WEBVTT

1
00:00.000 --> 00:08.000
So before we jump right in and start configuring IPsec on our routers, let's

2
00:08.000 --> 00:08.560
talk a little

3
00:08.560 --> 00:12.600
bit first about the IPsec framework.

4
00:12.600 --> 00:17.060
These are the different parts that make up IPsec, the different options we have

5
00:17.060 --> 00:17.200
, so we

6
00:17.200 --> 00:20.680
at least have a little bit of an idea what we're configuring when we do jump

7
00:20.680 --> 00:21.240
into the

8
00:21.240 --> 00:23.920
command line and configure this.

9
00:23.920 --> 00:30.040
So let's talk a little bit about the IPsec framework.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:23.920 --> 00:30.040
So let's talk a little bit about the IPsec framework.

10
00:30.040 --> 00:40.310
So IPsec or IP security is an open standard protocol suite to authenticate and

11
00:40.310 --> 00:40.920
encrypt

12
00:40.920 --> 00:43.800
packets over a public network.

13
00:43.800 --> 00:47.560
Of course, the most popular being the internet itself.

14
00:47.560 --> 00:51.540
Now of course, this could also be used on a private network if that's part of

15
00:51.540 --> 00:52.360
your security

16
00:52.360 --> 00:58.460
plan, but of course, its most common use is over that public network, such as

17
00:58.460 --> 00:59.860
the internet.

18
00:59.860 --> 01:04.920
Of course, the reason we call it a suite is it consists of several different
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:59.860 --> 01:04.920
Of course, the reason we call it a suite is it consists of several different

19
01:04.920 --> 01:05.720
protocols

20
01:05.720 --> 01:08.000
that perform various functions.

21
01:08.000 --> 01:13.880
One of those is authentication header or AH.

22
01:13.880 --> 01:20.680
This is not going to be our main focus, but AH does provide two major functions

23
01:20.680 --> 01:20.760
.

24
01:20.760 --> 01:26.120
It does provide data integrity and provides authentication.

25
01:26.120 --> 01:30.890
So we're making sure the other side is who they say they are and that the data
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
01:26.120 --> 01:30.890
So we're making sure the other side is who they say they are and that the data

26
01:30.890 --> 01:31.440
has not

27
01:31.440 --> 01:33.440
been compromised.

28
01:33.440 --> 01:40.040
Optionally, it can also protect against replay attacks and also be aware just

29
01:40.040 --> 01:40.920
in case we

30
01:40.920 --> 01:45.720
need to get this through a firewall or something along those lines, maybe an IP

31
01:45.720 --> 01:46.760
packet filter,

32
01:46.760 --> 01:54.120
be aware that this does run directly on top of IP as protocol 51.

33
01:54.120 --> 01:57.740
Now the one that we're going to be focusing on and you'll see why here very

34
01:57.740 --> 01:58.960
shortly is

35
01:58.960 --> 02:04.760
the encapsulation security payload or ESP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:58.960 --> 02:04.760
the encapsulation security payload or ESP.

36
02:04.760 --> 02:11.270
Now this also provides data integrity and authentication, but of course, the

37
02:11.270 --> 02:12.240
really big

38
02:12.240 --> 02:18.440
thing added here with ESP is the confidentiality.

39
02:18.440 --> 02:21.240
This is the actual encryption.

40
02:21.240 --> 02:27.350
So above and beyond what AH does, ESP of course brings this confidentiality to

41
02:27.350 --> 02:28.800
the table, which

42
02:28.800 --> 02:31.480
is one of our main concerns.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
02:28.800 --> 02:31.480
is one of our main concerns.

43
02:31.480 --> 02:34.680
It also of course protects against replay attacks.

44
02:34.680 --> 02:40.320
However, it differs in that it still runs on top of the IP protocol.

45
02:40.320 --> 02:43.560
However, it uses protocol 50.

46
02:43.560 --> 02:48.160
Of course, we will see this as we move through the rest of the skill.

47
02:48.160 --> 02:54.320
Another component of the IPsec framework is the Internet Security Association

48
02:54.320 --> 02:54.960
and Key

49
02:54.960 --> 03:00.600
Management Protocol, quite a mouthful or ICECAM.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
02:54.960 --> 03:00.600
Management Protocol, quite a mouthful or ICECAM.

50
03:00.600 --> 03:06.270
This provides the framework for the authentication and the key exchange that we

51
03:06.270 --> 03:07.200
're going to

52
03:07.200 --> 03:10.040
be using for our encryption.

53
03:10.040 --> 03:15.200
This incorporates ICEC, which is Internet Key Exchange.

54
03:15.200 --> 03:20.180
It also includes ICEC version 2, which of course is a more updated version of

55
03:20.180 --> 03:20.800
ICEC.

56
03:20.800 --> 03:23.520
This is the one that we're going to be implementing.

57
03:23.520 --> 03:29.060
It also uses pre-shared keys and some other various options, such as

58
03:29.060 --> 03:30.600
certificates.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
03:29.060 --> 03:30.600
certificates.

59
03:30.600 --> 03:35.520
We'll be focusing on ICEC version 2 with pre-shared keys.

60
03:35.520 --> 03:42.370
Now ICECAM's primary function is to create the Security Association or the SA

61
03:42.370 --> 03:43.080
that's

62
03:43.080 --> 03:49.160
going to be used by AH or ESP that we just discussed.

63
03:49.160 --> 03:54.160
Well, what is the Security Association that we're creating here?

64
03:54.160 --> 03:59.930
Well quite simply, this is used to establish the security attributes that are

65
03:59.930 --> 04:00.800
supported
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
03:59.930 --> 04:00.800
supported

66
04:00.800 --> 04:03.200
by each of our peers.

67
04:03.200 --> 04:08.330
There are a lot of different encryption algorithms, hashing mechanisms for

68
04:08.330 --> 04:09.640
authentication, different

69
04:09.640 --> 04:11.600
authentication methods.

70
04:11.600 --> 04:13.920
These are all listed of course down below here.

71
04:13.920 --> 04:22.040
We have things like AES, SHA, pre-shared secrets, ICEC, certificates and so on.

72
04:22.040 --> 04:26.910
There's a lot of choices and we don't need to be aware of all of them right now

73
04:26.910 --> 04:27.040
.

74
04:27.040 --> 04:31.360
Generally speaking, we're probably going to choose the most secure options that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
04:27.040 --> 04:31.360
Generally speaking, we're probably going to choose the most secure options that

75
04:31.360 --> 04:32.280
our devices

76
04:32.280 --> 04:33.640
support.

77
04:33.640 --> 04:39.050
But the point of the Security Association is we can have multiple choices for

78
04:39.050 --> 04:39.720
each one

79
04:39.720 --> 04:47.000
of these and then the devices can pick from that list what they want to use and

80
04:47.000 --> 04:47.560
again,

81
04:47.560 --> 04:52.010
most devices will choose the best option out of all the ones that are

82
04:52.010 --> 04:53.080
configured.

83
04:53.080 --> 04:59.840
One more thing we want to make sure we talk about is that both AH and ESP can

84
04:59.840 --> 05:00.760
operate
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
04:59.840 --> 05:00.760
operate

85
05:00.760 --> 05:04.320
in either transport or tunnel mode.

86
05:04.320 --> 05:09.080
Now once again, we're going to focus on tunnel mode but we should understand

87
05:09.080 --> 05:10.680
both of them.

88
05:10.680 --> 05:16.300
So since we will be focusing on ESP, let's take a look at the difference

89
05:16.300 --> 05:17.920
between transport

90
05:17.920 --> 05:22.920
and tunnel mode specifically for ESP.

91
05:22.920 --> 05:30.560
So in transport mode, the IP payload is encrypted.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
05:22.920 --> 05:30.560
So in transport mode, the IP payload is encrypted.

92
05:30.560 --> 05:36.070
If we look over here at our diagram, we can see here that the payload is above

93
05:36.070 --> 05:37.240
the encrypted

94
05:37.240 --> 05:38.600
section.

95
05:38.600 --> 05:44.000
So the payload and the ESP trailer are both encrypted.

96
05:44.000 --> 05:50.220
The original IP header is used for the routing and is therefore not encrypted,

97
05:50.220 --> 05:51.040
we can see

98
05:51.040 --> 05:53.520
that header right out here.

99
05:53.520 --> 05:59.800
So in summary, it's really only the payload that is protected end to end.

100
05:59.800 --> 06:04.890
This method is generally used, of course, there's always exceptions, but this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
05:59.800 --> 06:04.890
This method is generally used, of course, there's always exceptions, but this

101
06:04.890 --> 06:05.720
is generally

102
06:05.720 --> 06:09.920
used for host to host encryption.

103
06:09.920 --> 06:16.280
So for example, PC to PC, maybe for a remote access connection.

104
06:16.280 --> 06:22.660
Tunnel mode, which again is what we're going to be focusing on, creates a new

105
06:22.660 --> 06:23.400
IP header.

106
06:23.400 --> 06:28.800
We can see that new IP header right here in our diagram and that's what's used

107
06:28.800 --> 06:29.440
for actually

108
06:29.440 --> 06:31.400
forwarding the packet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
06:29.440 --> 06:31.400
forwarding the packet.

109
06:31.400 --> 06:37.800
The new header allows the entire original packet to be encrypted.

110
06:37.800 --> 06:39.920
So what does that really mean?

111
06:39.920 --> 06:46.400
It means that the original IP header and the payload are above the encrypted

112
06:46.400 --> 06:47.920
section for

113
06:47.920 --> 06:49.600
tunnel mode.

114
06:49.600 --> 06:56.290
Now this method can also be used for host to host VPNs, but it's most commonly

115
06:56.290 --> 06:57.360
used for

116
06:57.360 --> 07:02.320
site to site VPNs, which is of course our main focus.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
06:57.360 --> 07:02.320
site to site VPNs, which is of course our main focus.

117
07:02.320 --> 07:09.020
It can also of course be used for those remote access or host to network VPNs

118
07:09.020 --> 07:10.120
as well.

119
07:10.120 --> 07:14.870
So now that we have a bit of an understanding about the different moving parts

120
07:14.870 --> 07:15.800
for IP stack,

121
07:15.800 --> 07:19.990
let's jump into the command line and get this configured for our currently

122
07:19.990 --> 07:21.880
unprotected tunnel.

123
07:21.880 --> 07:26.430
Of course, the first step for that will be to configure the components needed

124
07:26.430 --> 07:26.680
for

125
07:26.680 --> 07:30.020
like version two using a pre-shared key.