One of the cool things about IPsec
is that it's not always implemented in the same way.
I mean we want the protection of IPsec,
but it's not always implemented with the same exact protocols
or the same methods.
So, in this video I'd like to do an overview of IPsec
and a few of our options regarding using it.
So, regardless of how we implement it the goal of IPsec
is to protect packets and we are protecting basically two
things.
We want to protect the confidentiality, or the privacy
of those packets, so if someone is eavesdropping
and they look at a packet then they can't really
make sense of the payload. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
make sense of the payload.
The other element we want to protect is the data integrity.
And with data integrity we want confidence
that the packet hasn't been manipulated
or that the data hasn't been changed
by somebody who doesn't have the authority
to make those changes.
And the main way of getting privacy
is through encrypting the data and the main way
of getting data integrity is some type of hashing,
or a derivative of hashing, which we'll talk more about.
So, let's talk about where we want the privacy and integrity
to potentially happen.
Maybe we have two sites, site 1 over here
on the left, site 2 over here on the right,
and we have network 10.1.0, 10.2.0 over here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we have network 10.1.0, 10.2.0 over here,
and we want to protect with encryption
and hashing all the traffic between site 1
from 10.1.0 going to 10.2.0.
So, what we do is have a tunnel--
or a set of tunnels as we'll discover here in a little bit--
we'll have some tunnels built up logically so that traffic that
leaves the PC goes to this router eventually
to get routed over the network.
And router 1 sees this as, oh you
know what I'm going to take this packet
and the source IP is PC1, the destination IP
is PC2 for this purpose, so that's the source, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is PC2 for this purpose, so that's the source,
that's the destination.
So, the router says, oh before I route that I
need to protect that traffic.
So, what the router will do is take all this data right here
and it will encrypt.
And R1 is going to encrypt that data using
a set of key material.
And the secret is if you encrypt with symmetrical encryption--
if you encrypt the data with a key you can decrypt it
if you have that same key.
So, the keys are known by R1 and R2.
So, R1 encrypts this.
It then adds a little ESP header.
There's also an option for a UDP header,
we'll talk about that later. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we'll talk about that later.
But ESP is layer 4 protocol 50 for encapsulating security
payload and it's going to add on top of that a new IP
header, except this time the IP header is going
to be a source address of R1 and a destination address of R2.
So, the internet would just see the packet coming from R1 going
to R2, at layer 4 it would like ESP,
a little ESP header there, and then the rest of the content
all encrypted.
So, it'd just be gobbledygook if anybody's
eavesdropping on the internet.
So, this is an example of a site-to-site IPsec WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, this is an example of a site-to-site IPsec
VPN between site 1 and site 2, between two sites.
Another option we have for IPsec VPN tunnels
is referred to as remote access.
And that refers to a single computer or device
that needs to build a VPN tunnel,
like to corporate headquarters.
So, it launches the AnyConnect client or some other VPN
client, builds a connection, negotiates that tunnel
with the hidden device, and now has a remote access VPN
from that one PC over to the headend server, which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
from that one PC over to the headend server, which
could be a Cisco firewall, it could
be a Cisco router, or a dedicated device handling
that VPN connection.
Now, in a world of IPsec there's two camps as far as
how do you build these tunnels.
There's IKE, which stands for Internet Key exchange.
IKE version 1 and there's also IKE, Internet Key exchange,
version 2 and we could use either one
if our gear supports it.
So, I will put in a separate video
a comparison and contrasting between IKEv1 and IKEv2
regarding building IPsec tunnels, but at this point WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
regarding building IPsec tunnels, but at this point
I just wanted to share with you that they exist.
So, we've mentioned site-to-site tunnels,
we mentioned remote access tunnels,
and if we'd had a headquarters location
and we had multiple sites and we wanted to build VPN tunnels,
we could have multiple Site2Site tunnels.
So, maybe this is R3 and this is R4
and we also have the option of building
spoke to spoke tunnels too.
So, if we wanted direct spoke to spoke IPsec paths
we could do that as well.
And to leverage that, one of the technologies
that does that is DMVPN. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that does that is DMVPN.
We'll introduce that in a separate video here coming up
as well.
So, I wanted to point out that the options for getting
where we want to overlay these IPsec tunnels, it's there's
quite a variety of options that we can use.
And before I close this video there's
also one other option I'd like to talk with you about
and that is how we actually implement,
not just where we implement the tunnels, but how.
The older way of doing it would be
to use what was called a crypto map.
And a crypto map simply has instructions
that says, OK traffic from this network going to this network,
as an example if the router sees it we'd WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as an example if the router sees it we'd
apply a crypto map to an interface
and when it sees that traffic, it would then go ahead encrypt,
ship it over to the pair who would decrypt
and forward it this way.
However, that crypto map option that we
used for a long, long time wasn't quite as flexible
as we needed it to be.
So, another way of doing it is to create tunnel interfaces.
So, for example interface tunnel 0,
which by default is going to use generic route encapsulation
as the layer 4 protocol.
But what we can do is we can take a tunnel
and we can actually put on that tunnel
an IPsec profile, which basically says any traffic that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
an IPsec profile, which basically says any traffic that
goes in or out of the tunnel is going to have cryptography
applied to it.
And they refer to that as a VTI, a virtual tunnel interface.
Think of a VTI, a, virtual tunnel interface,
for IPsec as a tunnel that's using an IPsec profile
to protect the traffic.
And there's a few options and variables within the VTI world
as well that we'll also discuss as we
proceed through these videos.
So, now that we've taken a look at some options for IPsec
let's dig in deeper in the next video WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's dig in deeper in the next video
and take a look at some of the specifics for IKEv1
and we'll contrast that to IKEv2 because they can both be
used to build IPsec tunnels.
So, I'll see you in that next video in just a moment.
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing.