Transport layer security, as we looked at the previous video,
does a great job of encrypting, and doing
data integrity for packets, and protecting those packets
as they're crossing a network.
However, it's not the only protocol that can do that.
One of the families of protocols that's
dedicated to doing that for VPN use, is called
I-P, capital I, capital P, lowercase s-e-c.
And that's what I'd like to talk with you about in this video.
So the purpose of IPsec is two main things.
And that is privacy, which we are WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that is privacy, which we are
going to get through encryption, and also
data integrity, which we are going to get primarily
through some kind of a hashing algorithm, or its cousin HMAC.
And we generally are going to apply
IPsec as we're going over untrusted networks,
or networks that we want to protect the packets as they
cross.
So if we wanted to-- let's take this as an example--
maybe this is the internet.
That certainly would be an untrusted network.
What we do is we could build a logical tunnel
over the network.
And a tunnel has two endpoint, so if R1 is one endpoint, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And a tunnel has two endpoint, so if R1 is one endpoint,
and R2 is the other, those would be
the ends of the IPsec tunnel.
So traffic from a user like Bob here
was saying traffic that was going
from 10.1.0.50 to 10.2.0.50, if it hits this router,
and based on its instructions, if it said,
hey, everything from 10.1.0 to 10.2.0 encrypt.
It would then encrypt the data, and do hashing based
on the rules that we set up.
It would then forward it, it would put a new IP header
on it.
And the source address would be itself.
The destination would be the other end of the tunnel. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The destination would be the other end of the tunnel.
And then the payload would be the original packet,
but all encrypted.
And that way people on the internet who eavesdrop,
without the keys involved, would only
be able to go ahead and see gobbly goop.
They wouldn't be able to make sense of the payload.
So it gets encrypted, shipped over the tunnel
to R2 who decrypts it, and then it forwards it on its way.
Now in the world of IPsec, there are two big camps.
There is IKEv1.
IKE stands for Internet Key Exchange, and v1 means old.
And IKEv2, which is more modular, more WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And IKEv2, which is more modular, more
moving parts, and more compatible with other vendors.
Because if have Cisco and your other vendors,
and they're all using IKEv2, there's
more compatibility involved.
So I have separate sets of videos
that are going to go into great detail on both IKEv1 and IKEv2.
But I wanted to introduce it here as one of the components
that we're going to leverage in the world of cryptography
for protecting packets as they're
being sent over network.
And that is the family of protocols included in IPsec. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that is the family of protocols included in IPsec.
So one of the other questions that comes up
when dealing with IPsec and IPsec
with virtual private networks, basically tunnels
of IPsec traffic, is how do you make sure,
how do we make sure that router 1 or router 2
are actually talking to the right devices?
How can they prove to each other that they
are who they claim to be.
And we have two basic options for that with IPsec.
We're going to take a look at those authentication
options in the next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I'd like to thank you for viewing.