Cisco IPv6安全指南：Scott Hogg与Eric Vyncke合作作品 - CSDN文库

需积分: 9 45 浏览量更新于2024-07-28 收藏 8.19MB PDF 举报

《Cisco IPv6 Security》是由Scott Hogg和Eric Vyncke合著的专业书籍，由Cisco Press出版。这本书是针对Cisco网络环境中IPv6安全的关键指南，它是在2009年首次印刷，版权归属于Cisco Systems, Inc.。该书的主要目标是帮助读者理解和实施IPv6网络的安全措施，随着IPv6在全球范围内的部署，网络安全变得尤为重要，因为它提供了更广阔的地址空间，同时也带来了新的安全挑战。书中内容涵盖了广泛的IPv6安全主题，包括但不限于： 1. **IPv6网络基础知识**：首先，读者将学习IPv6协议的基础知识，理解其与IPv4的区别，以及它如何支持更大的地址空间和更高效的数据传输。 2. **安全威胁分析**：书中详细阐述了IPv6引入的新安全威胁，如地址空间的无限性可能导致的地址欺骗、路由攻击和中间人攻击等，以及针对这些威胁的防护措施。 3. **安全架构设计**：对于网络管理员，章节将介绍如何设计和实现IPv6安全架构，包括使用IPsec（IP Security）进行加密通信，实现身份验证和数据完整性，以及防止DoS和DDoS攻击。 4. **证书和密钥管理**：书中涉及如何管理和分发IPv6证书，确保通信双方的身份验证，以及如何处理公钥基础设施（PKI）在IPv6环境中的角色。 5. **认证和授权**：讨论各种认证机制，如EAP-TLS、EAP-PEAP等，以及如何实现用户和设备的准入控制。 6. **网络监控与日志记录**：介绍如何通过工具和技术来检测和应对IPv6网络中的异常行为，以及维护有效的审计和事件记录。 7. **标准和最佳实践**：书中还涵盖了当前和未来的IPv6安全标准，如RFCs，以及业界的最佳安全配置和策略建议。 8. **案例研究和实战指导**：作者通过实际案例，展示如何在实际网络环境中应用这些理论知识，帮助读者掌握解决方案的实施步骤。《Cisco IPv6 Security》是一本实用的参考书籍，不仅适合网络管理员和安全专业人员，也对IT决策者和准备升级到IPv6的组织具有参考价值。阅读这本书，可以帮助读者充分理解并应对IPv6时代的网络安全挑战，确保网络的可靠性和安全性。

ptg

xv

Internet Key Exchange (IKE) 322

IKE Version 2 324

IPsec with Network Address Translation 324

IPv6 and IPsec 325

Host-to-Host IPsec 326

Site-to-Site IPsec Configuration 328

IPv6 IPsec over IPv4 Example 329

Configuring IPv6 IPsec over IPv4 329

Verifying the IPsec State 332

Adding Some Extra Security 337

Dynamic Crypto Maps for Multiple Sites 338

IPv6 IPsec Example 339

Configuring IPsec over IPv6 340

Checking the IPsec Status 343

Dynamic Multipoint VPN 349

Configuring DMVPN for IPv6 351

Verifying the DMVPN at the Hub 353

Verifying the DMVPN at the Spoke 359

Remote Access with IPsec 361

SSL VPNs 368

Summary 373

References 374

Chapter 9 Security for IPv6 Mobility 377

Mobile IPv6 Operation 378

MIPv6 Messages 379

Indirect Mode 381

Home Agent Address Determination 381

Direct Mode 382

Threats Linked to MIPv6 385

Protecting the Mobile Device Software 386

Rogue Home Agent 386

Mobile Media Security 386

Man-in-the-Middle Threats 387

Connection Interception 388

Spoofing MN-to-CN Bindings 389

DoS Attacks 390

Using IPsec with MIPv6 390

ptg

xix

Introduction

Internet Protocol version 6 (IPv6) is the next version of the protocol that is used for communications on

the Internet. IPv6 is a protocol that has been in existence for many years, but it has not yet replaced

IPv4. IPv4 has some limitations that were not anticipated when it was ﬁrst created. Because IPv6 over-

comes many of these limitations, it is the only viable long-term replacement for IPv4.

While the migration to IPv6 has started, it is still in its early stages. Many international organizations

already have IPv6 networks, the U.S. federal organizations are working on their transitions to IPv6, and

others are contemplating what IPv6 means to them. However, many organizations already have IPv6

running on their networks and they do not even realize it. Many computer operating systems now

default to running both IPv4 and IPv6, which could cause security vulnerabilities if one is less secure

than the other. IPv6 security vulnerabilities currently exist, and as the popularity of the IPv6 protocol

increases, so do the number of threats.

When a security ofﬁcer wants to secure an organization, he must be aware of all potential threats, even if

this threat is a ten-year-old protocol that represents less than 1 percent of the overall Internet trafﬁc in

2008. Don’t be blinded by this 1 percent: This ﬁgure is doomed to increase in the coming years, and

chances are good that your network is already exposed to some IPv6 threats. It’s better to be safe than

sorry.

Just like the early deployment of many technologies, security is often left to the ﬁnal stages of imple-

mentation. Our intent in writing this book is to improve the security of early IPv6 deployments from day

one. Any organization considering or already in the midst of transitioning to IPv6 does not want to

deploy a new technology that cannot be secured right from the outset. The transition to IPv6 is inevita-

ble, and therefore this book can help you understand the threats that exist in IPv6 networks and give you

ways to protect against them. Therefore, this book gives guidance on how to improve the security of

IPv6 networks.

Goals and Methods

Currently, many organizations have slowed their migration to IPv6 because they realize that the security

products for IPv6 might be insufﬁcient, despite the fact that the network infrastructure is ready to sup-

port IPv6 transport. They realize that they cannot deploy IPv6 without ﬁrst considering the security of

this new protocol. This book intends to survey the threats against IPv6 networks and provide solutions

to mitigate those threats. It covers the issues and the best current practices.

This book is arranged so that it covers the threats ﬁrst and then describes ways to combat these threats.

By outlining all the risks and showing that a solution exists for each threat, you can feel more comfort-

able with continuing the transition to IPv6. You learn about techniques attackers might use to breach

your networks and what Cisco products to use to protect the networks.

However, showing attacks without solutions is socially irresponsible, so the focus is on the current tech-

niques that are available to make the IPv6 network more secure and on the best current practices.

By reading this book, you can gain an understanding of the full range of IPv6 security topics.

剩余564页未读，继续阅读

xyjcn85

粉丝: 1
资源: 115

最新资源