- [Instructor] Years ago if we wanted
to connect a couple of corporate sites
we probably had to get some sort
of a LAN connection like a leased line
or maybe go into a frame relay or an ATM cloud,
but these days we have such high speed connectivity
to the internet through something like a cable modem,
or in my home I've got gig fiber,
we've got such easy connectivity in many places
in the world to high speed internet
that we can connect one office location
to another office location over the internet,
but the challenge is we want to do that securely
because the internet is an untrusted network.
So we need to come up with some sort
of a virtual private network, a VPN,
that can protect our data as
it's flowing between a couple of sites.
So let's think about how we can accomplish that.
We know that we can use these common broadband technologies,
and the clients, if we're using a site-to-site VPN like this
they don't have to have special software installed.
They don't have to have client software.
It's going to be transparent to them
because the routers or possibly a VPN concentrator
is going to be used to do the heavy lifting.
So again, the goal is to transport all kinds of traffic
between our different corporate sites,
and by all kinds of traffic I mean not just unicast IP
but broadcast, multicast, whatever traffic we want,
we want to be able to send it over this protected tunnel,
and to do that let's consider a couple of VPN protocols.
The first one is called GRE, generic routing encapsulation.
Now the downside I'll tell you upfront about GRE
is that it does not provide security.
The good thing about GRE is that it is super flexible.
It can encapsulate just about any type of data,
broadcast, unicast, even non-IP traffic
we can send over a GRE tunnel.
But it's a bit of a drawback that it doesn't do security.
There's another VPN protocol
that's very popular that does do security,
and it's IPsec, short for IP security.
But with an IPsec tunnel
we're going to have a drawback there as well.
So let's take a look at
the characteristics of an IPsec tunnel.
First of all, it is super secure.
It's going to give us different encryption algorithms
that will scramble our data up,
and therefore give us confidentiality.
It's going to be able to run a hashing algorithm,
like the Secure Hash Algorithm, against a data string,
and create a fingerprint of it,
and if the fingerprint on one router
matches the fingerprint on the other router,
that's an indication that that Packet
has not been modified in transit,
so we think it's good; that checks its integrity.
We can do authentication using something
like a pre-shared key or a digital certificate
so we know that the other end of the tunnel
is who we think they are,
and if somebody were to intercept Packets
and then try to play them back,
because those Packets worked earlier, they might work later,
well we're going to prevent anti-replay attacks
by putting basically serial numbers on those Packets.
So it has lots of security features.
Here's the downside, though, unlike a GRE,
which could encapsulate just about anything,
IPsec can only encapsulate unicast IP Packets.
We'll talk about how to overcome that in a moment.
But more information about IPsec that I want you to know.
There are two basic modes of IPsec.
There's transport mode and tunnel mode,
and transport mode,
we're going to be using the original Packet's header
and we're going to encapsulate the payload of the Packet.
In tunnel mode, though, we encapsulate everything.
We encapsulate the payload and the original header,
and the way an IPsec tunnel is set up
really uses two different steps.
Step one is to establish what's called
an ISAKMP tunnel or an IKE Phase 1 tunnel.
And as a metaphor, if you've ever watched the TV show,
the really old TV show or now it's a Steve Carell movie,
Get Smart, if you're familiar with that show
you might remember the cone of silence
that Max always wants lowered
when he's talking to chief about something secret.
Never did seem to work right in the TV show or movie,
but the idea was you could lower the cone of silence
and that gives you this private communication area.
Well, that's essentially what an ISAKMP tunnel is.
It's like we're lowering the cone of silence
so that these two routers can talk securely.
What are they talking about?
Well, they're talking about the parameters
that they're going to use to set up the actual IPsec tunnel,
which is also known as the IKE Phase 2 tunnel.
So we negotiate the parameters
of the actual IPsec tunnel within the protection
of an IKE Phase 1 tunnel; this is very secure,
but how do we overcome this issue
that we can only secure unicast IP traffic?
Well, GRE could encapsulate just about anything,
but it would not give us security.
What if we use both?
And here's what I mean.
What if we took whatever the traffic was,
unicast, multicast, broadcast, it doesn't matter,
we took any of our traffic
and we encapsulated it inside of a GRE tunnel.
Now we've got a bunch of GRE Packets.
Some of those Packets might contain IP unicast,
broadcast, multicast, doesn't matter,
but the GRE Packet itself is a unicast IP Packet.
Do you see where I'm going with this?
Once we put traffic inside of a GRE tunnel
it's now unicast IP Packets,
which can then be sent inside of an IPsec tunnel.
We're going to take our traffic,
put it inside of the GRE tunnel,
then we're going to put those GRE unicast IP Packets
inside of an IPsec tunnel.
That's how we can use these two
different VPN protocols together
to meet our goals of giving us flexible,
secure communication across
an untrusted network, across the internet,
and in our next video we're going to take a look at
how to configure a GRE over IPsec tunnel.