So now we get to start talking about IPsec.
So let's introduce ourselves to IPsec.
Now remember, we're doing IPsec here for Cisco IOS and IOS XE.
But in general, what is IPsec VPN?
So IPsec VPN gives us the opportunity to create site-to-site secure tunnels
or site-to-site remote access tunnels.
So what we have the opportunity to do is get a secure tunnel over an untrusted network.
So an example of an untrusted network is the internet.
So in this particular scenario here, we have our internet.
So I'm creating a secure tunnel over the internet.
A secure tunnel for remote access from a mobile worker device, like a laptop, a PC, a tablet, a phone, up to headquarters.
A small office, home office environment, creating a VPN tunnel from that small branch office,
from that small office, home office, whatever, up to the environment.
So that way anybody in the site can use the VPN tunnel to get the resources in headquarters.
Anybody in the site can use the tunnel to get the resources in the headquarters.
Anybody using this device that is authorized to do so can use the remote access to get to secure resources in headquarters.
So we get a secure tunnel over the untrusted network.
And so what we're doing is we're going to be encrypting our IPv4 traffic or our IPv6 traffic.
Unicast traffic as it crosses that untrusted network.
So what you need to realize about this is that it does not support other protocols.
So when you use IPsec, you can't set up OSPF neighborships across an IPsec tunnel.
You can't do that.
So it does not support other protocols except for IPv4 and IPv6 over top of that tunnel to protect it.
Oh, and it's really great at is what?
Encryption, authentication, integrity checking.
That's the power of IPsec.
So remember this.
Site-to-site is about secure point-to-point connections between sites.
And remote access is going to be about secure point-to-point connections between a device running software like Cisco AnyConnect VPN Client,
which has been rebranded to Cisco Secure Access with the AnyConnect Client inside of it,
up to something like an office, a site that you have.
So IPsec is what?
IPsec itself is a framework.
That's what it is.
And what is a framework?
A framework gives you guidance.
A framework gives you best practices.
A framework gives you suggestions on what you need to do in order to successfully accomplish something.
So with the IPsec framework, it's about having guidelines, best practices, suggestions.
So that way there, you can provide security for your Layer 3 traffic, your IPv4 Layer 3 traffic, your IPv6 Layer 3 traffic.
So your what?
Your IP packets.
So think of it as IP packet security, internet protocol security, IP packet security.
So the underlying network has to be IPv4 or IPv6, and then the traffic you're transporting over top of it has to be IPv4 or IPv6.
And with the IPsec framework, we have the opportunity to provide things like authentication, integrity checking, confidentiality,
and anti-replay protection, as well as things like non-repudiation as well.
So a great way to visualize IPsec is to look at it this way.
This is my box.
I need to implement IPsec on my router.
And so the framework says, hey, Raymond, you need to pick a protocol.
You need to pick a hashing algorithm for integrity checking.
You need to pick something for authentication.
You need to pick an encryption algorithm for confidentiality.
You need to pick something for key management.
And so my Cisco router right now, let's say, supports all of these options.
So the IPsec framework tells me I need to do these.
I need to pick something from each of these categories.
But what it doesn't do is it tells me what I need to pick.
That's up to me to decide.
That is my choice, not the framework's choice.
Obviously, the framework is going to suggest that you use the best of the best of the best.
But I get to pick and choose.
And what I get to pick and choose is based on what my devices actually support.
So, for example, if my device doesn't support AES, then I can't pick it.
Because if it does, then I can't pick it.
But if it does, then I can't pick it.
So, for example, if my device doesn't support AES, then I can't pick it.
Because it wouldn't be on my device's shelf of options to use.
Now, if my device didn't support AES, I'd be throwing that device in the garbage, by the way.
Because you should be using AES today.
But now let's just go ahead and pick some things here.
Let's pick ESP for our protocol.
Let's pick pre-shared keys for authentication.
SHA-2 for integrity checking.
AES for authentication.
SHA-2 for integrity checking.
AES for confidentiality.
And then Diffie-Hellman for my key management.
Now, with all of that stuff, I configure this on my router.
And this would be true for any other implementation of IPSec you have.
Whether it's on a firewall or any other type of device.
It's the same methodology here we're talking about with a framework.
So, I need something from every category.
And what I choose is going to be based on the level of protection that I want.
When it's all said and done.
The great thing about frameworks is that they don't have to change.
If all of a sudden a new hashing algorithm comes along, like SHA-3.
We can put it on the shelf.
Does that change the framework?
No, it doesn't.
It just means that now we can actually take this out and put SHA-3 in the box if we wanted to.
That's what a framework allows us to do.
So, when it comes to IPSec, we are going to dynamically negotiate tunnels
to establish what are called security associations.
So, the first one is our ISACAMP security association.
So, our ISACAMP security association refers to the Internet Security Association
and Key Management Protocol.
So, it's about establishing a security association.
A relationship between two different entities, like R1 and Branch A in this particular case.
And exchanging keys.
Key Management Protocol.
And then we also have IKE.
That can be utilized as well.
Internet Key Exchange.
And you'll see that we have multiple phases.
We have phase one that creates the ISACAMP security association.
And then we have phase two, which creates the IPSec security association.
So, what is phase one all about?
So, phase one is all about defining what we call your ISACAMP policy.
So, your Internet Security Association and Key Management Protocol policy.
And so, this is about creating our first tunnel.
We actually create two tunnels here.
This first tunnel is used to establish a secure initial connection,
which will be used to exchange information with the real ISACAMP key.
This second tunnel is used to establish a secure initial connection,
which will be used to exchange information with the real tunnel we'll use for security.
See, the problem we have here is if I just turn around over this untrusted network
and share and do what we need to do to protect the real tunnel,
then that could be captured by the cybercriminals.
But what if instead we generate dynamically a secure tunnel
that can be regenerated at a period of time by having lifetime specification
and once that's created, then we can transport the real information inside of that
so that way we can protect our data with the real information.
That's what's really happening here.
It's like a tunnel within a tunnel in order to get the job done.
So, this first tunnel here, we need our hashing algorithm, our encryption algorithm.
We need to specify our key exchange algorithm that we're going to use.
So, Diffie-Hellman, authentication parameters, lifetime parameters.
And then once this is done, then we can go on to phase two
and we can do everything else we need to do.
So, this is responsible for setting up the actual encrypted data tunnel.
So, this is happening inside of the phase one tunnel.
And so, we're setting up the actual encrypted data tunnel
through which data is securely transmitted between IPsec pairs.
So, this information is going to be transmitted in a safe and secure way
where the ISA-CAMP information is not.
And that's okay because the ISA-CAMP information in the end
allows us to dynamically create a secure tunnel
over an untrusted network in an unencrypted way
which ultimately produces an encrypted tunnel.
It's some pretty cool tech, folks. It really is.
And then from there, build that other tunnel we need
using that encrypted tunnel.
Whoo! That's beautiful. Absolutely beautiful.
And so, with the phase two, we get to define where is the tunnel going,
what's going in the tunnel, how is the traffic changing,
And then, what do we do?
We apply it to our interface.
Physical interface in this case.
And so, our tunnel goes from physical interface to physical interface.
Just like with GRE, right?
We had our tunnel that we created,
but then we indicated what physical interfaces we're using
from point A to point B.
Whereas in this case, we actually put it on the physical interface.
Now, what I want you to realize, too, is that
when you're building a tunnel,
you actually put it on the physical interface.
Now, what I want you to realize, too, is that
these types of tunnels are going to be initiated or brought up,
meaning the security association only comes up
if there's interesting traffic that arises at the router.
So, the tunnel won't even be established
unless traffic arrives that needs to go through the tunnel.
If traffic arrives that needs to go through the tunnel,
then we go through phase one, we go through phase two,
we establish that, then we can use that.
And then if traffic stops flowing,
then after our timeout period,
then all of that just gets torn down
and we renegotiate, reestablish everything.
So, that way there, we don't have the same parameters being used
for the tunnel for a prolonged period of time.
It gives us the opportunity to reestablish keying,
change keying, depending on the lifetime of phase one.
We have the opportunity to do that.
So, there we go.
We have our phase one, we have our phase two.
So, in phase one, authentication can be done
with things like pre-shared keys, X509 certificates.
So, in production environments, X509 certificates
are better than the pre-shared keys.
We have Diffie-Hellman that we're going to use as an example
to securely generate keys and exchange keys
over the untrusted network to produce our phase one.
Diffie-Hellman is absolutely amazing.
If you want to learn more about Diffie-Hellman,
just check out YouTube videos on Diffie-Hellman.
Diffie-Hellman.
With Diffie and Martin-Hellman, my gosh,
to come up with this, that's just incredible.
Incredible minds these two individuals had
in order to come up with a secure key generation.
It's really, really amazing.
And it's still in use today, and they invented it
in like the 80s, if I recall correctly.
So, anyways, been around a long time, still works to this day.
So, Diffie-Hellman for the key exchange.
Keep that in mind for the exam.
You get your encryption algorithms.
The asymmetric algorithm that's going to be used
to protect the traffic, like AES as an example.
And then a hashing algorithm that's going to be used
for integrity checking of that actual phase one tunnel.
So, something like SHA-256 as an example.
And then we also have lifetime.
So, how long the policy is valid until the renegotiation happens.
So, something to keep in mind here about phase one
is that all of these must match
between peers.
Right?
And then this one doesn't have to match,
but the lowest value between peers is used.
Okay?
Keep that in mind for the exam.
All right?
So, that is phase one.
Now, for phase two, we define things
like where is the tunnel going, what is going in the tunnel,
and how is the traffic going to be treated.
So, in phase two, how is the traffic treated?
That's going to be done with what we call an IPsec transform set.
So, inside of our IPsec transform set,
that's where we have to specify a security protocol,
an IPsec security protocol, either AAH or ESP.
So, AAH or ESP is what?
AAH is called authentication header.
So, we only do authentication and integrity checking in that case.
Whereas with ESP, we do encryption authentication
and integrity checking.
So, this is not an option that you want to use
when you're trying to do VPNs over the internet
because you want ESP because it does encryption as well.
Keep that in mind for the exam.
Okay?
Encapsulation mode, tunnel versus transport.
So, this just determines how you're actually going
to encrypt your traffic.
Are you going to encrypt the entire contents of it,
or are you just going to encrypt what you need
in order to successfully deliver it?
So, here's the difference.
I'm going to show you a diagram
on the difference between the two here.
So, in transport mode, notice,
if this is our original packet, I should say,
when we use transport mode,
notice how this header is reused here.
So, we're really only encrypting from here to here.
So, notice our data is the only thing that's being encrypted.
The original IP header is not being encrypted.
Whereas with tunnel mode,
you see the original IP header is being encrypted now.
And then we have a new IP header
that is added on outside of that.
So, what you need to realize
is there's really two different purposes for this.
So, tunnel mode is what you're going to have to use
over the internet.
And it's not because of the encryption of the IP header.
Let's be clear about that.
You're going to use tunnel mode over the internet
because this is typically going to be what?
Private IP addressing.
Right?
Somebody in 10.0.0.10
trying to go to 10.0.255 or 254.5 as an example.
That's private IP addressing.
And then we're trying to do a site-to-site tunnel over the internet.
So, that has to be public IP addressing anyways.
So, this is typically what you're going to use over the internet.
However, this one here,
since it preserves the private IP addressing,
if you ever want to do IPSec tunnels inside of your organization,
maybe you want to secure traffic going from one site,
not one site,
but one department to another department
or maybe even one site to another site,
let's say over a WAN connection.
A WAN connection that allows you to preserve your private IP addressing.
Well, then in that particular case,
you can encrypt it from end to end
and just keep that same IP address in there.
So, that's the difference between the two.
So, typically, because we're going to be tested on in the certification exam,
running IPSec over an internet connection of some type,
tunnel mode is the one you're going to use
because this addressing has to be different than that addressing.
But in scenarios where the addressing can be the same,
then you can use transport mode instead if you want to.
So, that's the difference between tunnel mode and transport mode.
And then what do we have next?
We have encryption next.
So, when it comes to encryption,
what type of encryption are we going to use?
Are we going to use AES-256 as an example
or something else to protect our traffic and transit across the network?
And then what are we using for authentication?
Authentication in this case.
So, hashing algorithms is what they're referring to for authenticity,
for integrity checking is what we're talking about in this particular case.
Now, the other item here we see is what is going inside the tunnel.
So, what is going inside the tunnel?
And so, we do ACLs for that and we call those proxy ACLs.
So, we'll set up an ACL that specifies traffic
that is coming from 10.0.0.0.24 going to 10.0.254.0.24
is going to be allowed to go through the tunnel.
And so, if traffic arrives and it needs to be routed over this way
and it meets the proxy ACL,
then it's going to generate the IPSec tunnel for us.
And then where is the tunnel going?
So, what is the physical or the public IP address of the interface
that we're trying to reach on the other side of that particular tunnel?
All right, then we apply all of this interface
and we can generate traffic to initiate our tunnel.
So, that is our overview of IPSec, folks.
Will you be tested on anything specific there for the exam?
It's tough to say.
It's mostly just theory we covered there,
but if you understand that theory,
then you shouldn't have any trouble answering any questions
that do come up about that theory on the certification exam.