HEY EVERYBODY WELCOME TO next video.
So in this video we're going to be following up from the previous one about VPN.
But we're going to be talking a little bit deeper on the components on how it's built.
So the main the first main tableau component is something called IP sec.
Now IP SEC is short for Internet Protocol security this protocol is used to provide data confidentiality
integrity and authentication between endpoint peers in a tunnel.
So whether that's you know 1 to 1 1 2 5 5 2 5 10 to 10 it doesn't matter.
Now this high level protocol consists of two internal ones.
Now this is the first one is called authentication header or age.
Then the other one is encapsulating security payload or ESPN.
Now ESPN is what you're going to find in most cases when you're interfacing with with VPN at an enterprise
level.
However age does have its places.
So the high level process here goes as follows.
So the first part of the tunnel is we have interesting traffic.
So this initial this interesting traffic initialize is the negotiation which is the phases 1 to 1 and
2 before it's able to transfer the data.
Now tunnels don't always stay up 100 percent.
They have a life.
They have a heartbeat or a ping time that they they can key you can keep them alive.
Also music keep alive you can keep them up all the time.
However and by default you're not going to have that.
So you can just you can have it drop the tunnel and an interesting traffic comes through it will rebuild
and instantiate the tunnel.
Now what is interesting traffic when you have one host trying to reach something on the other side of
a tunnel the end IP the target IP that you're trying to touch or send draft traffic to is when it reaches
the firewall or the router that holds a tunnel will know that that endpoint is not on it's in the local
network but it is indeed on the other end of this tunnel because it's matching to the other end of this
tunnel.
It is now considered interesting traffic so once Phases 1 and 2 which is more then negotiations start
will have entire videos on each phase.
It's important to understand what happens in each one of these phases when troubleshooting tunnels or
trying to put them up yourself.
But we're not going to touch exactly what these are in this video.
So once the phases and all negotiation all the keys are done everything has been set up everything's
secure.
We now have data transfer which is our normal state of the tunnel traffic to passes back and forth.
Then we have termination which is what I spoke about either we have to keep alive or we don't.
The tunnel goes down the tunnel goes down.
Interesting traffic will rebuild the tunnel and bring it back up.
Now there's a keep alive the tunnel we'll just send a ping from one from our gateway which has the tunnel
to the other Gateway which has the other end of the tunnel.
I'll just ping back and forth which does generate the interesting traffic which will keep the tunnel
up and alive.
Now the authentication header this is done by sharing two keys between the piers or I'm sorry.
A shared key secret key between the piers.
This is important to understand is that the authentication header is normally used between two gateways
or two devices.
So this is used when you don't care about somebody seeing the data you need to make sure that it is
not tampered with.
So this data with authentication header goes over the clear.
However it's with using a h.
You are you are guaranteeing the traffic does not get tampered with along the way.
And in some cases this is what you want.
So what happens is as it takes this one shared key it runs the IP header and the raw data that it wants
to send which is the rest of the packet the IG runs it through a one way hash with the secret key and
then that generates a single hash.
Now it's important to note that when it want to take stuff from the IP header immutable headers like
the time to live and stuff like that that changes in transit when you normally send a packet is not
included in this because then it wouldn't make sense because by the time they get it when they reincarnate
when they rehash it to check it doesn't it will fail.
So what happens is at the end we have our IP header.
We've got our raw data and we've got our hash so the track it gets sent over as as that then the peer
will notice that there's a hash at the end rehash everything with this with the secret key that was
shared between the two and then compare the hashes the hashes don't match kicks it back it knows it's
been tampered with if it hasn't been tampered with then you're OK now.
It's important I understand that with hashing one bit changing or one byte one bit one byte doesn't
matter anything changes you're going to have a different hash.
Now ESPN so ESPN are encapsulating security payload.
This is gonna be your most commonly used protocol with IP SEC in an IP SEC Base Tunnel.
Now what this does this provides encryption to the IP packet layer which is the packet layer it uses
five fifty six bit d by default for backwards compatibility just so that any other devices legacy devices
can handle that type the least the base level of encryption so something's there.
Now ESPN uses quite a few different encryption protocols for its encryption.
Now you set this up when you bring up the tunnel you can tell it what to do.
Now there's Ike SHA 1 and 3.
Yes now I K is something we're going to go over more detailed in this particular course the others we're
going to leave we're going to let B for homework for you guys to look up how they work with ESB but
know that it can use more than i k but in the enterprise world you're going to find i k is the most
commonly used.
So that's what we're going to go with it going forward for this particular course.
Now in an IP SEC tunnel there are two different modes now the mode you want will determine what type
of tunnel comes up.
Now we have a tunnel mode.
This is where we want to connect one gateway to another or one device to another which I'm talking when
I say device I'm talking about networked devices switches routers firewalls we want to do this because
this is most common for site to site such as HQ to a remote office.
This is what you can do both routers or both firewalls are going to connect to each other and then they're
going to generate a tunnel.
This is going to be an Ip SEC IKB in tunnel mode.
So this will be more apparent when we go over the actual implementation of this in another module.
Just understand that the difference between the two modes tunnel and transport now tunnel mode acts
like a proxy.
So when you send traffic on the network you send it from your host through the proxy a.k.a. the gateway
that sends it to the other Gateway which is again the proxy for the remote host you're actually trying
to touch.
Now transport mode is a little bit different.
This works when you want to have a tunnel of secure connection between two piers.
So if I wanted to talk with my let's say my MacBook I want to talk to somebody else on the other side
of the office with a MacBook I would build a tunnel between us two and then we could have to secure
communication between us two or if I want to talk to a firewall and I need to do some administration
but I'm also on a public network for whatever reason that needs to happen.
You can create a tunnel between you and the firewall the firewall in this case isn't is a gateway or
it is it is a gateway by definition.
However because your connecting to the firewall in the respects that you're only hitting the firewall
you're you're using the tunnel to reach the specific firewall.
It's not considered in tunnel mode.
It's considered in transport mode because you're only going straight to that single device and it's
being treated as a peer not a gateway.
So this is just kind of how IP SEC works at a pretty high level.
I want you to go ahead and look a little bit online to figure out a little bit more of how IP SEC works.
We're gonna be going over the tunnels in the next few videos so don't don't worry about that.