32 · Introducing WAN TechnologiesWAN 技術

Enterprise-Managed VPNs企業自管 VPN

When an enterprise designs VPN connectivity, there are two deployment modes that are usually implemented: site-to-site VPNs and remote-access VPNs.

企業在設計 VPN 連線時，通常會實作兩種部署模式：站對站 VPN 與遠端存取 VPN。

Here are the two deployment modes in enterprise-managed VPNs:

以下是企業自管 VPN 中的兩種部署模式：

  • Site-to-siteVPNs connect entire networks to each other, such as connecting branch offices, home offices, or business partners networks to the main office network. Each site has a VPN capable device, called VPN gateway. Routers, firewalls, and other security appliances, such as the Cisco Adaptive Security Appliance (ASA), can act as VPN gateways. The VPN gateways establish the connection between themselves. VPN gateways have static VPN configurations and are "aware" of the VPN tunnel established between them. End hosts are not aware of the tunneling. They send and receive normal traffic. The traffic that must be "placed" into the tunnel passes through a VPN gateway, which cryptographically processes it if required, encapsulates it, and sends it through the tunnel to the peer VPN gateway. The peer VPN gateway strips the headers, verifies, and decrypts the content and relays the packet toward the destination end host within its inside network. The destination host receives the normal traffic, again, unaware of tunneling that happened.站對站VPN 用於連接完整網路，例如連接分公司、家庭辦公室或合作夥伴網路至總公司網路。每個據點都有一台具備 VPN 能力的裝置，稱為 VPN 閘道。路由器、防火牆及其他安全設備，例如 Cisco 調適型安全設備（ASA），皆可作為 VPN 閘道。VPN 閘道之間建立連線。VPN 閘道採靜態 VPN 組態設定，並「知道」彼此之間建立的 VPN 通道。終端主機則不知道有通道處理，它們只會傳送與接收一般流量。需要「放入」通道的流量會經過 VPN 閘道，由其視需要進行加密處理、封裝，並透過通道傳送至對等 VPN 閘道。對等 VPN 閘道會剝除標頭、驗證並解密內容，再將封包轉送至其內部網路中的目的終端主機。目的主機收到的是一般流量，同樣不會察覺曾經過通道處理。
  • Remote-accessVPNs are used to connect individual hosts to remote networks over the internet. These VPNs support the need of telecommuters, mobile users, and enterprise customers to access remote networks and applications. Individual hosts typically connect to internet via broadband connections. To establish VPNs, end hosts use VPN client software or a web-based client, such as an SSL-enabled web browser. On the remote side, the end host connects to a VPN server device. The end-host data is encrypted by the client software, sent over the internet to the VPN gateway, where it is decapsulated, decrypted and relayed to the appropriate host inside its network. Remote-access VPNs are not statically set up. They are dynamic and can be set up when required.遠端存取VPN 用於透過網際網路將個別主機連接至遠端網路。此類 VPN 可滿足電傳工作者、行動使用者及企業客戶存取遠端網路與應用程式的需求。個別主機通常透過寬頻連線連上網際網路。要建立 VPN，終端主機需使用 VPN 用戶端軟體或網頁式用戶端，例如啟用 SSL 的網頁瀏覽器。在遠端一側，終端主機連接至一台 VPN 伺服器裝置。終端主機的資料由用戶端軟體加密後，透過網際網路傳送至 VPN 閘道，於該處解封裝、解密，再轉送至其網路內的適當主機。遠端存取 VPN 並非靜態設定，而是動態的，可視需要建立。

Site-to-site VPN options in use today are:

目前使用中的站對站 VPN 選項包括：

  • IPsec tunnel:IPsec is a framework of open standards that spells out the rules for secure communications. IPsec relies on existing algorithms to implement cryptographic functions. The framework allows technologies to be replaced over time. When cryptographic technologies become obsolete, it does not make the IPsec framework obsolete. Current technologies are swapped to replace the obsolete ones, keeping the framework in place. The IPsec framework provides a tunnel mode of operation, which enables you to use it as a standalone connection method. This option is the most fundamental IPsec VPN design model. IPsec provides security services to VPN tunnels.IPsec 通道：IPsec 是一套開放標準框架，規範了安全通訊的規則。IPsec 依賴既有演算法來實作加密功能。此框架允許技術隨時間更替；當加密技術過時，並不會使 IPsec 框架本身過時，只需將過時的技術替換為當前技術，框架仍維持不變。IPsec 框架提供通道模式的運作方式，讓您能將其作為獨立的連線方法使用。此選項是最基本的 IPsec VPN 設計模式。IPsec 為 VPN 通道提供安全服務。
  • Generic Routing Encapsulation (GRE) over IPsec: Although IPsec provides a secure method for tunneling data across an IP network, it has limitations. IPsec does not support IP broadcast or IP multicast, for example, it cannot be used when exchanging messages from protocols that rely on these features, such as routing protocols. IPsec also does not support the use of non-IP protocols. GRE is a tunneling protocol developed by Cisco that can encapsulate a wide variety of network layer protocol packet types, such as IP broadcast or IP multicast, and non-IP protocols, inside IP tunnels but it does not support encryption. Using GRE tunnels with IPsec will give you the ability to securely run routing protocol, IP multicast, or multiprotocol traffic across the network between the remote locations.通用路由封裝（GRE）over IPsec：雖然 IPsec 提供了一種在 IP 網路上建立安全通道傳輸資料的方法，但它也有其限制。例如，IPsec 不支援 IP 廣播或 IP 群播，因此無法用於交換依賴這些功能的通訊協定訊息，例如路由通訊協定；IPsec 也不支援非 IP 通訊協定的使用。GRE 是 Cisco 開發的一種通道通訊協定，可將多種網路層通訊協定封包類型（例如 IP 廣播或 IP 群播）及非 IP 通訊協定封裝於 IP 通道內，但本身不支援加密。將 GRE 通道搭配 IPsec 使用，即可讓您在遠端據點之間的網路上安全地執行路由通訊協定、IP 群播或多重通訊協定流量。
  • With a generic hub-and-spoke topology, you can typically implement static tunnels (typically GRE over IPsec) between the central hub and remote spokes. When you want to add a new spoke to the network, you need to configure it on the hub router. Also, the traffic between spokes has to traverse the hub, where it must exit one tunnel and enter another. Static tunnels may be an appropriate solution for small networks, but this solution becomes unacceptable as the number of spokes grows larger.Cisco Dynamic Multipoint Virtual Private Network (DMVPN) is a Cisco proprietary software solution that simplifies the device configuration when there is a need for many VPN connections. With Cisco DMVPN, a hub-and-spoke topology is first implemented. The configuration of this network is facilitated by a multipoint GRE tunnel interface, established on the hub. Multipoint in the name signifies that a single GRE interface can support multiple IPsec tunnels. The hub is a permanent tunnel source. The size of the configuration on the hub router remains constant even if you add more spoke routers to the network. The spokes are configured to establish a VPN connection with the hub. After building the hub-and-spoke VPNs, the spokes can obtain information about other spokes from the hub and establish direct spoke-to-spoke tunnels.在一般的軸輻式拓樸中，您通常可以在中央樞紐與遠端分支之間實作靜態通道（通常是 GRE over IPsec）。當您想新增一個分支到網路中時，需要在樞紐路由器上進行組態設定。此外，分支之間的流量必須經過樞紐，並在該處退出一個通道、進入另一個通道。靜態通道對小型網路而言可能是合適的解決方案，但隨著分支數量增加，此方案便會變得不可行。Cisco 動態多點虛擬私人網路（DMVPN）是一種 Cisco 專有的軟體解決方案，可在需要建立大量 VPN 連線時簡化裝置組態設定。使用 Cisco DMVPN 時，會先實作軸輻式拓樸。此網路的組態設定是透過在樞紐上建立的多點 GRE 通道介面來達成的。名稱中的「多點」表示單一 GRE 介面可支援多個 IPsec 通道。樞紐作為永久性的通道來源，即使網路中新增更多分支路由器，樞紐路由器上的組態設定量仍維持不變。分支則組態設定為與樞紐建立 VPN 連線。在建立軸輻式 VPN 之後，各分支可從樞紐取得其他分支的資訊，並建立直接的分支對分支通道。
  • IPsec virtual tunnel interface (VTI): IPsec VTI is a feature that associates an IPsec tunnel endpoint with a virtual interface. Traffic is encrypted or decrypted when it is forwarded from or to the tunnel interface and is managed by the IP routing table. Using IP routing to forward the traffic to the tunnel interface simplifies the IPsec VPN configuration compared to the conventional process, allowing for the flexibility of sending and receiving both IP unicast and multicast encrypted traffic on any physical interface. The IPsec tunnel protects the routing protocol and multicast traffic, like with GRE over IPsec, but without the need to configure GRE. Keep in mind that all traffic is encrypted and that it supports, like standard IPsec, only one protocol (IPv4 or IPv6), which allows for the flexibility of sending and receiving both IP unicast and multicast encrypted traffic on any physical interface, such as in the case of multiple paths.IPsec 虛擬通道介面（VTI）：IPsec VTI 是一種將 IPsec 通道端點與虛擬介面相關聯的功能。流量在轉送進出通道介面時會被加密或解密，並由 IP 路由表管理。利用 IP 路由將流量轉送至通道介面，相較於傳統程序可簡化 IPsec VPN 組態設定，並可在任一實體介面上靈活收發 IP 單播與群播加密流量。與 GRE over IPsec 相同，IPsec 通道可保護路由通訊協定與群播流量，但無需組態設定 GRE。請注意，所有流量皆會被加密，且與標準 IPsec 相同，僅支援一種通訊協定（IPv4 或 IPv6），這使其能在任一實體介面（例如多路徑情況）上靈活收發 IP 單播與群播加密流量。
  • Cisco IOS FlexVPN: Cisco IOS FlexVPN is a unified VPN solution and provides several benefits:Cisco IOS FlexVPN：Cisco IOS FlexVPN 是一套統一的 VPN 解決方案，提供以下幾項優點：
    • Transport network: FlexVPN can be deployed either over a public internet or a private MPLS VPN network.傳輸網路：FlexVPN 可部署於公共網際網路或私有 MPLS VPN 網路之上。
    • Deployment style: Designed for the concentration of both site-to-site and remote access VPNs, one single FlexVPN deployment can accept both types of connection requests at the same time.部署方式：設計用於集中處理站對站與遠端存取 VPN，單一 FlexVPN 部署即可同時接受這兩種類型的連線請求。
    • Failover redundancy: Three different kinds of redundancy models can be implemented with FlexVPN.容錯備援：FlexVPN 可實作三種不同的備援模式。
    • Third-party compatibility: It provides compatibility with any IKEv2-based third-party VPN vendors, including native VPN clients from Apple IOS and Android devices.第三方相容性：與任何基於 IKEv2 的第三方 VPN 廠商相容，包括 Apple iOS 與 Android 裝置的原生 VPN 用戶端。
    • IP Multicast support: FlexVPN natively supports IP Multicast.IP 群播支援：FlexVPN 原生支援 IP 群播。
    • Superior QoS: The architecture of Cisco IOS FlexVPN easily allows hierarchical QoS to be integrated at the per tunnel or per (Security Association) SA basis.優異的 QoS：Cisco IOS FlexVPN 的架構可輕鬆整合階層式 QoS，並可依每條通道或每個（安全關聯）SA 為基礎進行設定。
    • Centralized policy control: VPN dynamic policies can be fully integrated with the authentication, authorization, and accounting (AAA) RADIUS server and applied at a per peer basis.集中式政策控管：VPN 動態政策可與驗證、授權及記帳（AAA）RADIUS 伺服器完全整合，並依每個對等體為基礎套用。
    • VRF awareness: The Cisco IOS FlexVPN solution can be fully integrated with MPLS VPN networks for service provider type of deployment.VRF 感知能力：Cisco IOS FlexVPN 解決方案可與 MPLS VPN 網路完全整合，適用於服務供應商類型的部署。
Match the VPN term with its correct description.請將 VPN 術語與其正確描述配對。
IPsec VPNIPsec VPNa client in remote-access VPN遠端存取 VPN 中的用戶端
SSL enabled browser啟用 SSL 的瀏覽器a site-to-site VPN solution that enables secure exchange of broadcast and multicast traffic.一種可安全交換廣播與群播流量的站對站 VPN 解決方案。
Firewall防火牆cryptographic VPN加密型 VPN
Cisco DMVPNCisco DMVPNa device that can act as VPN gateway, to terminate VPNs.一種可作為 VPN 閘道以終止 VPN 連線的裝置。
GRE over IPsec VPNGRE over IPsec VPNa site-to-site VPN solution that implements hub-and-spoke topology and facilitates establishment of direct spoke-to-spoke connections.一種採用軸輻式拓樸並促成分支對分支直接連線建立的站對站 VPN 解決方案。