WEBVTT

1
00:00.000 --> 00:01.500 align:middle line:84%


2
00:01.500 --> 00:03.023 align:middle line:90%
One of the cool
things about IPsec

3
00:03.023 --> 00:05.190 align:middle line:90%
is that it's not always
implemented in the same way.

4
00:05.190 --> 00:06.930 align:middle line:90%
I mean we want the
protection of IPsec,

5
00:06.930 --> 00:09.870 align:middle line:90%
but it's not always implemented
with the same exact protocols

6
00:09.870 --> 00:10.890 align:middle line:84%
or the same methods.

7
00:10.890 --> 00:13.710 align:middle line:90%
So, in this video I'd like
to do an overview of IPsec

8
00:13.710 --> 00:16.030 align:middle line:90%
and a few of our options
regarding using it.

9
00:16.030 --> 00:18.420 align:middle line:90%
So, regardless of how we
implement it the goal of IPsec

10
00:18.420 --> 00:21.400 align:middle line:90%
is to protect packets and we
are protecting basically two

11
00:21.400 --> 00:21.900 align:middle line:84%
things.

12
00:21.900 --> 00:25.020 align:middle line:90%
We want to protect the
confidentiality, or the privacy

13
00:25.020 --> 00:27.070 align:middle line:90%
of those packets, so if
someone is eavesdropping

14
00:27.070 --> 00:29.070 align:middle line:90%
and they look at a packet
then they can't really

15
00:29.070 --> 00:30.330 align:middle line:84%
make sense of the payload.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.070 --> 00:30.330 align:middle line:84%
make sense of the payload.

16
00:30.330 --> 00:33.030 align:middle line:90%
The other element we want to
protect is the data integrity.

17
00:33.030 --> 00:35.280 align:middle line:90%
And with data integrity
we want confidence

18
00:35.280 --> 00:37.140 align:middle line:90%
that the packet hasn't
been manipulated

19
00:37.140 --> 00:38.640 align:middle line:90%
or that the data
hasn't been changed

20
00:38.640 --> 00:40.390 align:middle line:90%
by somebody who doesn't
have the authority

21
00:40.390 --> 00:41.442 align:middle line:84%
to make those changes.

22
00:41.442 --> 00:42.900 align:middle line:90%
And the main way
of getting privacy

23
00:42.900 --> 00:45.300 align:middle line:90%
is through encrypting
the data and the main way

24
00:45.300 --> 00:47.880 align:middle line:90%
of getting data integrity
is some type of hashing,

25
00:47.880 --> 00:50.990 align:middle line:90%
or a derivative of hashing,
which we'll talk more about.

26
00:50.990 --> 00:53.490 align:middle line:90%
So, let's talk about where we
want the privacy and integrity

27
00:53.490 --> 00:54.450 align:middle line:84%
to potentially happen.

28
00:54.450 --> 00:56.158 align:middle line:90%
Maybe we have two
sites, site 1 over here

29
00:56.158 --> 00:58.090 align:middle line:90%
on the left, site 2
over here on the right,

30
00:58.090 --> 01:01.410 align:middle line:90%
and we have network
10.1.0, 10.2.0 over here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
00:58.090 --> 01:01.410 align:middle line:90%
and we have network
10.1.0, 10.2.0 over here,

31
01:01.410 --> 01:03.000 align:middle line:90%
and we want to protect
with encryption

32
01:03.000 --> 01:06.330 align:middle line:90%
and hashing all the
traffic between site 1

33
01:06.330 --> 01:08.610 align:middle line:84%
from 10.1.0 going to 10.2.0.

34
01:08.610 --> 01:10.670 align:middle line:90%
So, what we do is
have a tunnel--

35
01:10.670 --> 01:13.170 align:middle line:90%
or a set of tunnels as we'll
discover here in a little bit--

36
01:13.170 --> 01:16.050 align:middle line:90%
we'll have some tunnels built up
logically so that traffic that

37
01:16.050 --> 01:18.840 align:middle line:90%
leaves the PC goes to
this router eventually

38
01:18.840 --> 01:20.430 align:middle line:84%
to get routed over the network.

39
01:20.430 --> 01:22.230 align:middle line:90%
And router 1 sees
this as, oh you

40
01:22.230 --> 01:24.060 align:middle line:90%
know what I'm going
to take this packet

41
01:24.060 --> 01:28.020 align:middle line:90%
and the source IP is
PC1, the destination IP

42
01:28.020 --> 01:31.110 align:middle line:90%
is PC2 for this purpose,
so that's the source,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:28.020 --> 01:31.110 align:middle line:90%
is PC2 for this purpose,
so that's the source,

43
01:31.110 --> 01:32.115 align:middle line:84%
that's the destination.

44
01:32.115 --> 01:33.990 align:middle line:90%
So, the router says, oh
before I route that I

45
01:33.990 --> 01:35.198 align:middle line:84%
need to protect that traffic.

46
01:35.198 --> 01:38.130 align:middle line:90%
So, what the router will do is
take all this data right here

47
01:38.130 --> 01:38.970 align:middle line:84%
and it will encrypt.

48
01:38.970 --> 01:41.850 align:middle line:90%
And R1 is going to
encrypt that data using

49
01:41.850 --> 01:43.190 align:middle line:84%
a set of key material.

50
01:43.190 --> 01:46.380 align:middle line:90%
And the secret is if you encrypt
with symmetrical encryption--

51
01:46.380 --> 01:49.380 align:middle line:90%
if you encrypt the data with
a key you can decrypt it

52
01:49.380 --> 01:50.680 align:middle line:84%
if you have that same key.

53
01:50.680 --> 01:53.490 align:middle line:90%
So, the keys are
known by R1 and R2.

54
01:53.490 --> 01:54.900 align:middle line:84%
So, R1 encrypts this.

55
01:54.900 --> 01:56.910 align:middle line:90%
It then adds a
little ESP header.

56
01:56.910 --> 01:58.950 align:middle line:90%
There's also an option
for a UDP header,

57
01:58.950 --> 02:00.400 align:middle line:84%
we'll talk about that later.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
01:58.950 --> 02:00.400 align:middle line:84%
we'll talk about that later.

58
02:00.400 --> 02:03.540 align:middle line:90%
But ESP is layer 4 protocol
50 for encapsulating security

59
02:03.540 --> 02:07.110 align:middle line:90%
payload and it's going to
add on top of that a new IP

60
02:07.110 --> 02:09.580 align:middle line:90%
header, except this time
the IP header is going

61
02:09.580 --> 02:14.320 align:middle line:90%
to be a source address of R1
and a destination address of R2.

62
02:14.320 --> 02:17.660 align:middle line:90%
So, the internet would just see
the packet coming from R1 going

63
02:17.660 --> 02:19.800 align:middle line:90%
to R2, at layer 4
it would like ESP,

64
02:19.800 --> 02:22.820 align:middle line:90%
a little ESP header there, and
then the rest of the content

65
02:22.820 --> 02:24.120 align:middle line:84%
all encrypted.

66
02:24.120 --> 02:25.980 align:middle line:90%
So, it'd just be
gobbledygook if anybody's

67
02:25.980 --> 02:27.910 align:middle line:84%
eavesdropping on the internet.

68
02:27.910 --> 02:32.230 align:middle line:90%
So, this is an example
of a site-to-site IPsec
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:27.910 --> 02:32.230 align:middle line:90%
So, this is an example
of a site-to-site IPsec

69
02:32.230 --> 02:36.000 align:middle line:90%
VPN between site 1 and
site 2, between two sites.

70
02:36.000 --> 02:38.520 align:middle line:90%
Another option we have
for IPsec VPN tunnels

71
02:38.520 --> 02:41.130 align:middle line:84%
is referred to as remote access.

72
02:41.130 --> 02:44.310 align:middle line:90%
And that refers to a
single computer or device

73
02:44.310 --> 02:46.110 align:middle line:90%
that needs to
build a VPN tunnel,

74
02:46.110 --> 02:47.880 align:middle line:84%
like to corporate headquarters.

75
02:47.880 --> 02:50.910 align:middle line:90%
So, it launches the AnyConnect
client or some other VPN

76
02:50.910 --> 02:54.120 align:middle line:90%
client, builds a connection,
negotiates that tunnel

77
02:54.120 --> 02:57.270 align:middle line:90%
with the hidden device, and
now has a remote access VPN

78
02:57.270 --> 03:00.930 align:middle line:90%
from that one PC over to
the headend server, which
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
02:57.270 --> 03:00.930 align:middle line:90%
from that one PC over to
the headend server, which

79
03:00.930 --> 03:02.760 align:middle line:90%
could be a Cisco
firewall, it could

80
03:02.760 --> 03:05.820 align:middle line:90%
be a Cisco router, or a
dedicated device handling

81
03:05.820 --> 03:07.290 align:middle line:84%
that VPN connection.

82
03:07.290 --> 03:10.028 align:middle line:90%
Now, in a world of IPsec
there's two camps as far as

83
03:10.028 --> 03:11.320 align:middle line:84%
how do you build these tunnels.

84
03:11.320 --> 03:14.010 align:middle line:90%
There's IKE, which stands
for Internet Key exchange.

85
03:14.010 --> 03:17.700 align:middle line:90%
IKE version 1 and there's also
IKE, Internet Key exchange,

86
03:17.700 --> 03:20.920 align:middle line:90%
version 2 and we
could use either one

87
03:20.920 --> 03:22.270 align:middle line:84%
if our gear supports it.

88
03:22.270 --> 03:24.570 align:middle line:90%
So, I will put in
a separate video

89
03:24.570 --> 03:28.890 align:middle line:90%
a comparison and contrasting
between IKEv1 and IKEv2

90
03:28.890 --> 03:31.770 align:middle line:90%
regarding building IPsec
tunnels, but at this point
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:28.890 --> 03:31.770 align:middle line:90%
regarding building IPsec
tunnels, but at this point

91
03:31.770 --> 03:33.850 align:middle line:90%
I just wanted to share
with you that they exist.

92
03:33.850 --> 03:35.700 align:middle line:90%
So, we've mentioned
site-to-site tunnels,

93
03:35.700 --> 03:38.070 align:middle line:90%
we mentioned remote
access tunnels,

94
03:38.070 --> 03:40.110 align:middle line:90%
and if we'd had a
headquarters location

95
03:40.110 --> 03:42.750 align:middle line:90%
and we had multiple sites and
we wanted to build VPN tunnels,

96
03:42.750 --> 03:44.950 align:middle line:90%
we could have multiple
Site2Site tunnels.

97
03:44.950 --> 03:47.850 align:middle line:90%
So, maybe this is
R3 and this is R4

98
03:47.850 --> 03:50.460 align:middle line:90%
and we also have the
option of building

99
03:50.460 --> 03:52.070 align:middle line:84%
spoke to spoke tunnels too.

100
03:52.070 --> 03:54.900 align:middle line:90%
So, if we wanted direct
spoke to spoke IPsec paths

101
03:54.900 --> 03:56.145 align:middle line:84%
we could do that as well.

102
03:56.145 --> 03:58.020 align:middle line:90%
And to leverage that,
one of the technologies

103
03:58.020 --> 04:00.228 align:middle line:84%
that does that is DMVPN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:58.020 --> 04:00.228 align:middle line:84%
that does that is DMVPN.

104
04:00.228 --> 04:02.520 align:middle line:90%
We'll introduce that in a
separate video here coming up

105
04:02.520 --> 04:03.430 align:middle line:84%
as well.

106
04:03.430 --> 04:05.680 align:middle line:90%
So, I wanted to point out
that the options for getting

107
04:05.680 --> 04:08.370 align:middle line:90%
where we want to overlay these
IPsec tunnels, it's there's

108
04:08.370 --> 04:10.440 align:middle line:90%
quite a variety of
options that we can use.

109
04:10.440 --> 04:11.610 align:middle line:90%
And before I close
this video there's

110
04:11.610 --> 04:13.840 align:middle line:90%
also one other option I'd
like to talk with you about

111
04:13.840 --> 04:16.410 align:middle line:90%
and that is how we
actually implement,

112
04:16.410 --> 04:18.870 align:middle line:90%
not just where we implement
the tunnels, but how.

113
04:18.870 --> 04:20.670 align:middle line:90%
The older way of
doing it would be

114
04:20.670 --> 04:22.820 align:middle line:90%
to use what was
called a crypto map.

115
04:22.820 --> 04:24.600 align:middle line:90%
And a crypto map
simply has instructions

116
04:24.600 --> 04:27.960 align:middle line:90%
that says, OK traffic from this
network going to this network,

117
04:27.960 --> 04:30.570 align:middle line:90%
as an example if the
router sees it we'd
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
04:27.960 --> 04:30.570 align:middle line:90%
as an example if the
router sees it we'd

118
04:30.570 --> 04:32.607 align:middle line:90%
apply a crypto map
to an interface

119
04:32.607 --> 04:35.190 align:middle line:90%
and when it sees that traffic,
it would then go ahead encrypt,

120
04:35.190 --> 04:36.940 align:middle line:90%
ship it over to the
pair who would decrypt

121
04:36.940 --> 04:38.320 align:middle line:84%
and forward it this way.

122
04:38.320 --> 04:40.200 align:middle line:90%
However, that crypto
map option that we

123
04:40.200 --> 04:43.410 align:middle line:90%
used for a long, long time
wasn't quite as flexible

124
04:43.410 --> 04:44.370 align:middle line:84%
as we needed it to be.

125
04:44.370 --> 04:47.710 align:middle line:90%
So, another way of doing it is
to create tunnel interfaces.

126
04:47.710 --> 04:50.580 align:middle line:90%
So, for example
interface tunnel 0,

127
04:50.580 --> 04:53.370 align:middle line:90%
which by default is going to
use generic route encapsulation

128
04:53.370 --> 04:55.300 align:middle line:84%
as the layer 4 protocol.

129
04:55.300 --> 04:57.390 align:middle line:90%
But what we can do is
we can take a tunnel

130
04:57.390 --> 04:59.370 align:middle line:90%
and we can actually
put on that tunnel

131
04:59.370 --> 05:02.530 align:middle line:90%
an IPsec profile, which
basically says any traffic that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
04:59.370 --> 05:02.530 align:middle line:90%
an IPsec profile, which
basically says any traffic that

132
05:02.530 --> 05:05.680 align:middle line:90%
goes in or out of the tunnel
is going to have cryptography

133
05:05.680 --> 05:06.640 align:middle line:84%
applied to it.

134
05:06.640 --> 05:12.310 align:middle line:90%
And they refer to that as a
VTI, a virtual tunnel interface.

135
05:12.310 --> 05:14.440 align:middle line:90%
Think of a VTI, a,
virtual tunnel interface,

136
05:14.440 --> 05:18.130 align:middle line:90%
for IPsec as a tunnel that's
using an IPsec profile

137
05:18.130 --> 05:19.400 align:middle line:84%
to protect the traffic.

138
05:19.400 --> 05:21.910 align:middle line:90%
And there's a few options and
variables within the VTI world

139
05:21.910 --> 05:23.950 align:middle line:90%
as well that we'll
also discuss as we

140
05:23.950 --> 05:25.400 align:middle line:84%
proceed through these videos.

141
05:25.400 --> 05:28.090 align:middle line:90%
So, now that we've taken a
look at some options for IPsec

142
05:28.090 --> 05:30.250 align:middle line:90%
let's dig in deeper
in the next video
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:28.090 --> 05:30.250 align:middle line:90%
let's dig in deeper
in the next video

143
05:30.250 --> 05:33.370 align:middle line:90%
and take a look at some
of the specifics for IKEv1

144
05:33.370 --> 05:36.280 align:middle line:90%
and we'll contrast that to
IKEv2 because they can both be

145
05:36.280 --> 05:38.162 align:middle line:84%
used to build IPsec tunnels.

146
05:38.162 --> 05:40.370 align:middle line:90%
So, I'll see you in that
next video in just a moment.

147
05:40.370 --> 05:42.880 align:middle line:90%
Meanwhile, I hope this has
been informative for you

148
05:42.880 --> 05:46.290 align:middle line:90%
and I'd like to thank
you for viewing.