WEBVTT

1
00:00.000 --> 00:07.880
So I'm sure we can all agree that the Internet is going to be one of our best

2
00:07.880 --> 00:12.000
choices for connecting to cloud service providers.

3
00:12.000 --> 00:16.150
Of course, all of the cloud providers are connected to the Internet as our most

4
00:16.150 --> 00:17.000
companies.

5
00:17.000 --> 00:21.000
So it just would make sense that that would be one of our choices.

6
00:21.000 --> 00:33.480
However, it does, of course, bring up a bit of a problem. We need to make sure
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

6
00:21.000 --> 00:33.480
However, it does, of course, bring up a bit of a problem. We need to make sure

7
00:33.480 --> 00:35.580
that our data is protected when passing through the Internet because of course,

8
00:35.580 --> 00:37.570
that is a totally public network where essentially almost anybody could

9
00:37.570 --> 00:43.000
potentially intercept our traffic and potentially read sensitive information.

10
00:43.000 --> 00:54.370
So, as we're sending our traffic through the Internet, it needs to be protected

11
00:54.370 --> 00:55.000
. And of course, one of the fundamental ways to do that is with a standards

12
00:55.000 --> 00:55.000
suite called IPsec.

13
00:55.000 --> 01:00.300
So in this video, our goal is going to be to jump in and take a look at some of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:55.000 --> 01:00.300
So in this video, our goal is going to be to jump in and take a look at some of

14
01:00.300 --> 01:06.000
the moving parts of IPsec and get a more detailed look at how it operates.

15
01:06.000 --> 01:11.180
So, of course, the big advantage of using the Internet to connect to public

16
01:11.180 --> 01:16.750
cloud providers is it's very convenient, because of course, almost everybody

17
01:16.750 --> 01:19.000
has an Internet connection.

18
01:19.000 --> 01:23.410
And it is a fairly affordable method, generally because again, most companies

19
01:23.410 --> 01:27.070
already have an Internet connection and they're just going to use that same

20
01:27.070 --> 01:28.000
connection.

21
01:28.000 --> 01:32.270
Now, there are, of course, other choices that we will discuss later in this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
01:28.000 --> 01:32.270
Now, there are, of course, other choices that we will discuss later in this

22
01:32.270 --> 01:37.000
course, but for now, we're going to start with connecting using the Internet.

23
01:37.000 --> 01:42.000
Now, the problem, of course, with using the Internet is it's public.

24
01:42.000 --> 01:46.000
It's, of course, the world's largest public network.

25
01:46.000 --> 01:51.160
And therefore, any data that's crossing that Internet is, of course, going to

26
01:51.160 --> 01:56.280
be unprotected, which means that bad actors could potentially intercept this

27
01:56.280 --> 01:59.000
traffic and capture sensitive data.

28
01:59.000 --> 02:05.000
Now, there are several ways to provide protection to this traffic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
01:59.000 --> 02:05.000
Now, there are several ways to provide protection to this traffic.

29
02:05.000 --> 02:10.210
IPsec, which is our current topic is, of course, one of them. Just as another

30
02:10.210 --> 02:15.000
example, there's also something called SSL or secure socket layer.

31
02:15.000 --> 02:19.970
That can either secure things like just in a browser, like maybe between you

32
02:19.970 --> 02:25.000
and your bank, for example, those websites will use SSL to secure them.

33
02:25.000 --> 02:31.300
But there is also something called SSL VPN, where we can actually use SSL to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
02:25.000 --> 02:31.300
But there is also something called SSL VPN, where we can actually use SSL to

34
02:31.300 --> 02:35.000
secure a VPN or a virtual private network.

35
02:35.000 --> 02:38.000
So there are definitely other ways to do this.

36
02:38.000 --> 02:43.000
However, for the sake of this course, we will be focusing mostly on IPsec.

37
02:43.000 --> 02:49.600
Now, where we're looking to use this is going to be between our on-prem devices

38
02:49.600 --> 02:50.000
.

39
02:50.000 --> 02:55.970
So maybe at our headquarters or maybe at a remote site and the various cloud

40
02:55.970 --> 03:02.190
providers, such as, again, we have AWS with their VPCs or virtual private
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
02:55.970 --> 03:02.190
providers, such as, again, we have AWS with their VPCs or virtual private

41
03:02.190 --> 03:03.000
clouds.

42
03:03.000 --> 03:07.000
That, by the way, is how Google refers to their networks as well.

43
03:07.000 --> 03:14.000
And Azure refers to these as virtual networks or vnets.

44
03:14.000 --> 03:18.350
So really, whichever cloud provider we're talking about using, maybe even more

45
03:18.350 --> 03:24.000
than one, we need to secure the traffic going between these locations.

46
03:24.000 --> 03:28.000
To that end is where we're going to want to use IPsec.

47
03:28.000 --> 03:31.000
So what is IPsec?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
03:28.000 --> 03:31.000
So what is IPsec?

48
03:31.000 --> 03:35.000
Well, it's a framework of open standards.

49
03:35.000 --> 03:41.440
Now, since it is a framework, it means that there's sort of different choices

50
03:41.440 --> 03:44.000
we can use within IPsec itself.

51
03:44.000 --> 03:49.200
So given that there's different choices, it becomes fundamental to understand

52
03:49.200 --> 03:52.000
what IPsec is actually trying to provide.

53
03:52.000 --> 03:56.000
And it's providing first confidentiality.

54
03:56.000 --> 04:01.230
Also known as encryption, this is what's keeping people from being able to read
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
03:56.000 --> 04:01.230
Also known as encryption, this is what's keeping people from being able to read

55
04:01.230 --> 04:04.000
your data as it passes through the network.

56
04:04.000 --> 04:09.630
In addition to the confidentiality of the data, we also need to make sure that

57
04:09.630 --> 04:15.120
the data integrity is still good, meaning that the data hasn't been altered in

58
04:15.120 --> 04:16.000
transit.

59
04:16.000 --> 04:19.000
So it's not just about somebody else being able to read it.

60
04:19.000 --> 04:23.490
We also need to make sure they haven't corrupted the data in some way, and that

61
04:23.490 --> 04:26.000
it arrives the same way that it was sent.

62
04:26.000 --> 04:30.800
We also want to bring authentication to the table to make sure that we're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
04:26.000 --> 04:30.800
We also want to bring authentication to the table to make sure that we're

63
04:30.800 --> 04:36.140
actually talking to the correct other party, and we're not talking to somebody

64
04:36.140 --> 04:40.520
who's trying to spoof an identity and make it look like we're talking to

65
04:40.520 --> 04:42.000
somebody we're not.

66
04:42.000 --> 04:47.000
Another protection we want to be aware of is anti replay.

67
04:47.000 --> 04:51.490
This is to make sure that somebody can't, for example, capture you authent

68
04:51.490 --> 04:55.000
icating to something, wait a little bit,

69
04:55.000 --> 05:00.250
and then replay those same packets back to the same device, trying to authent
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
04:55.000 --> 05:00.250
and then replay those same packets back to the same device, trying to authent

70
05:00.250 --> 05:05.100
icate you at a later date, simply by duplicating the packets, even though maybe

71
05:05.100 --> 05:08.000
they can't read them because of encryption.

72
05:08.000 --> 05:12.590
If they just replay the same things, they might be able to bypass the

73
05:12.590 --> 05:14.000
authentication.

74
05:14.000 --> 05:17.000
Anti replay prevents that from happening.

75
05:17.000 --> 05:22.940
One last thing we're usually worried about with IPsec is some form of key

76
05:22.940 --> 05:24.000
management.

77
05:24.000 --> 05:29.200
In order to do this confidentiality and encryption we talked about up here, we

78
05:29.200 --> 05:32.000
are going to need encryption keys.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
05:29.200 --> 05:32.000
are going to need encryption keys.

79
05:32.000 --> 05:35.000
Authentication also can use keys.

80
05:35.000 --> 05:39.160
So we need to be concerned about how these keys are going to be managed, how

81
05:39.160 --> 05:43.490
the keys get shared with the other side, because again, if somebody were to

82
05:43.490 --> 05:47.830
intercept the keys, well, they would then either be able to authenticate or

83
05:47.830 --> 05:50.000
read the data through the encryption.

84
05:50.000 --> 05:55.550
So this is basically what we're looking towards IPsec to provide for us in one

85
05:55.550 --> 05:57.000
way or another.

86
05:57.000 --> 06:04.000
So in order to accomplish this, IPsec uses two main protocols.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
05:57.000 --> 06:04.000
So in order to accomplish this, IPsec uses two main protocols.

87
06:04.000 --> 06:09.000
The first of these is authentication header or AH.

88
06:09.000 --> 06:13.000
Now some things we want to be aware of with AH.

89
06:13.000 --> 06:19.000
First, it runs directly on top of IP as IP protocol 51.

90
06:19.000 --> 06:24.200
This kind of thing is of course going to be important if you need to allow this

91
06:24.200 --> 06:29.480
to pass through a firewall, a security appliance, an access list, something

92
06:29.480 --> 06:31.000
along those lines.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
06:29.480 --> 06:31.000
along those lines.

93
06:31.000 --> 06:36.000
Now here's sort of the downside for most people to AH.

94
06:36.000 --> 06:40.000
It does not provide encryption.

95
06:40.000 --> 06:46.590
And honestly, that pretty much takes it off the table in most modern networks

96
06:46.590 --> 06:48.000
for using AH.

97
06:48.000 --> 06:55.700
What it does provide however, authentication, integrity, and the anti replay

98
06:55.700 --> 06:57.000
features.

99
06:57.000 --> 07:01.930
So it basically makes sure that you're authenticated and that the data hasn't
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
06:57.000 --> 07:01.930
So it basically makes sure that you're authenticated and that the data hasn't

100
07:01.930 --> 07:06.700
been corrupted or tampered with or replayed, but it does not encrypt the

101
07:06.700 --> 07:08.000
payload itself.

102
07:08.000 --> 07:13.000
So authentication header or AH is not going to be our main focus.

103
07:13.000 --> 07:18.000
And it's not going to be a very popular option in most of today's networks.

104
07:18.000 --> 07:26.000
Instead, what we normally use is the encapsulating security payload or ESP.

105
07:26.000 --> 07:32.060
Now ESP also runs directly on top of IP specifically this one uses IP protocol
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
07:26.000 --> 07:32.060
Now ESP also runs directly on top of IP specifically this one uses IP protocol

106
07:32.060 --> 07:33.000
50.

107
07:33.000 --> 07:37.190
So once again, if we have to change permissions to allow this through, it's

108
07:37.190 --> 07:39.000
going to be protocol 50.

109
07:39.000 --> 07:43.000
And of course we can see the big thing here that's different.

110
07:43.000 --> 07:47.000
ESP does include encryption.

111
07:47.000 --> 07:52.130
Now of course, it also includes the authentication, the integrity, and the anti

112
07:52.130 --> 07:54.000
replay, just like AH.

113
07:54.000 --> 07:58.860
But of course, the big thing that ESP brings to the table is the ability to do

114
07:58.860 --> 08:00.000
encryption.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
08:00.000 --> 08:07.190
So as we proceed through this course, our main focus is going to be IP sec with

116
08:07.190 --> 08:08.000
ESP.

117
08:08.000 --> 08:14.290
So in this video, we just wanted to jump in and get a quick overview and idea

118
08:14.290 --> 08:21.000
of what IP sec is and sort of its two major protocols, AH and ESP.

119
08:21.000 --> 08:32.000
As we said, our main focus is going to be on IP sec with ESP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
08:21.000 --> 08:32.000
As we said, our main focus is going to be on IP sec with ESP.