>> After you choose whether or
not you want to be in tunnel mode,
or transport mode,
the next decision you want to make is what
protocols you want to use for IPSec.
There are two main ones that
provide the security service.
One is called AH,
which stands for Authentication Header.
Authentication Header will provide non-repudiation,
because what will happen is IPSec and authentication,
is the Authentication Header is going
to run something called an ICV,
an Integrity Check Value.
That Integrity Check Value is essentially a hash.
We haven't talked about what hashing is yet,
but the whole purpose of a hash
is to detect modification.
By running this Integrity Check Value
on the header of the packet,
that guarantees the header hasn't been modified.
When a packet is spoofed,
it's the IP header that does get modified.
What we get is an assurance that
the IP header has not been manipulated,
which gives us authenticity.
That giving us authenticity is great,
but we do not get confidentiality with the AH.
Honestly, a lot of times we
use IPSec for confidentiality.
We want to encrypt our data, so often,
we're going to use a different protocol called ESP.
ESP stands for Encapsulating Security Payload.
That's the protocol that's going
to provide us with encryption.
It also uses something called a MAC,
which is a message authentication code to
determine whether or not there's been
modification of the packet.
You really get pretty decent integrity checking,
and little bit of authenticity,
and encryption with ESP,
so it's a very popular choice.
The third protocol mentioned here is one
called IKE, Internet Key Exchange.
I always think about IKE like
you think about a roadie at a concert.
You go to a concert,
you show up early and there's
a guy in a t-shirt and cut-off jeans,
no matter what the weather is,
and he's laying out cable,
he's checking the lights,
checking the sound, tuning instruments.
Nobody's really there to see
that guy unless it's his mom.
We're here to see the main act, and that's IKE.
IKE doesn't provide the security services.
IKE doesn't get any of the glory.
All IKE does is go out ahead of the communication,
or a head of the exchange of information
>> and sets up and negotiates algorithms and keys,
>> Internet Key Exchange.
>> Actually, IKE is made up of two sub protocols,
one called Oakley and the other called ISAKMP.
Oakley initiates the key agreement
through an algorithm called Diffie-Hellman.
More to come on that later.
ISAKMP sets up what is
referred to as a security association.
The security association is
something you can think of like a channel,
or a unique identifier to
reference each secure connection.
If I have three different secure connections
with three different systems,
I have various SAs, security associations.
To identify each one is unique,
and actually, I'll have two SAs,
one for outgoing communication
and one for an incoming communication.
Again, that security association
allows me to keep each session as unique.
It has an identifier called the
Security Parameters Index,
and that one field will always be unique
>> even if I have multiple security sessions opened
>> up on the same system.
>> The SPI will provide
the randomness or at least the pseudo-randomness.
Next we got GRE,
which is another protocol
called Generic Routing Encapsulation.
GRE doesn't really provide
>> encryption or authentication.
>> It's just about encapsulation.
We saw this back in the olden days
with systems using Apple Talk,
trying to traverse a TCPI network,
so GRE would be used for encapsulation.
Now we see it with IPv4 to IPv6 networks.
Sometimes you'll see it for a multicast traffic because
a multicast traffic can't traverse typical VPNs,
so GRE is something that's
a protocol coming back into favor.
Let's wrap it up for remote access.
We looked at dial-up and talked
about Point-to-Point protocol,
and the fact that it uses PAP,
CHAP, and EAP for authentication.
We said point-to-point protocol provides the layer to
connectivity and framing for WAN connectivity,
and to get authentication we needed PAP, CHAP and EAP.
PAP is sending passwords in plain text.
>> We don't like it.
>> CHAP protects our passwords better,
but it's still only capable
>> for password authentication.
>> Then EAP is what we're using today in a lot of areas,
because it will support more than just passwords,
things like tokens, certificates, and so on.
What replaced dial-up connectivity
is tunneling and creating our VPNs.
We're certainly looking at other ways to
connect today beyond the VPNs,
but the VPNs were created with tunneling protocols.
We have Point-to-Point Tunneling Protocols,
which is really the first main tunneling protocol.
We've got L2TP that enhance
Point-to-Point Tunneling Protocol and
allowed it to separate from IP networks.
Remember, L2TP has no built-in security
and it uses IPSec to secure its traffic.
We have Generic Routing Encapsulation
and we also talked about IPSec,
which can either be used for VPN tunnels,
but it can certainly also be used on
internal networks to protect traffic.
Those are your key takeaways.