Well, as part of the IPsec implementation, the industry created ISA camp, which
stands
for the Internet Security Association Key Management Protocol.
This is a way for us to manage our security keys, but once again, this is a
framework.
It is not itself a protocol.
So the protocol that was developed out of ISA camp is known as the Internet Key
Exchange, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Exchange,
or IKE.
Now the Internet Key Exchange has two different versions, and we're expected to
know both
of these versions, so we're going to talk about both of these in this skill.
But it's important to understand what exactly are these keys we're talking
about?
What are we trying to accomplish?
Well, when two devices want to form a secure connection with one another, they
're going
to use the concept of keys in order to lock up the data. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to use the concept of keys in order to lock up the data.
It's sort of thinking along the lines of having a lockpad here, and the keys
are what's going
to be used to not only lock the file, the data that we're sending.
We're kind of trying to lock it up with encryption, but it's also going to be
how we unlock it
on the other side.
So I can scramble the information up with encryption, send this jumbled mess
across the Internet.
So anybody here in the middle, any thread actor listening in, won't be able to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So anybody here in the middle, any thread actor listening in, won't be able to
understand
this because it's been encrypted, it's been locked up using this key, and then
the other
side is able to take this jumbled mess and turn it into actual data on the
other side,
because again, they have the key.
So these keys are very important to how we encrypt and decrypt data.
Now we're not going to dive into the nitty gritty details of how encryption and
decryption
works and how exactly this all comes together. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
works and how exactly this all comes together.
It's actually very fascinating how we do that.
But we do have this information here on CBT nuggets within our content library.
It just understands it goes outside the scope of this conversation, but it also
goes outside
the scope of the course and the exam.
And so if you want to know more about it, this is where we're drilling in more
to CCNP
security types of topics.
But again, we do have a sec core CCNP security core as an option.
We've also got plenty of other security courses that walk through how exactly WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We've also got plenty of other security courses that walk through how exactly
encryption and
decryption works using these encryption keys.
So what we need to know and take away from this conversation is this exchange
needs to
happen in a very secure manner.
And so that is exactly what Ike or internet key exchange is going to do for us.
Now as I mentioned, there are two different versions of Ike and so we're going
to go through
those and we're going to start with Ike version one.
Now for the most part, we want to be using Ike version two. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now for the most part, we want to be using Ike version two.
It's the more modern version, but not all platforms support it.
And so that's why we need to understand Ike V one as much as we understand Ike
V two.
And there's actually a lot more to understand about Ike V one.
Ike V two actually simplifies a lot of things.
And so we're going to spend actually a disproportionate amount of time on Ike
version one, even though
we prefer to use Ike version two in production networks.
So Ike V one, the way this works is actually broken up into two phases.
So we have phase one and phase two. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we have phase one and phase two.
So we're going to start here with phase one.
And the goal of phase one is sort of to establish the control plane of our
secure communications.
So phase one is about establishing a control plane.
Then phase two is going to be about establishing a data plane.
But either way, we just need to establish communications between our two
devices.
So this is sort of the initiation point, how exactly do we enable communication
and enable WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and enable
the exchange of our keys and also negotiate all of the security parameters like
we alluded
to at the end of the last video needing to decide different authentication
encryption
means.
Well, this is what we have to do.
We have to decide and make a bunch of decisions.
And my friend Keith Barker here at CBT Nuggets, he calls this the haggle.
Now you might notice that haggle is misspelled, especially if you know English.
When you're talking about haggling, you're usually talking about negotiating, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
When you're talking about haggling, you're usually talking about negotiating,
right?
Like I go to a flea market and I'm trying to haggle over the price about
something.
Let's build with two G's.
So what are we trying to say here?
Well, this is an acronym and we're still sort of haggling with one another.
We're sort of these two devices are trying to figure out how they're going to
interoperate
and work together.
But again, now we're going to turn haggle into an acronym.
So the H here is going to say that, hey, we've got to figure out the hashing
method.
So we mentioned this is for authentication. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we mentioned this is for authentication.
This is going to be MD five or it's going to be shot.
So two different hashing methods and we just have to decide between the two.
We also need to decide our authentication mechanism.
So are we going to add a pre shared key?
Are we going to use certificates?
And so the hashing algorithm and the authentication kind of come together here.
We also have to decide the group.
The group ID is interesting.
This has to do with what we call Diffie Hellman. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This has to do with what we call Diffie Hellman.
Diffie Hellman is the way by which we can securely exchange keys in on an open
network.
Might have noticed the situation over here, you say, well, wait a second, we
have to exchange
keys and yet this thread actor could be right in the middle listening in.
Maybe we think about even something like this where I'm at a cafe and there's a
wireless
access point here and this laptop trying to connect and we need to secure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
access point here and this laptop trying to connect and we need to secure
communications
with one another.
Meanwhile, the thread actors right here listening in to the wireless
communications.
So this is an even easier scenario, but certainly thread actors can have ways
of intercepting
communications out on the internet as well.
So we're not safe regardless of the underlay in this particular situation.
So how do we go about exchanging keys in such a way that everybody can listen
into this
process and yet they can't figure out what the keys are. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
process and yet they can't figure out what the keys are.
It's pretty fascinating and really involves a lot of complex math and the
operation that
we use here is known as a Diffie Hellman exchange.
Now there's lots of different Diffie Hellman exchanges and we typically refer
to these
different versions as different groups.
It emphasizes the security mechanism used and things have changed and evolved
over time
and so usually we're going to see that this group ID is 14 or above because
this is the
threshold for what we'd consider to be modern Diffie Hellman exchanges these WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
threshold for what we'd consider to be modern Diffie Hellman exchanges these
days.
So just keep in mind that we have to decide a Diffie Hellman group and we have
to again
agree on this.
We can't use two different methods for exchanging keys.
We have to lock in on the same group ID.
So this is going to help us to exchange our keys.
Now we also have to decide a lifetime, meaning when does this session expire?
We don't necessarily want to keep this session around forever. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We don't necessarily want to keep this session around forever.
It might be insecure to keep it around forever because the longer we have this
communication
going, the longer that this threat actor might just be able to sort of guess
keys and run
dictionary attacks and those kinds of brute force methods.
So we don't want to necessarily leave this online for that long because the
longer it's
online, the more time they would have to brute force things.
So we expire this session at some point and then the last piece of the puzzle
here is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here is
going to be our encryption method.
So in the modern network, we're probably going to select AES, which is the
advanced encryption
standard.
But just keep in mind we have to decide which version of AES to run and so on
and so forth.
Now notice that we're performing these communications back and forth and we
haven't yet established
secure communications, which means that this encryption method that we're
talking about
here is not going to impact this first phase one tunnel. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here is not going to impact this first phase one tunnel.
This is going to impact our phase two tunnel, which is again, I'll say for
phase two, which
is again going to be for our data plane of operations.
Now phase one actually has two different methods or modes that we can perform
this with.
One is going to be a little bit more lightweight and faster.
The other one's going to be heavier and more secure. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The other one's going to be heavier and more secure.
The first one, which is the heavier option, is going to be known as main mode.
And this is typically abbreviated as MM.
If we're talking about I could be one and we're doing research, we might see
this MM show
up in white papers and so understand that that's what we're talking about here.
Main mode is going to consist of six different messages that go back and forth
in order to
perform everything that we need to perform in phase one.
Furthermore, it's also going to offer a little bit more protection around WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Furthermore, it's also going to offer a little bit more protection around
identities.
So keep in mind that these devices, they have identities on the internet and we
don't necessarily
just want to broadcast everything in plain text.
We might want to try to secure some of these communications and main mode
taking more message
time into account allows us to actually perform some initial plain text
communications and
then secure the latter messages.
As with everything, the more we secure things, the more important it is that we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
As with everything, the more we secure things, the more important it is that we
have good
processing, especially if we're doing a lot of negotiations every second or
whatever the
situation is.
And so that's why we do have an aggressive mode of operation, which doesn't
itself necessarily
sound like it's lighter or less secure.
But the idea here is that instead of six messages, we're only going to send
three messages. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
three messages.
And as we might imagine, three messages doesn't allow us to talk much in plain
text and still
have things left over to say that we could encrypt.
And so again, we might or we're not going to see this protection for the
identifiers.
However, it is a whole lot faster than main mode.
And again, it is going to require fewer resources.
Now both of these have the same end result.
And the same end result and the goal of IKEV one is to lead to like I said, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the same end result and the goal of IKEV one is to lead to like I said,
phase one,
the goal is to get to phase two.
So what exactly is phase two?
Well phase two is the point at which we establish the data plane tunnel.
So again, this is the tunnel that we want to use for our actual throughput, our
end user
traffic.
This is going to result in our overlay establishment and overlay traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is going to result in our overlay establishment and overlay traffic.
So this is the goal.
It's great to establish a method of communication between the devices and to go
back and forth
like this and figure out how we want to do things and figure out the method for
all of
this and all of this is great, but that's itself is not the goal.
That's just a means to the end.
And so at the end of this is creating the actual data plane tunnel.
So this is where we're going to pay attention to the transform set that we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this is where we're going to pay attention to the transform set that we
mentioned and
all of the things that we negotiated as part of phase one.
Furthermore, this when we talk about an IP sec tunnel, this is what we're
talking about.
We are talking about the phase two tunnel and just be aware that every now and
again,
we might actually hear this mentioned as an Ike tunnel as well.
Just depending on what white papers you're reading and who's talking about it.
Sometimes the vocabulary gets blended here a little bit. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Sometimes the vocabulary gets blended here a little bit.
Phase two is going to use what we call quick mode.
We say, well, are there two different modes of operation like before?
No, we're just going to send quick mode messages.
And this, like with MM and AM, this is abbreviated now as QM.
And interestingly, this is going to create two, say, two unidirectional tunnels
.
This is a little bit different from before where actually we establish a bid
irectional WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
irectional
tunnel between our two devices for the phase one tunnel.
This ends up creating two unidirectional tunnels.
So each router has its own way of sending traffic to the other side.
So that is Ike version one from a phase one and phase two perspective.
Just keep in mind the difference between phase one and phase two.
We're really talking about the control plane and all the negotiations happening
in phase
one, the data plane and the actual sending of our data in the phase two tunnel. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
one, the data plane and the actual sending of our data in the phase two tunnel.
And one last note in all of this is we mentioned lifetime here.
So how long does this all last?
Well, the phase one tunnel is only going to last 24 hours by default.
And you say, wow, that's not very long.
That means every day we have to reestablish a new phase one tunnel.
And that's true.
But phase two is even more strict.
Phase two is only going to last four hours by default.
And so we're going to have to build new tunnels every four hours. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so we're going to have to build new tunnels every four hours.
Now we can change the lifetime of the tunnel if we so desire, but do understand
that we
can't extend an existing tunnel.
If the expiration timer is reached, then we're going to have to tear down these
phase two
tunnels and or maybe even the phase one tunnel.
And we're going to have to rebuild accordingly, just rebuild those tunnels from
scratch.
So that might end up disrupting our network traffic.
But again, we want to prioritize our security and favor our ability to avoid WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But again, we want to prioritize our security and favor our ability to avoid
brute force
attacks.
So the end of this whole conversation, we say, okay, well, that's great for a
phase or for
Ike v one.
Do we want to pause and and how we'll have a whole breakdown of Ike v two?
Well, now we're going to go ahead and talk about it here.
And yes, this is probably enough space down here in the corner.
There's not a lot to talk about with Ike v two because it sort of blends the
process
into a single phase of operation.
We're going to accomplish all the same things, but we're going to take phase WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're going to accomplish all the same things, but we're going to take phase
one and phase
two and put it into this single phase or the single process.
It's only going to take four messages rather than going back and forth.
We'll see, keep in mind, either six or three to start with.
And then another, what do we say for quick mode?
There were three messages.
I don't know if we actually said that or not, but there were three messages in
quick
mode.
So either have six or nine total messages.
And that's been greatly reduced down to four messages, which is great. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's been greatly reduced down to four messages, which is great.
And we have better encryption options.
So that is going to be one of the primary drivers to use Ike v two because I
could be
one works great.
There's nothing wrong with Ike v one as long as it actually maintains things
securely,
even if it's less efficient in the setup.
Well, if we have better encryption options, namely different versions of AES or
what have
you that Ike v one doesn't support, that's going to be the primary driver of
Ike v two.
And it is important to note that if we have a device here running Ike v two, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it is important to note that if we have a device here running Ike v two,
and we have
a device up here that can only run Ike v one, that these are going to be
incompatible with
one another.
So we are going to have to have support for Ike v two on both devices.
If we want to use Ike v two to build out our secure tunnels.
But that is how I comes together again, a lot of our time was spent on Ike
version one.
And I know it feels a little backwards sometimes to spend that much time on the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I know it feels a little backwards sometimes to spend that much time on the
more legacy
protocol.
But we see that all the same information in Ike v one is what's negotiated in
Ike v two.
We can't really unpack Ike v two until we understand Ike v one.
And as always, we want to pay attention to the blueprint and the scope of the
course
and exam in order to understand what we need to learn.
And so we do, we should absolutely make sure we understand the two phase
approach with
Ike v one.
We need to understand how that reduces to a single phase in Ike v two. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We need to understand how that reduces to a single phase in Ike v two.
And the fact that other than changing a little bit of message count, we do get
some better
encryption options and the two versions are incompatible with one another.