WEBVTT

1
00:00.000 --> 00:01.280 align:middle line:84%


2
00:01.280 --> 00:04.280 align:middle line:90%
Transport layer security, as we
looked at the previous video,

3
00:04.280 --> 00:06.680 align:middle line:90%
does a great job of
encrypting, and doing

4
00:06.680 --> 00:09.120 align:middle line:90%
data integrity for packets,
and protecting those packets

5
00:09.120 --> 00:10.370 align:middle line:84%
as they're crossing a network.

6
00:10.370 --> 00:13.580 align:middle line:90%
However, it's not the only
protocol that can do that.

7
00:13.580 --> 00:15.230 align:middle line:90%
One of the families
of protocols that's

8
00:15.230 --> 00:18.080 align:middle line:90%
dedicated to doing that
for VPN use, is called

9
00:18.080 --> 00:22.450 align:middle line:90%
I-P, capital I, capital
P, lowercase s-e-c.

10
00:22.450 --> 00:25.710 align:middle line:90%
And that's what I'd like to talk
with you about in this video.

11
00:25.710 --> 00:28.730 align:middle line:90%
So the purpose of IPsec
is two main things.

12
00:28.730 --> 00:30.620 align:middle line:90%
And that is privacy,
which we are
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:28.730 --> 00:30.620 align:middle line:90%
And that is privacy,
which we are

13
00:30.620 --> 00:33.470 align:middle line:90%
going to get through
encryption, and also

14
00:33.470 --> 00:36.410 align:middle line:90%
data integrity, which we
are going to get primarily

15
00:36.410 --> 00:40.910 align:middle line:90%
through some kind of a hashing
algorithm, or its cousin HMAC.

16
00:40.910 --> 00:42.440 align:middle line:90%
And we generally
are going to apply

17
00:42.440 --> 00:45.428 align:middle line:90%
IPsec as we're going
over untrusted networks,

18
00:45.428 --> 00:47.720 align:middle line:90%
or networks that we want to
protect the packets as they

19
00:47.720 --> 00:48.220 align:middle line:84%
cross.

20
00:48.220 --> 00:50.760 align:middle line:90%
So if we wanted to-- let's
take this as an example--

21
00:50.760 --> 00:51.950 align:middle line:84%
maybe this is the internet.

22
00:51.950 --> 00:54.640 align:middle line:90%
That certainly would be
an untrusted network.

23
00:54.640 --> 00:57.320 align:middle line:90%
What we do is we could
build a logical tunnel

24
00:57.320 --> 00:58.970 align:middle line:84%
over the network.

25
00:58.970 --> 01:01.472 align:middle line:90%
And a tunnel has two endpoint,
so if R1 is one endpoint,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:58.970 --> 01:01.472 align:middle line:90%
And a tunnel has two endpoint,
so if R1 is one endpoint,

26
01:01.472 --> 01:02.930 align:middle line:90%
and R2 is the other,
those would be

27
01:02.930 --> 01:05.910 align:middle line:84%
the ends of the IPsec tunnel.

28
01:05.910 --> 01:09.325 align:middle line:90%
So traffic from a
user like Bob here

29
01:09.325 --> 01:10.700 align:middle line:90%
was saying traffic
that was going

30
01:10.700 --> 01:14.780 align:middle line:90%
from 10.1.0.50 to 10.2.0.50,
if it hits this router,

31
01:14.780 --> 01:16.660 align:middle line:90%
and based on its
instructions, if it said,

32
01:16.660 --> 01:19.640 align:middle line:90%
hey, everything from
10.1.0 to 10.2.0 encrypt.

33
01:19.640 --> 01:22.850 align:middle line:90%
It would then encrypt the
data, and do hashing based

34
01:22.850 --> 01:24.080 align:middle line:84%
on the rules that we set up.

35
01:24.080 --> 01:26.330 align:middle line:90%
It would then forward it,
it would put a new IP header

36
01:26.330 --> 01:26.830 align:middle line:84%
on it.

37
01:26.830 --> 01:28.460 align:middle line:90%
And the source address
would be itself.

38
01:28.460 --> 01:30.668 align:middle line:90%
The destination would be
the other end of the tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:28.460 --> 01:30.668 align:middle line:90%
The destination would be
the other end of the tunnel.

39
01:30.668 --> 01:32.990 align:middle line:90%
And then the payload would
be the original packet,

40
01:32.990 --> 01:34.500 align:middle line:84%
but all encrypted.

41
01:34.500 --> 01:36.740 align:middle line:90%
And that way people on the
internet who eavesdrop,

42
01:36.740 --> 01:38.823 align:middle line:90%
without the keys
involved, would only

43
01:38.823 --> 01:40.490 align:middle line:90%
be able to go ahead
and see gobbly goop.

44
01:40.490 --> 01:43.030 align:middle line:90%
They wouldn't be able to
make sense of the payload.

45
01:43.030 --> 01:45.500 align:middle line:90%
So it gets encrypted,
shipped over the tunnel

46
01:45.500 --> 01:48.630 align:middle line:90%
to R2 who decrypts it, and
then it forwards it on its way.

47
01:48.630 --> 01:52.480 align:middle line:90%
Now in the world of IPsec,
there are two big camps.

48
01:52.480 --> 01:54.030 align:middle line:84%
There is IKEv1.

49
01:54.030 --> 01:59.270 align:middle line:90%
IKE stands for Internet Key
Exchange, and v1 means old.

50
01:59.270 --> 02:02.420 align:middle line:90%
And IKEv2, which is
more modular, more
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
01:59.270 --> 02:02.420 align:middle line:90%
And IKEv2, which is
more modular, more

51
02:02.420 --> 02:05.855 align:middle line:90%
moving parts, and more
compatible with other vendors.

52
02:05.855 --> 02:07.730 align:middle line:90%
Because if have Cisco
and your other vendors,

53
02:07.730 --> 02:09.380 align:middle line:90%
and they're all
using IKEv2, there's

54
02:09.380 --> 02:11.220 align:middle line:84%
more compatibility involved.

55
02:11.220 --> 02:13.280 align:middle line:90%
So I have separate
sets of videos

56
02:13.280 --> 02:17.313 align:middle line:90%
that are going to go into great
detail on both IKEv1 and IKEv2.

57
02:17.313 --> 02:19.730 align:middle line:90%
But I wanted to introduce it
here as one of the components

58
02:19.730 --> 02:22.855 align:middle line:90%
that we're going to leverage
in the world of cryptography

59
02:22.855 --> 02:24.230 align:middle line:90%
for protecting
packets as they're

60
02:24.230 --> 02:25.430 align:middle line:84%
being sent over network.

61
02:25.430 --> 02:30.268 align:middle line:90%
And that is the family of
protocols included in IPsec.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:25.430 --> 02:30.268 align:middle line:90%
And that is the family of
protocols included in IPsec.

62
02:30.268 --> 02:32.060 align:middle line:90%
So one of the other
questions that comes up

63
02:32.060 --> 02:33.800 align:middle line:90%
when dealing with
IPsec and IPsec

64
02:33.800 --> 02:36.200 align:middle line:90%
with virtual private
networks, basically tunnels

65
02:36.200 --> 02:38.970 align:middle line:90%
of IPsec traffic, is
how do you make sure,

66
02:38.970 --> 02:41.690 align:middle line:90%
how do we make sure that
router 1 or router 2

67
02:41.690 --> 02:43.440 align:middle line:90%
are actually talking
to the right devices?

68
02:43.440 --> 02:45.620 align:middle line:90%
How can they prove to
each other that they

69
02:45.620 --> 02:46.880 align:middle line:84%
are who they claim to be.

70
02:46.880 --> 02:50.047 align:middle line:90%
And we have two basic
options for that with IPsec.

71
02:50.047 --> 02:52.130 align:middle line:90%
We're going to take a look
at those authentication

72
02:52.130 --> 02:53.760 align:middle line:84%
options in the next video.

73
02:53.760 --> 02:55.740 align:middle line:90%
So I'll see you there
in just a moment.

74
02:55.740 --> 02:58.190 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

75
02:58.190 --> 03:01.450 align:middle line:90%
and I'd like to thank
you for viewing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:58.190 --> 03:01.450 align:middle line:90%
and I'd like to thank
you for viewing.