As mentioned there are some major advantages to using digital signatures rather than preset keys.
There is however one major stumbling block when Peter sends his public key to Sarah.
Joe hacker could intercept that public key and replace it with his own public key and send that on to
Sarah pretending to be Peter.
That means that Sarah believes that traffic coming from Joe hacker is actually Peter in this case.
She needs a mechanism to prove that PETA is who he says he is and that he hasn't been replaced with
someone else.
And that allows us to introduce the concept of a certificate of authority.
Now in brief the easiest way to understand this is to think of the typical of a 30 as a trusted party.
When you connect a Web site like Amazon Dot Com you trust that Web site because of a trusted third party
like is sign or thought essentially a certificate of authority is introducing Peter to Sarah and allowing
them to receive each other's public keys knowing that that public key actually belongs to that person.
What happens in brief is Peter will send his public key to the certificate of authority and a certificate
of authority will issue Peter with a certificate stating that the public key contained in the certificate
is actually Peter's public key.
The certificate of authority does that by taking some of Peter's information these public key ashing
that data and then signing it with a certificate of authority private key putting that into certificate
and issuing that certificate to Peter the certificate of authority will do the same with Sarah taking
Sarah's data taking her public key hashing that information and signing it with the certificate of authorities
private key.
This whole infrastructure known as the public key infrastructure or Piquet I relies on businesses trusting
the certificates issued by the certificate of authority before setting up a VPN.
Peter and Sarah will exchange certificates.
So Peter will send he's a terrific get to Sara.
Sarah trusts the information contained in the certificate from Peter because the certificate has been
signed by a trusted third party let's say in this case there's a sign and she trusts the bearer a sign
so because Sarah trusts very sign and sign trusts Peter Sarah now trusts Peter by the same token Sarah
sends his certificate to Peter Petah trusts Sarah because he trusts very sign and there assigned trusts.
Sarah beris sign or whichever certificate of authority you use is the trusted third party allowing for
the secure exchange of public keys.
Now what is the SEC.
I DiCicco the security is a network layer protocol.
In actual fact it's a suite of protocols that protects and syndicates IP packets.
It's a framework of open standards that is algorithm independent and thus can use multiple algorithms.
They are three main IP protocols.
The first one is Internet key exchange or ICQ which provides a framework for negotiating security parameters
and establishing a syndicated keys.
A lot of the information I've just covered about pre-shared keys and digital signatures relies on ICQ.
We also have a syndication head or or H which does not provide encryption but provides a thin dictation
and integrity.
And then thirdly we have what's called encapsulating security payload or use P which provides for encryption
authentication and integrity.
There are two modes that can be used in basic the paeans.
The first one is transport mode where the original IP head of the packet being encrypted is used to
transport the packet.
And the second one is Tunnel mode where the original IP packet being encrypted is not used to transport
the packet a new IP header is tagged on the front.
So you have double IP addresses the head is used for writing the packets of the IP addresses of the
peer devices involved in the VPN not the originating host and destination host.
So he has an example of a site to site VPN.
And we going to use Espey with Tunnel mode which is very common.
Please note we have a MacBook with an IP address of 10 one on one and a server with an IP address of
10 1 to 1.
But we also have two routers Router one with Oculus quadruple one and router two with IP address quadruple
T and the IP SEC a VPN is going to be set up between Route 1 and route.
So if we look at the IP headers when the MacBook sends traffic to the server the source address will
be 10 1 1 1 and the destination address will be 10 1 to 1 on the local LAN that traffic will then be
routed to Rotto 1 when that traffic is sent through the basic tunnel.
Notice all the information so the data and the original IP headers and other sources trace 10 1 1 1
and destination 10 1 to 1 are encrypted and non readable on the Internet and ECP header is tagged onto
the front as well as a new source IP address and destination IP address.
So if Joe hacker were sniffing packets on the Internet he would see traffic from router one going to
route it to.
He would not see who was actually involved in the conversation.
When Ratatouille receives those encrypted packets routed to will strip off the outside headers decrypt
the packets as per what we've discussed previously and then send the original packets on towards the
server.
So the source IP address will be 10:01 on one destination will be 10 1 to 1 if sniffed on the local
LAN.
So this once again is an example of a site to site VPN using USP in tunnel mode.
It is if you remember provides encryption.
So confidentiality data integrity and authentic action.
Notice also that we're using tunnel mode because we have inserted new IP headers now when using IP sec
you have various options to choose from.
The first thing to choose is which are basic protocol are you going to use.
Are you going to use XP while you're going to use H or are you going to use them together.
Now firstly it provides encryption but A-H doesn't.
So if you need confidentiality.
Don't use age or authentication headed by itself.
Use is P However it is combined with H provides for stronger affinity cation and encryption and therefore
for example in banking environments they may choose to use both ISP and A.H. together.
The next thing to choose which I haven't got on the slide is which mode are you going to use.
Are you going to use tunnel mode or are you going to use transport mode.
Please remember if the devices setting up the VPN on not the actual devices communicating you need to
use tunnel mode.
So in this example because the routers are not the source and destination of the actual traffic they
are configured in tunnel mode.
You need to choose an encryption algorithm.
So are you going to use days or couple days or a.
It's recommended today to use a s what authentic cation and integrity are you gonna use.
Is it M.D five Wilshaw.
Also are you going to use pre-shared keys or are you going to use digital signatures and therefore digital
certificates digital certificates are harder to implement but are more scalable.
So for a very small VPN you matías appreciate keys for authentication but in a large environment you
may decide to use digital certificates.
Which version of Diffie Helman are you going to use Diffie Hellman one or DIFI home and two or Diffie
home and five.
Now I'm hoping at this point that you have a good understanding of the various protocols and that's
why I spend a lot of time discussing the various protocols because we don't cover the ground work.
The slide will mean nothing.
So what tops a VPN is can you expect to encounter the first time the site to site where you for instance
have a remote office or home office with a local router connecting back to the head office which may
be using a router or NASA or another type of device.
The basic VPN tunnel is set up directly between Route 1 and router to the advantage of this is firstly
that the devices like the MacBook and server do not need to run any corruption software from their point
of view.
It's as if there is a leased line or direct connection between the two lands.
Another advantage of using IP sic is because it runs at the network level they always side model.
It can encrypt all Hialeah protocols.
So rather than just being able to encrypt for instance HTP it can encrypt Oracle traffic sequel traffic
HGP traffic traffic and so forth and so on.
The second type of VPN you'll probably encounter is a remote access like the sick VPN.
In this case a remote client like a Windows laptop has installed the Cisco VPN client and a VPN has
been configured and set up between the laptop and HQ router directly the advantage of this method is
that the user could be roaming.
So in other words the user could be in a hotel and can connect securely across a public wireless network
in the hotel to the head office.
The user could also be in an internet cafe or a Starbucks or some way connecting to a wireless network
but because they are running the VPN client software they traffic is encrypted and a syndicated and
so forth directly from the laptop to the central site router there's an example of a Cisco VPN client
software running on my laptop.
Well I would need to do to connect back to the office for instance would be to double click on the VPN
entry put in my syndication information like my username and password and I'll be able to connect back
to the corporate environment.
The disadvantage of this method is that you have to install the Cisco VPN client.
So it's not client lists.
You have to install a piece of software.
The next type of remote access VPN is an SSL or secure sockets like a VPN these days there are two variants
of this you first look up the client list SSL tunnel where you could be in an internet cafe or somewhere
and you can connect securely to the HQ router without installing any software on your PC or client.
There were some restrictions originally with which applications and protocols could be used.
These days Cisco have something called the connect client which allows you to connect via SSL but download
a Java applet that allows more applications to be used through the SSL tunnel.
No software has to be installed locally.
Any connect client can automatically be downloaded and installed when connecting to the central site.
So for this cost just be away.
The advantage of an SSL VPN is that you do not need to install any software.
Now which devices support BP and Cisco routers do Cisco firewalls like the Cisco Assaidi.
They are various clients that can be used.
The first one is the SOTY compliant which can be used on wireless PDA use and other devices.
We have a legacy device called the VPN to hardware client which is a physical device that would be installed
at a remote site but would allow for easy VPN connections back to a central site and then as I've shown
me you have the Cisco VPN software client These days you also have the connect client that can be downloaded
automatically when connecting by an SSL VPN.
So to sum up what are the benefits of using VPN a major driver for VPN is cost savings because VPN is
all compatible.
With broadband technologies like DSL and cable rather than having to install expensive leased lines
to other private networks a virtual private network can be established across a public infrastructure
like the Internet the paeans provide security in that they provide encryption syndication data integrity.
Non-reaction anti replay protection and so forth and the peahens are very scalable DDNS can scale to
many many countries.
And I've been involved in DPN that spanned 50 countries.
Now it's a level you're not expected to know how to configure and set up like basic the peahens but
I'm going to demonstrate the set up of an idea like VPN by using the VPN config generator which you
may have got depending which package you've purchased.
So let's look at setting up a side to side DPN the tween Rotto one and routed to with networks 10 1
1 0 and 10 1 2 0.
As private networks that need to be encrypted so launch the site to site VPN wizard.
In our example both sides of the Pacific tunnel ARADAS will click next.
In this case we are requiring basic encryption.
Are we going to go for an encrypted tunnel.
We are not running dynamic routing protocols or multicasting cetra Celtic next day in our example its
just a see that we're using static IP addresses on both sides and not dynamic IP addresses so click
next.
So this is sort of what our diagram looks like.
We're going to encrypt traffic from 10 1 1 0 going to 10 1 0 and 2 are out as kid races.
Quadruple one and quadruple T.
And when sitting up I'd be sick.
You've got to specify your ick.
Well I say KMP options.
So for example let's be really secure and go for a 256.
In this example we going to use appreciate keys.
I'm just going to leave that at Cisco 2:59 and then I'm going to click on the generate button and this
is what that configuration would look like.
You have to create an access list specifying which networks are going to be encrypted.
This is known as an interesting traffic access list.
So traffic from 10 1 1 0 to 10 1 to zero would be encrypted because we're looking at router one is sort
of the configuration.
Now notice here we are using empty five hashing we could change that to use Shaw.
We're using a 256 encryption we're using Diffie Hellman group to we're using pre-shared authentication
noticed when talking to Ratatouille.
We're using a pasada Cisco 2:59 from an artistic point of view.
We're using ECP.
Yes.
So encapsulating security payload using A-S with M.D 5 and we're using tunnel mode we are specifying
who are P-A is OPSEC we are binding the access list so the router knows which network should be encrypted
and so forth.
I hope that gives you an idea of how to configure an IP sic VPN once again for CCMA.
It's not expected that you know this configuration but I've just put it in for completeness on router
2.
We we just have a mirror image of that configuration.
So I noticed the same password but going to IP Address quadrupole one.
So whatever we covered we looked at an overview of VPN as I explained various VPN components.
We discussed basic discuss a lot of options including encryption authentication and integrity.
Please remember that the scores level you're not expected to know commands but you expected to have
an appreciation and an understanding of the various IP VPN technologies.
Thank you for watching.