trao i gia cc bn IP-VPN thng qua mt ng hm an ton (hnh 3.18). Qu trnh x l gi tin (m ha, mt m, ng gi) ph thuc vo cc thng s c thit lp ca SA.

Hnh 3.18 ng hm IPSec c thit lp

1.13.2.5 Kt thc ng hmCc lin kt an ninh IPSec SA kt thc khi b xa b hoc ht thi gian tn ti. Khi cc bn IP-VPN khng s dng cc SA ny na v bt u gii phng c s d liu ca SA. Cc kha cng b loi b. Nu thi im ny cc bn IP-VPN vn cn mun trao i thng tin vi nhau th mt IKE pha hai mi s c thc hin. Trong trng hp cn thit th cng c th thc hin li t IKE pha mt. Thng thng, m bo tnh lin tc ca thng tin th cc SA mi c thit lp trc khi cc SA c ht hn.

1.14 Mt s vn k thut trong thc hin VPN trn nn IPSec IPSec s dng nhiu giao thc v k thut ang tn ti m ha, xc thc d liu v trao i kha. iu ny lm cho IPSec tr thnh tiu chun ph bin trong cc ng dng m bo an ninh thng tin nh VPN. Sau y trnh by khi qut v mt s giao thc v k thut mt m, m bo ton vn thng tin, xc thc cc bn cng nh l qun l v trao i kha. y l nhng k thut c bn c lin quan cht ch n vic thc hin VPN trn nn IPSec.

1.14.1 Mt m

C th m