WEBVTT

1
00:00.000 --> 00:05.600
Tunneling architectures are great. Again, we can connect two disparate networks

2
00:05.600 --> 00:08.000
to one another across an underlay.

3
00:08.000 --> 00:12.300
If we think about it, this could be a headquarters network on the left and a

4
00:12.300 --> 00:14.000
branch office on the right.

5
00:14.000 --> 00:19.130
We want to make sure that they can communicate as if the branch was directly

6
00:19.130 --> 00:21.000
connected to the headquarters.

7
00:21.000 --> 00:24.000
The problem is how do we bridge this gap?

8
00:24.000 --> 00:29.330
We could go out, we could purchase service provider links, old school, it would

9
00:29.330 --> 00:31.000
maybe be a T1 or an E1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:29.330 --> 00:31.000
maybe be a T1 or an E1.

10
00:31.000 --> 00:35.000
These days we could use MPLS, but these can be very expensive.

11
00:35.000 --> 00:40.120
And even though they're a much higher quality link, we could also rely on the

12
00:40.120 --> 00:41.000
Internet.

13
00:41.000 --> 00:46.520
The Internet is an underlay. It's something that we could build another network

14
00:46.520 --> 00:47.000
on top of,

15
00:47.000 --> 00:51.000
and it works out well because the Internet is kind of everywhere.

16
00:51.000 --> 00:55.520
I can pretty easily get an Internet connection at any location, whether it's a

17
00:55.520 --> 00:57.000
headquarters or a branch.

18
00:57.000 --> 01:00.630
Even if the branches may be in a remote part of the world, there's usually a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:57.000 --> 01:00.630
Even if the branches may be in a remote part of the world, there's usually a

19
01:00.630 --> 01:02.000
way to get an Internet connection.

20
01:02.000 --> 01:06.000
But this is where we start to realize there's a problem with all of this.

21
01:06.000 --> 01:12.270
It's great that I can form a tunnel relationship, which allows me to send my

22
01:12.270 --> 01:16.000
network communications across this underlay that we've created.

23
01:16.000 --> 01:21.600
And if it's a private underlay, like a T1 and E1 or MPLS, which, depending on

24
01:21.600 --> 01:25.000
who you ask, maybe MPLS is secure, maybe it's not,

25
01:25.000 --> 01:29.490
but either way we understand that there's a difference between a service

26
01:29.490 --> 01:33.000
provider type of technology like this and the Internet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
01:29.490 --> 01:33.000
provider type of technology like this and the Internet.

27
01:33.000 --> 01:37.840
Because the Internet will work out great as an underlay, but it's also a very

28
01:37.840 --> 01:39.000
public space.

29
01:39.000 --> 01:43.770
Anybody can listen in, depending on how the traffic ends up getting routed

30
01:43.770 --> 01:45.000
through the Internet.

31
01:45.000 --> 01:52.000
And so the problem that we end up facing is this tunnel is very insecure.

32
01:52.000 --> 01:57.440
The tunnel mechanism that we've talked about, GRE, and for that matter, other

33
01:57.440 --> 02:01.000
tunnel mechanisms as well, they do nothing to offer security.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:57.440 --> 02:01.000
tunnel mechanisms as well, they do nothing to offer security.

34
02:01.000 --> 02:06.000
We want this to be a secure connection, not an insecure connection.

35
02:06.000 --> 02:10.410
So we've only solved part of the problem at this point if we want to use tunnel

36
02:10.410 --> 02:12.000
ing for this scenario.

37
02:12.000 --> 02:17.310
It's great that it allows me the flexibility of connecting a remote enterprise

38
02:17.310 --> 02:19.000
location to my headquarters,

39
02:19.000 --> 02:24.000
but that connection is useless to me so long as it isn't secure.

40
02:24.000 --> 02:27.000
Well, every good problem needs a solution.

41
02:27.000 --> 02:32.650
And so we do have a solution in the industry, and that solution is known as IP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
02:27.000 --> 02:32.650
And so we do have a solution in the industry, and that solution is known as IP

42
02:32.650 --> 02:35.000
sec, where sec is short for security,

43
02:35.000 --> 02:39.740
and we're talking about building that on IP networks, and especially IP tunnel

44
02:39.740 --> 02:41.000
ing solutions.

45
02:41.000 --> 02:47.000
Now, what's interesting about IPsec is that it's not actually a protocol.

46
02:47.000 --> 02:52.000
IPsec doesn't give us the technical bits and bytes in order to secure this.

47
02:52.000 --> 02:58.930
Instead, what IPsec is, is it is giving us a framework on which to build other

48
02:58.930 --> 03:00.000
protocols.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
02:58.930 --> 03:00.000
protocols.

49
03:00.000 --> 03:04.000
And we'll be taking a look at those protocols here coming up.

50
03:04.000 --> 03:08.700
But the goal here is for us to be able to take these insecure tunnels and make

51
03:08.700 --> 03:10.000
them secure.

52
03:10.000 --> 03:16.600
We'll put the ability to deploy a secure tunnel, and this is going to become

53
03:16.600 --> 03:19.000
known as that virtual private network or VPN.

54
03:19.000 --> 03:22.000
So we can call these VPN tunnels.

55
03:22.000 --> 03:27.080
Sometimes we'll call them IPsec tunnels, but either way we're going to take the

56
03:27.080 --> 03:30.000
tunnel technology and add security to it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
03:27.080 --> 03:30.000
tunnel technology and add security to it.

57
03:30.000 --> 03:32.000
So how does it do this?

58
03:32.000 --> 03:38.000
Well, IPsec is going to start by defining some header types for us.

59
03:38.000 --> 03:42.360
And what we'll find is that we have two different primary options depending on

60
03:42.360 --> 03:43.000
the needs.

61
03:43.000 --> 03:46.620
Because we're approaching this from the perspective that we're sending this

62
03:46.620 --> 03:48.000
across the public internet,

63
03:48.000 --> 03:52.000
and we want to probably really lock those communications down.

64
03:52.000 --> 03:56.980
But we might also want to add a lighter level of security over a shared service

65
03:56.980 --> 03:59.000
provider network like MPLS,

66
03:59.000 --> 04:02.270
where we say, you know, we want to make sure that we're properly connecting to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
03:59.000 --> 04:02.270
where we say, you know, we want to make sure that we're properly connecting to

67
04:02.270 --> 04:03.000
our own devices,

68
04:03.000 --> 04:08.880
but we're going to trust the underlay to not leak our bids and bytes out to the

69
04:08.880 --> 04:10.000
public world.

70
04:10.000 --> 04:20.000
And so the first option that we have is known as authentication header or AH.

71
04:20.000 --> 04:25.910
Authentication header, again, AH from here on out, is going to use IP protocol

72
04:25.910 --> 04:27.000
number 51.

73
04:27.000 --> 04:30.140
So we always have to make sure that we're allowing this through our firewalls
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
04:27.000 --> 04:30.140
So we always have to make sure that we're allowing this through our firewalls

74
04:30.140 --> 04:32.000
if we're going to build a tunnel through one,

75
04:32.000 --> 04:34.000
or again, access control lists.

76
04:34.000 --> 04:38.120
And AH is going to place two different security layers on top of our tunnel

77
04:38.120 --> 04:39.000
mechanism,

78
04:39.000 --> 04:43.450
the first of which is authentication, as the name implies, we'd expect to add

79
04:43.450 --> 04:44.000
authentication.

80
04:44.000 --> 04:50.450
Authentication is essentially proving who I am so that I don't just have other

81
04:50.450 --> 04:54.000
random routers trying to build tunnels with me.

82
04:54.000 --> 04:57.400
If you want to build a tunnel with me, you have to prove that you are who you

83
04:57.400 --> 04:58.000
say you are,

84
04:58.000 --> 05:02.000
and usually we're going to use a hashing mechanism in order to do this.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
04:58.000 --> 05:02.000
and usually we're going to use a hashing mechanism in order to do this.

85
05:02.000 --> 05:07.000
Now, the second layer of security we're adding is known as data integrity,

86
05:07.000 --> 05:12.000
and data integrity is making sure that data remains unchanged.

87
05:12.000 --> 05:18.820
If I send a series of bits to you, I don't want anyone in the middle to be able

88
05:18.820 --> 05:20.000
to change that.

89
05:20.000 --> 05:25.600
And if somebody in the middle does get their hands on the packet and they're

90
05:25.600 --> 05:27.000
able to change what the packet says,

91
05:27.000 --> 05:30.000
we want to be able to detect this.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
05:27.000 --> 05:30.000
we want to be able to detect this.

92
05:30.000 --> 05:34.000
And so we're going to use the concept of a chuck summon order to do this.

93
05:34.000 --> 05:38.120
The interesting thing about AH, and this is the big thing, is that we notice

94
05:38.120 --> 05:40.000
that there is no encryption.

95
05:40.000 --> 05:44.000
And because there's no encryption, AH doesn't get used a whole lot.

96
05:44.000 --> 05:46.000
Again, it's a lighter flavor of security.

97
05:46.000 --> 05:50.730
It doesn't take as much processing power, and it might be appropriate when we

98
05:50.730 --> 05:54.000
feel like we have a secure underlay.

99
05:54.000 --> 05:58.000
But in general, we're not going to see a whole lot of this in production.

100
05:58.000 --> 06:03.070
Instead, we're going to see the second header type, which is known as the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
05:58.000 --> 06:03.070
Instead, we're going to see the second header type, which is known as the

101
06:03.070 --> 06:09.000
encapsulating security payload, or ESP.

102
06:09.000 --> 06:13.290
ESP is going to solve this problem of not supporting encryption by adding

103
06:13.290 --> 06:15.000
support for encryption.

104
06:15.000 --> 06:19.000
But first of all, let's just address this. It does use IP protocol 50.

105
06:19.000 --> 06:23.000
So one right after the other, 50 and 51 for these two header types.

106
06:23.000 --> 06:29.570
And then we also are going to see that it adds data confidentiality, which

107
06:29.570 --> 06:35.000
again is basically saying we're going to support encryption.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
06:29.570 --> 06:35.000
again is basically saying we're going to support encryption.

108
06:35.000 --> 06:40.160
It also, interestingly, adds NAT traversal. So we have a mechanism now for

109
06:40.160 --> 06:45.130
getting around NAT, which is especially important if we're performing this over

110
06:45.130 --> 06:46.000
the Internet.

111
06:46.000 --> 06:52.430
So if we're ever doing anything over the Internet, it really must be using ESP

112
06:52.430 --> 06:54.000
rather than AH.

113
06:54.000 --> 07:00.000
Now, IPsec adds definitions for a couple of modes of operation.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
06:54.000 --> 07:00.000
Now, IPsec adds definitions for a couple of modes of operation.

114
07:00.000 --> 07:03.940
These two modes are very important that we know the difference and can keep

115
07:03.940 --> 07:05.000
them straight.

116
07:05.000 --> 07:10.000
The first mode of operation is known as transport mode.

117
07:10.000 --> 07:17.000
And transport mode means that we are only encrypting the payload.

118
07:17.000 --> 07:22.410
So payload only is protected, meaning the only other part of the packet besides

119
07:22.410 --> 07:25.000
the payload is going to be the header information.

120
07:25.000 --> 07:30.680
And so if we want to protect the entire packet, we're going to have to use
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
07:25.000 --> 07:30.680
And so if we want to protect the entire packet, we're going to have to use

121
07:30.680 --> 07:32.000
tunnel mode.

122
07:32.000 --> 07:36.490
Tunnel mode is both the header. Again, we're talking about the inner header at

123
07:36.490 --> 07:38.000
this point. This is still a tunnel mechanism.

124
07:38.000 --> 07:43.000
So the inner header is protected as well as the payload.

125
07:43.000 --> 07:47.000
For the most part, we're going to see tunnel mode be adopted.

126
07:47.000 --> 07:52.160
Again, a lot of these protocols and mechanisms were created at a time when not

127
07:52.160 --> 07:54.000
every network device was super powerful.

128
07:54.000 --> 08:00.300
And so this is certainly more of a lightweight type of security deployment for
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
07:54.000 --> 08:00.300
And so this is certainly more of a lightweight type of security deployment for

129
08:00.300 --> 08:03.000
devices that have a harder time,

130
08:03.000 --> 08:07.360
maybe encrypting the entire packet. And that's the same concept up here that we

131
08:07.360 --> 08:11.000
saw with authentication header, where we have a lightweight version.

132
08:11.000 --> 08:14.990
In the modern network, we don't really struggle with this a whole lot, although

133
08:14.990 --> 08:20.000
encrypting a very high level of throughput,

134
08:20.000 --> 08:24.410
like a 10 or 40 gig pipe, is actually still very challenging. We need to make

135
08:24.410 --> 08:26.000
sure we have the right hardware in place to do that.

136
08:26.000 --> 08:30.710
For the most part, again, if we've got the right hardware in place, we're going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
08:26.000 --> 08:30.710
For the most part, again, if we've got the right hardware in place, we're going

137
08:30.710 --> 08:37.100
to see ESP used along with tunnel mode in order to fully support the

138
08:37.100 --> 08:40.000
protections that we need for our modern networks.

139
08:40.000 --> 08:45.490
Now one last component that IPsec defines for us is the concept of the

140
08:45.490 --> 08:47.000
transform set.

141
08:47.000 --> 08:53.690
There are a lot of encryption protocols, and there are a lot of authentication

142
08:53.690 --> 08:55.000
protocols.

143
08:55.000 --> 09:00.420
For example, for authentication, we've got things like MD5 hashes and SHA
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
08:55.000 --> 09:00.420
For example, for authentication, we've got things like MD5 hashes and SHA

144
09:00.420 --> 09:01.000
hashes.

145
09:01.000 --> 09:05.640
And with encryption, we have a lot of methodologies, including some more legacy

146
09:05.640 --> 09:08.000
ones like DES and triple DES.

147
09:08.000 --> 09:12.110
Again, these are legacy and we don't really use these anymore. But we do have

148
09:12.110 --> 09:15.000
lots of different versions of AES.

149
09:15.000 --> 09:23.100
And so we want to make sure that we define a set that tells the other side,

150
09:23.100 --> 09:25.000
basically when we're negotiating what we want to use.

151
09:25.000 --> 09:29.790
Do I want to use MD5 along with AES? Do I want to use SHA along with triple DES

152
09:29.790 --> 09:30.000
?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

152
09:29.790 --> 09:30.000
?

153
09:30.000 --> 09:34.600
And so the transform set sort of defines for me my authentication and

154
09:34.600 --> 09:41.560
encryption method, and it allows me to negotiate again back and forth with the

155
09:41.560 --> 09:43.000
other side.

156
09:43.000 --> 09:48.410
The transform set is going to be part of our iOSXC configuration where we

157
09:48.410 --> 09:54.000
define which authentication and which encryption methods that we want to use.