Đang chuẩn bị nút TẢI XUỐNG, xin hãy chờ
Tải xuống
This design guide evaluates Cisco VPN product performance in scalable and resilient site-to-site VPN topologies, using Cisco VPN routers running Cisco IOS Software, with IPsec as the tunneling method. The concepts presented can also be applied to other Cisco products that do not run Cisco IOS software. This design guide begins with an overview, followed by design recommendations and product selection and performance information. Finally, partial configuration examples are presented. The chart in Figure 1shows the IPsec VPN WAN architecture documentation, which is divided into multiple design guides based on the technologies used. Each technology uses IPsec as the underlying transport. | IPsec Direct Encapsulation VPN Design Guide This design guide provides guidelines and best practices for customer deployments of IP Security IPsec direct encapsulation VPNs. It is assumed that the reader has a basic understanding of IPsec. Contents Introduction 3 Design Overview 4 Design Components 5 Best Practices and Known Limitations 6 Best Practices Summary 6 Known Limitations Summary 7 Design and Implementation 8 IPsec Direct Encapsulation Deployment 8 Dead Peer Detection 10 Reverse Route Injection 10 Dynamic Crypto Maps 10 Tunnel Initiation 11 VPN High Availability 11 Configuration and Implementation 12 ISAKMP Policy Configuration 12 Dead Peer Detection 13 Reverse Route Injection 14 Static Route Redistribution 14 VPN High Availability IPsec Failover 15 HA Design Example 15 Hot Standby Router Protocol 16 Cisco Systems Corporate Headquarters Cisco Systems Inc. 170 West Tasman Drive San Jose CA 95134-1706 USA Copyright 2006 Cisco Systems Inc. All rights reserved. Contents Stateless Failover without HSRP 16 Stateful Failover 17 Stateless Failover with HSRP Configuration 17 Quality of Service 18 IP Multicast 19 Interactions with Other Networking Functions 19 Network Address Translation and Port Address Translation 19 Dynamic Host Configuration Protocol 19 Firewall Considerations 19 Common Configuration Errors 21 Crypto Peer Address Matching Using PSK 21 Transform Set Matches 21 ISAKMP Policy Matching 21 Scalability Considerations 21 General Scalability Considerations 22 IPsec Encryption Throughput 22 Packets Per Second The Most Important Factor 22 Tunnel Quantity Affects Throughput 23 Headend Scalability 23 Sizing the Headend 23 Tunnel Aggregation Scalability 24 Aggregation Scalability 24 Customer Requirement Aggregation Scalability Case Studies 24 Branch Office Scalability 26 Scalability Test Results Unicast Only 27 Scalability Test Methodology 27 Overview 27 Headend Scalability Test Results 29 Branch Office Scalability Test Results 30 Scalability Test Results .
