>> As I'm sure you are aware,
dial-up communications were replaced
>> by the idea of VPNs and tunneling.
>> When we talk about VPNs,
Virtual Private Network,
that's the whole idea.
That even though you're in a remote location,
it seems as if you have your own private network
>> into your local office
>> or some resource across the Internet.
>> The idea is that this encapsulation
>> provided is passing through a tunnel.
>> We already talked about encapsulation
when discussing the OSI reference model.
What happens with encapsulation
>> is you get a protocol within a protocol,
>> or you get some additional headers
>> that are added that protect
>> the original data in its format.
>> With Virtual Private Networks,
we have to have tunneling protocols
that allow this protection.
Your tunneling protocols are either
going to provide encapsulation,
encryption, authentication,
>> all of these things,
>> or just some of these things.
It really is driven by the protocol that you choose.
The question then sometimes is why
>> would I not want encryption and authentication
>> if I'm tunneling across the Internet?
>> The answer to that is that,
some tunneling protocols just help
>> traffic moves from one network
>> across the different network.
>> For instance, an IP version 4 packet
can't travel across an IP version 6 network.
You can create or use a tunneling protocol
>> where the IPB for traffic is given transport
>> as encapsulated into IP version 6.
>> Ultimately, encapsulation provides us
with a lot more than just encryption
>> and authentication.
>> It really allows just one type of traffic
>> to traverse a different type of network.
>> Of course, this process of encapsulation
>> and perhaps encryption authentication,
>> is created through the use of protocols.
There are other protocols
>> that can be used for tunneling.
>> These are the most common.
You have a protocol that's based off
>> of a Point-to-Point Protocol
>> that we saw with the dial up.
>> It's called Point-to-Point tunneling protocol.
We also have L2TP,
which stands for Layer 2 Tunneling Protocol.
We can create a tunnel with IPsec.
GRE is Generic Routing Encapsulation.
Then we have Secure Sockets Layer.
We can create SSL tunnels really today, TLS tunnels.
If we start off by looking at
Point-to-Point Tunneling Protocol,
this was developed by Microsoft.
Again, we're really getting away
>> from dial-up communication,
>> because of the expense,
>> not the security.
>> What we wanted to do is allow users
>> to connect across the Internet
>> as opposed to having to dial it.
>> That's what PPTP was all about,
because it's some Point-to-Point Protocol,
>> if you'll remember, we talked about PAP,
>> CHAP, and EAP for authentication.
It uses a new protocol called MPPE for encryption.
Some of the same ideas,
but it provides the tunneling,
the connection to connection.
It's the creation of this virtual network.
One of the drawbacks to PPTP is that
>> it only works across IP based networks,
>> which is okay at the time because we're
communicating across the Internet today.
But back in our time,
we had a frame relay networks and ATM networks.
We really needed something more flexible
that worked across different network types,
which is exactly why L2TP was developed.
Cisco came out with a protocol
>> called L2F, Layer 2 Forwarding.
>> But Cisco likes to keep their good ideas proprietary.
We basically took what was good about
L2F and what was good about PPCP,
and came up with L2TP,
Layer 2 Tunneling Protocol.
Because it's a Layer 2 Protocol,
it doesn't require a specific network type.
It's agnostic, so it's not bound
>> to an IP network the way that
>> Point-to-Point Tunneling Protocol is.
The problem with L2TP is that
it's just the encapsulation in and of itself.
It can be used to have one type of
traffic traverse a dissimilar network type.
But if you're using it's create a tunnel,
IPsec is going to be used with L2TP.
IPsec will actually provide the security.
With that being said,
>> you can actually just use IPsec
>> in and out of itself to create a tunnel.
>> That way, it's really most common today.
Is that for instance,
>> if I'm doing site-to-site VPN
>> from one location to another,
>> I have VPN concentrators
>> and they communicate across
>> a unsecured network with IPsec.
>> IPsec really is an interesting protocol,
because it was designed as a part of an IP version 6.
One of the things about IPV6
>> is that this was going to finally give us
>> a protocol that was integrated with security.
Now, we've seen the masses
>> have not flocked to IPV6.
>> I almost feel like we'd see IPV6
>> as soon as we see that metric system.
>> But IPsec was designed as part of IPV6.
It is made to work backwards
>> or be backwards compatible.
>> You can use it with IP version 4.
But even though IPV6 isn't everywhere you look,
IPsec is very popular.
It is the framework of choice
>> for encryption, authentication,
>> and encapsulation.
>> Let's talk a little bit about configuring IPsec.
When you set up IPsec,
one of the first choices that you have to make
>> is the mode in which IPsec should operate.
>> Now, you have Tunnel Mode
>> and you have Transport Mode.
>> Whichever one of those you choose
>> is going to determine what gets encapsulated.
>> For instance, if we think about
typical IP version 4 packet,
we have a header, data, and a trailer.
In Tunnel Mode, the entire IPV4 packet is encapsulated.
You can see with the diagram here,
IPsec adds a header before the IP header.
The entire IPV4 packet is the IPsec payload,
and then there's an IPsec trailer at it as well.
The whole packet is wrapped up.
This is in Tunnel Mode.
Again, when you think about tunneling,
it's transmitted across an unsecured network.
It makes sense the whole IP packet is encapsulated.
But with Transport Mode,
we might be using transport mode internally.
Maybe we want to protect traffic
going to and from our payroll database.
We don't want that stuff on the network on encrypted,
so you might use IPsec and Transport Mode
>> to protect internal traffic,
>> because Transport Mode is only going to
encapsulate the IP payload, the data.
It doesn't encapsulate the IP header and trailer.
What you get when you add
some security services
>> is less security in Transport Mode.
>> But the understanding that
>> you're not really tunneling across
>> the Internet and Transport Mode,
>> so you get greater security in Tunnel Mode.
But you always treat performance for a security.