Hey everybody and welcome to the final video of the module.
So in this video we're going to follow off on the phases of the tunnel and what this is going to be
going about is something called IKB.
So IKB or Internet key exchange is the process of negotiating and authenticating IP SEC Security associations
or essays.
Now we're going to go over securitizations in the next slide but just understand that in the previous
videos we talked about tunnels.
So this is the two phases of the tunnel.
This is where IKB actually comes into play where all the negotiation for the tunnels come back and forth.
Now quick talk about security associations because this is going to be referred to in the phases of
the tunnel.
Now a security association is a relationship or a contract between two or more peers in an IP SEC tunnel.
It's important to understand what an essay or security association is when you're dealing with IP SEC
tunnels.
Now the data in a Security Association can vary depending on its implementation but some of the common
things you're going to see are the destinations address its it's hostname type of mode whether it's
tunnel or transport which you've talked about before.
The algorithm used so that's under the ISP that we've already talked about and the tunnel keep alive.
Now this is just a short list depending on again your implementation you will see a few varieties of
different things.
But understand that a Security Association has some of this data along with it.
So the NSA is in charge of what is actually being used in the tunnel.
So what algorithm etc..
So what happens here is in phase one this is the beginning of the tunnel.
So it authenticates the identities of the IP SEC Piers.
So there's a there's a pass a shared key or password that is that happens here now and ensures the NSA
policy matches between the two hosts or the two piers or multiple Piers.
Now this is important because of the essay policies don't match between the two.
It's never going to create the tunnel and you'll see that error as phase one airing out on you.
And then it performs a Duffy Hellman or D.H. exchange to generate matching shared keys and then sets
up a temporary secure connection between the two piers assuming everything else is passed to actually
pass the secret key to each other.
Now in some cases the secret key is not needed because it does something called a pre shared key.
Now you can set a pre shared key ahead of time on both ends and then you will not have to worry about
having a generated key or vice versa.
So just understand that that's there we're going to go over a few variations of that with P.F. sense
when we go over actually installing and running that firewall.
We will we will also use P.F. sense to create a VPN tunnel with IP second key in that course.
So we're going to go ahead and we're going to leave that over there.
But this is phase one once the they have the shared keys have been passed or generated and in the temporary
connection is there and it's secure then we go into the Phase 2 Now I'm sorry.
Phase one has a little bit more to it.
Apologies for their so phase one has two modes.
There's a main mode and then there's an aggressive mode.
In most cases you're going to want to do main mode because the time sensitivity is not that big of an
issue especially if you're a single user.
It might not be the case for an enterprise but it depends on the implementation.
Now main mode performs two or three two way handshakes or two exchanges.
Right.
So what it does is it sets up.
So this is the process that we just spoke about.
It agrees upon an algorithm and hashes for the for the IKB tunnel the temporary tunnel then uses Duffy
Hellman to create the keys and pass them and then identify the piers based on the IP.
Now that's important because if you have a hostname in there and you're using main mode it might fail.
Now aggressive mode so this sends everything in the fewest packets possible so essentially it takes
the leftover data in the essay values and packs as much data into them as possible to try to get as
much settings across.
So this is just so it speeds up that that transaction a little bit.
But this can also be sniffed on the network because it's not creating that temporary tunnel ahead of
time.
So she's packing all the data that would have been through all the exchanges into one or two requests
instead of multiple different requests back and forth for renegotiations and such.
In most cases you can use main mode for testing we might be using aggressive but either way the tunnel
will work just understand that aggressive mode can be sniffed across the network.
Now phase two which is the last phase.
So now we've got our temporary tunnel.
Now it takes the essay parameters and negotiates them between the people between the two pairs.
So now we're going through the essay parameters on each end and they're checking each others to make
sure that they're they're valid.
So the the algorithms the same the time delivers the same read tries are the same.
Obviously the destination addresses in an IP are going to be different but it knows that ahead of time
once it has that and also in some essays there's the appreciate key which is what we talked about.
So once that's happened it can use appreciate key or the algorithm itself to start the actual tunnel
based on the essays parameters.
Now this is important.
The tunnel once connect once in phase passed Phase 2 is using the essay parameters to hold and encrypt
traffic not the temporary one.
And periodically it will renegotiate the essay parameters just to make sure that the host on the other
side did not get compromised or it did not.
Nobody snuck in the middle and might have just had been able to let's say guess the date on the other
end or the type of encryption used etc..
So this renegotiated.
So they didn't have the original essay or the original connection it would now fail.
Now this has been just a pretty high level overview.
We'll go more into actually how you implement this in a future module but I just want to give you guys
an idea of how VPN tunnels work and more specifically on how IP SEC a.k.a. tunnels actually work in
the enterprise world.