Tunneling architectures are great. Again, we can connect two disparate networks
to one another across an underlay.
If we think about it, this could be a headquarters network on the left and a
branch office on the right.
We want to make sure that they can communicate as if the branch was directly
connected to the headquarters.
The problem is how do we bridge this gap?
We could go out, we could purchase service provider links, old school, it would
maybe be a T1 or an E1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
maybe be a T1 or an E1.
These days we could use MPLS, but these can be very expensive.
And even though they're a much higher quality link, we could also rely on the
Internet.
The Internet is an underlay. It's something that we could build another network
on top of,
and it works out well because the Internet is kind of everywhere.
I can pretty easily get an Internet connection at any location, whether it's a
headquarters or a branch.
Even if the branches may be in a remote part of the world, there's usually a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Even if the branches may be in a remote part of the world, there's usually a
way to get an Internet connection.
But this is where we start to realize there's a problem with all of this.
It's great that I can form a tunnel relationship, which allows me to send my
network communications across this underlay that we've created.
And if it's a private underlay, like a T1 and E1 or MPLS, which, depending on
who you ask, maybe MPLS is secure, maybe it's not,
but either way we understand that there's a difference between a service
provider type of technology like this and the Internet. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
provider type of technology like this and the Internet.
Because the Internet will work out great as an underlay, but it's also a very
public space.
Anybody can listen in, depending on how the traffic ends up getting routed
through the Internet.
And so the problem that we end up facing is this tunnel is very insecure.
The tunnel mechanism that we've talked about, GRE, and for that matter, other
tunnel mechanisms as well, they do nothing to offer security. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
tunnel mechanisms as well, they do nothing to offer security.
We want this to be a secure connection, not an insecure connection.
So we've only solved part of the problem at this point if we want to use tunnel
ing for this scenario.
It's great that it allows me the flexibility of connecting a remote enterprise
location to my headquarters,
but that connection is useless to me so long as it isn't secure.
Well, every good problem needs a solution.
And so we do have a solution in the industry, and that solution is known as IP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so we do have a solution in the industry, and that solution is known as IP
sec, where sec is short for security,
and we're talking about building that on IP networks, and especially IP tunnel
ing solutions.
Now, what's interesting about IPsec is that it's not actually a protocol.
IPsec doesn't give us the technical bits and bytes in order to secure this.
Instead, what IPsec is, is it is giving us a framework on which to build other
protocols. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
protocols.
And we'll be taking a look at those protocols here coming up.
But the goal here is for us to be able to take these insecure tunnels and make
them secure.
We'll put the ability to deploy a secure tunnel, and this is going to become
known as that virtual private network or VPN.
So we can call these VPN tunnels.
Sometimes we'll call them IPsec tunnels, but either way we're going to take the
tunnel technology and add security to it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
tunnel technology and add security to it.
So how does it do this?
Well, IPsec is going to start by defining some header types for us.
And what we'll find is that we have two different primary options depending on
the needs.
Because we're approaching this from the perspective that we're sending this
across the public internet,
and we want to probably really lock those communications down.
But we might also want to add a lighter level of security over a shared service
provider network like MPLS,
where we say, you know, we want to make sure that we're properly connecting to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
where we say, you know, we want to make sure that we're properly connecting to
our own devices,
but we're going to trust the underlay to not leak our bids and bytes out to the
public world.
And so the first option that we have is known as authentication header or AH.
Authentication header, again, AH from here on out, is going to use IP protocol
number 51.
So we always have to make sure that we're allowing this through our firewalls WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we always have to make sure that we're allowing this through our firewalls
if we're going to build a tunnel through one,
or again, access control lists.
And AH is going to place two different security layers on top of our tunnel
mechanism,
the first of which is authentication, as the name implies, we'd expect to add
authentication.
Authentication is essentially proving who I am so that I don't just have other
random routers trying to build tunnels with me.
If you want to build a tunnel with me, you have to prove that you are who you
say you are,
and usually we're going to use a hashing mechanism in order to do this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and usually we're going to use a hashing mechanism in order to do this.
Now, the second layer of security we're adding is known as data integrity,
and data integrity is making sure that data remains unchanged.
If I send a series of bits to you, I don't want anyone in the middle to be able
to change that.
And if somebody in the middle does get their hands on the packet and they're
able to change what the packet says,
we want to be able to detect this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we want to be able to detect this.
And so we're going to use the concept of a chuck summon order to do this.
The interesting thing about AH, and this is the big thing, is that we notice
that there is no encryption.
And because there's no encryption, AH doesn't get used a whole lot.
Again, it's a lighter flavor of security.
It doesn't take as much processing power, and it might be appropriate when we
feel like we have a secure underlay.
But in general, we're not going to see a whole lot of this in production.
Instead, we're going to see the second header type, which is known as the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Instead, we're going to see the second header type, which is known as the
encapsulating security payload, or ESP.
ESP is going to solve this problem of not supporting encryption by adding
support for encryption.
But first of all, let's just address this. It does use IP protocol 50.
So one right after the other, 50 and 51 for these two header types.
And then we also are going to see that it adds data confidentiality, which
again is basically saying we're going to support encryption. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
again is basically saying we're going to support encryption.
It also, interestingly, adds NAT traversal. So we have a mechanism now for
getting around NAT, which is especially important if we're performing this over
the Internet.
So if we're ever doing anything over the Internet, it really must be using ESP
rather than AH.
Now, IPsec adds definitions for a couple of modes of operation. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, IPsec adds definitions for a couple of modes of operation.
These two modes are very important that we know the difference and can keep
them straight.
The first mode of operation is known as transport mode.
And transport mode means that we are only encrypting the payload.
So payload only is protected, meaning the only other part of the packet besides
the payload is going to be the header information.
And so if we want to protect the entire packet, we're going to have to use WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so if we want to protect the entire packet, we're going to have to use
tunnel mode.
Tunnel mode is both the header. Again, we're talking about the inner header at
this point. This is still a tunnel mechanism.
So the inner header is protected as well as the payload.
For the most part, we're going to see tunnel mode be adopted.
Again, a lot of these protocols and mechanisms were created at a time when not
every network device was super powerful.
And so this is certainly more of a lightweight type of security deployment for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so this is certainly more of a lightweight type of security deployment for
devices that have a harder time,
maybe encrypting the entire packet. And that's the same concept up here that we
saw with authentication header, where we have a lightweight version.
In the modern network, we don't really struggle with this a whole lot, although
encrypting a very high level of throughput,
like a 10 or 40 gig pipe, is actually still very challenging. We need to make
sure we have the right hardware in place to do that.
For the most part, again, if we've got the right hardware in place, we're going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
For the most part, again, if we've got the right hardware in place, we're going
to see ESP used along with tunnel mode in order to fully support the
protections that we need for our modern networks.
Now one last component that IPsec defines for us is the concept of the
transform set.
There are a lot of encryption protocols, and there are a lot of authentication
protocols.
For example, for authentication, we've got things like MD5 hashes and SHA WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
For example, for authentication, we've got things like MD5 hashes and SHA
hashes.
And with encryption, we have a lot of methodologies, including some more legacy
ones like DES and triple DES.
Again, these are legacy and we don't really use these anymore. But we do have
lots of different versions of AES.
And so we want to make sure that we define a set that tells the other side,
basically when we're negotiating what we want to use.
Do I want to use MD5 along with AES? Do I want to use SHA along with triple DES
? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
?
And so the transform set sort of defines for me my authentication and
encryption method, and it allows me to negotiate again back and forth with the
other side.
The transform set is going to be part of our iOSXC configuration where we
define which authentication and which encryption methods that we want to use.