As mentioned, there are some major advantages to using digital signatures rather than pre-set keys.
There is, however, one major stumbling block when Peter sends his public key to Sarah.
Joe Hacker could intercept that public key and replace it with his own public key and send that on to
Sarah pretending to be Peter.
That means that Sarah believes that traffic coming from Joe Hacker is actually Peter.
In this case, she needs a mechanism to prove that Peter is who he says he is and that he hasn't been
replaced with someone else.
And that allows us to introduce the concept of a certificate of authority.
Now, in brief, the easiest way to understand this is to think of the certificate of authority as a
trusted third party.
When you connect to a website like Amazon.com, you trust that website.
Because of a trusted third party like VeriSign or thought.
Essentially a certificate of authority is introducing Peter to Sarah and allowing them to receive each
other's public keys, knowing that that public key actually belongs to that person.
What happens in brief is Peter will send his public key to the certificate of authority, and the certificate
of authority will issue Peter with a certificate stating that the public key contained in the certificate
is actually Peter's public key.
The certificate of authority does that by taking some of Peter's information, his public key, hashing
that data, and then signing it with the certificate of authority's private key.
Putting that into certificate and issuing that certificate to Peter.
The certificate of authority will do the same with Sarah taking Sarah's data, taking her public key,
hashing that information, and signing it with the certificate of authorities.
Private key.
This whole infrastructure known as the public key infrastructure or PKI, relies on businesses trusting
the certificates issued by the certificate of authority.
Before setting up a VPN, Peter and Sarah will exchange certificates.
So Peter will send his certificate to Sarah.
Sarah trusts the information contained in the certificate from Peter because the certificate has been
signed by a trusted third party.
Let's say in this case, VeriSign.
And she trusts VeriSign.
So because Sara trusts VeriSign and VeriSign trusts Peter.
Sarah now trusts Peter.
By the same token, Sarah sends her certificate to Peter.
Peter trusts Sarah because he trusts VeriSign.
And VeriSign trusts Sarah.
VeriSign or whichever certificate of authority you use, is the trusted third party allowing for the
secure exchange of public keys.
Now what is IP, sec, IP, sec or IP?
Security is a network layer protocol.
In actual fact, it's a suite of protocols that protects and authenticates IP packets.
It's a framework of open standards that is algorithm independent and thus can use multiple algorithms.
There are three main IPsec protocols.
The first one is Internet Key Exchange, or IK, which provides a framework for negotiating security
parameters and establishing authenticated keys.
A lot of the information I've just covered about appreciate keys and digital signatures relies on Ike.
We also have authentication, header or a.H, which does not provide encryption but provides authentication
and integrity.
And then thirdly, we have what's called encapsulating security payload or ESP, which provides for
encryption, authentication and integrity.
There are two modes that can be used in IPsec VPNs.
The first one is transport mode, where the original IP head of the packet being encrypted is used to
transport the packet.
And the second one is tunnel mode, where the original IP packet being encrypted is not used to transport
the packet.
A new IP header is tagged on the front, so you have double IP addresses.
The head is used for writing the packets or the IP addresses of the PIA devices involved in the VPN,
not the originating host and destination host.
So he has an example of a site to site VPN and we're going to use ESP with tunnel mode, which is very
common.
Please note we have a MacBook with an IP address of ten 111 and a server with an IP address of ten 121.
But we also have two routers router one with IP address quadruple one and router two with IP address
quadruple two.
And the IP SEC VPN is going to be set up between router one and router two.
So if we look at the IP headers, when the MacBook sends traffic to the server, the source address
will be ten 111 and the destination address will be ten 121 on the local LAN.
That traffic will then be routed to router one when that traffic is sent through the IP seq tunnel.
Notice all the information.
So the data and the original IP headers.
In other words source address ten 111 and destination ten 121 are encrypted and non readable on the
internet.
An ESP header is tagged onto the front as well as a new source IP address and destination IP address.
So if Joe Hacker was sniffing packets on the internet, he would see traffic from router one going to
router two.
He would not see who was actually involved in the conversation.
When Radha two receives those encrypted packets.
Router two will strip off the outside headers, decrypt the packets as per what we've discussed previously
and then send the original packets on towards the server.
So the source IP address will be ten 111 destination will be ten 121.
If sniffed on this local lan.
So this once again is an example of a site to site IPsec VPN.
Using ESP in tunnel mode.
ESP, if you remember, provides encryption.
So confidentiality, data integrity and authentication.
Notice also that we're using tunnel mode because we have inserted new IP headers.
Now when using IPsec, you have various options to choose from.
The first thing to choose is which IPsec protocol are you going to use?
Are you going to use ESP or are you going to use a or are you going to use them together?
Now firstly ESP provides encryption but doesn't.
So if you need confidentiality, don't use a or authentication header by itself.
Use ESP.
However, ESP combined with a PH provides for stronger authentication and encryption and therefore,
for example, in banking environments they may choose to use both ESP and PH together.
The next thing to choose, which I haven't got on the slide, is which mode are you going to use?
Are you going to use tunnel mode or are you going to use transport mode?
Please remember if the devices setting up the VPN are not the actual devices communicating you need
to use tunnel mode.
So in this example, because the routers are not the source and destination of the actual traffic,
they are configured in tunnel mode.
You need to choose an encryption algorithm.
So are you going to use days or triple days or as it's recommended today, to use as what authentication
and integrity are you going to use?
Is it MD5 or SHA?
Also, are you going to use preset keys or are you going to use digital signatures and therefore digital
certificates?
Digital certificates are harder to implement but are more scalable.
So for a very small VPN, you might use preset keys for authentication, but in a large environment
you may decide to use digital certificates.
Which version of Duffy helmet are you going to use?
Duffy.
Helmand one or Duffy?
Helmand two or Duffy?
Helmand five.
Now, I'm hoping at this point that you have a good understanding of the various protocols.
And that's why I spend a lot of time discussing the various protocols because.
If we don't cover the groundwork, the slide will mean nothing.
So what types of VPNs can you expect to encounter?
The first type is site to site where you, for instance, have a remote office or home office with a
local router connecting back to the head office, which may be using a router or an assay or another
type of device.
The IPsec VPN tunnel is set up directly between router one and router two.
The advantage of this is firstly that the devices like the MacBook and Server do not need to run any
encryption software.
From their point of view, it's as if there is a lease line or direct connection between the two lands.
Another advantage of using IPsec is because it runs at the network level of the OCI model.
It can encrypt all higher layer protocols.
So rather than just being able to encrypt, for instance, HTTP, it can encrypt Oracle traffic, SQL
traffic, HTTP, traffic, FTP traffic and so forth and so on.
The second type of VPN you'll probably encounter is a remote Access IPsec VPN.
In this case, a remote client like a Windows laptop has installed the Cisco VPN client.
And a VPN is being configured and set up between the laptop and HQ router directly.
The advantage of this method is that the user could be roaming.
So in other words, the user could be in a hotel and can connect securely across a public wireless network
in the hotel to the head office.
The user could also be in an Internet cafe or a Starbucks or somewhere connecting to a wireless network.
But because they're running the VPN client software, they traffic is encrypted and authenticated and
so forth, directly from the laptop to the central site, rather.
As an example of the Cisco VPN client software running on my laptop.
All I would need to do to connect back to the office, for instance, would be to double click on the
VPN entry, put in my authentication information like my username and password, and I'll be able to
connect back to the corporate environment.
The disadvantage of this method is that you have to install the Cisco VPN client.
So it's not client list.
You have to install a piece of software.
The next type of remote access VPN is an SSL or secure sockets layer VPN.
These days, there are two variants of this.
You firstly got the client list SSL tunnel where you could be in an internet cafe or somewhere and you
can connect securely to the HQ router without installing any software on your PC or client.
There were some restrictions originally with which applications and protocols could be used.
These days, Cisco have something called the interconnect client, which allows you to connect via ASL,
but download a Java applet that allows more applications to be used through the Sstl tunnel.
No software has to be installed locally that any connect client can automatically be downloaded and
installed when connecting to the central site.
So for this course, just be aware the advantage of an sstl VPN is that you do not need to install any
software.
Now which devices support VPNs?
Cisco routers do Cisco firewalls like the Cisco RSA do?
They are various clients that can be used.
The first one is a certain client.
Which can be used on wireless PDAs and other devices.
We have a legacy device called the VPN 302 hardware client, which was a physical device that would
be installed at a remote site that would allow for easy VPN connections back to a central site.
And then, as I've shown you, you have the Cisco VPN software client these days.
You also have the ENE Connect client that can be downloaded automatically when connecting via an Sstl
VPN.
So to sum up, what are the benefits of using VPNs?
A major driver for VPNs is cost savings because VPNs are compatible.
With broadband technologies like DSL and cable, rather than having to install expensive lease lines
or other private networks, a virtual private network can be established across a public infrastructure
like the Internet.
VPNs provide security in that they provide encryption, authentication, data integrity, non repudiation,
anti replay protection and so forth.
And VPNs are very scalable.
VPNs can scale to many, many countries, and I've been involved in VPNs that spanned 50 countries.
Now, at a level you're not expected to know how to configure and set up IPsec VPNs.
But I'm going to demonstrate the setup of an IPsec VPN by using the VPN config generator, which you
may have got depending on which package you purchased.
So let's look at setting up a site to side VPN between router one and router two with networks ten 110
and ten 120 as private networks that need to be encrypted.
So I'll launch the site to site VPN wizard.
In our example, both sides of the IPsec Tunnel or Routers.
So we'll click next.
In this case, we are requiring IPsec encryption.
So we're going to go for an encrypted tunnel.
We're not running dynamic routing protocols or multi costing, etc., so I'll click next there.
In our example, let's just assume that we're using static IP addresses on both sides and not dynamic
IP addresses.
So we'll click next.
So this is sort of what our diagram looks like.
We're going to encrypt traffic from ten 110.
Going to ten 120.
And our two routers IP addresses all quadruple one and quadruple two.
And when setting up IP sick.
You've got to specify your Ike or Isaac and P options.
So for example.
Let's be really secure and go for a turn.
56.
In this example, we're only going to use a preset key, so I'm just going to leave that at Cisco.
One, two, three.
And then I'm going to click on the generate button and this is what that configuration would look like.
You have to create an access list specifying which networks are going to be encrypted.
This is known as an interesting traffic access list.
So traffic from ten 110 going to ten 120 would be encrypted because we're looking at router one side
of the configuration.
Now notice here we are using md5 hashing.
We could change that to use sha.
We're using a 256 encryption.
We're using Duffie Hellman group to.
We're using pre shared authentication.
Notice when talking to Radha, too.
We're using a password of Cisco.
One, two, three.
From an IP point of view, we're using ESP as so encapsulating security payload using as with MD5 and
we are using tunnel mode.
We are specifying who our peer is for ip seq.
We are binding the access list.
So the writer knows which networks should be encrypted and so forth.
I hope that gives you an idea of how to configure an IPsec VPN.
Once again for Q&A, it's not expected that you know this configuration, but I've just put it in for
completeness.
On router two, we would just have a mirror image of that configuration.
So notice the same password.
But going to IP address quadruple one.
So what have we covered?
We looked at an overview of VPNs.
I explained various VPN components.
We discussed IP, SEK discuss a lot of options, including encryption, authentication and integrity.
Please remember at this course level, you're not expected to know commands, but you expect it to have
an appreciation and an understanding of the various IPsec VPN technologies.
Thank you for watching.