-: In this lesson, we're going to talk
about the different VPN protocols.
But first, a reminder
of what a virtual private network is, or VPN.
It's a secure connection between two or more computers
or devices that aren't on the same private network,
creating a virtual private network.
Now, when we talk about VPN protocols there's three big ones
we're going to talk about in this lesson.
We're going to talk about PPTP, L2TP and IPSec.
The first VPN protocol we're going to talk about
is a Point-to-Point Tunneling Protocol, or PPTP.
This is a protocol that encapsulates PPP packets
and ultimately sends data out as encrypted traffic.
Now, what is PPP?
PPP is the Point-to-Point Protocol,
and it was originally used for dial-up connections,
but it's used in combination with the PPTP protocol
over Port 1723 to allow servers and devices
to connect over a wide area network like the internet.
Now, PPTP uses CHAP-based authentication,
and that makes it vulnerable to attack.
If you're going to use PPTP for your VPNs,
you should always require
a strong authentication mechanism be used instead,
something like EAP-TLS, like we've talked about before.
This is going to rely on PKI and digital certificates
for stronger authentication.
Otherwise, you should look at something like L2TP or IPSec.
And that brings us to L2TP.
L2TP is the Layer 2 Tunneling Protocol.
This is going to give you a connection
between two or more computers or devices
that aren't on the same private network.
Notice here, I didn't use the word secure.
That is because L2TP is not secure on its own
and it provides no encryption and no confidentiality
by itself.
Instead, we usually are going to pair it with IPSec
to provide that security.
IPSec is going to provide us with the encryption
and confidentiality while we're using L2TP,
and this is going to enable us to use things like PKI
with L2TP if we're using Windows Servers
as part of that authentication process.
L2TP is used over Port 1701 as you may have remembered
from our Ports and Protocol lesson.
Now, IPSec is a TCP protocol that authenticates
and encrypts IP packets effectively,
securing those communications between computers and devices
using the protocol.
This is going to create a nice secure tunnel for us
that we can send our traffic and create our VPNs across.
This is what we use heavily inside of VPNs.
Now, when we talk about IPSec,
IPSec is going to provide us confidentiality
by giving us encryption,
it's going to provide integrity for us by using hashing
and it's going to give us authentication
by performing a key exchange.
When we talk about that key exchange,
it's known as IKE, the Internet Key Exchange.
This is a method that's used by IPSec
to create a secure tunnel by encrypting the connection
between authenticated peers.
This can occur in one of three ways.
A Main mode, an Aggressive mode or a Quick mode.
In Main mode, there are three separate exchanges
that are going to occur.
When we use Aggressive mode, the key exchange
is going to happen more quickly,
but it still achieves basically the same result as Main mode
but it only uses three packets.
If we decide to use Quick mode,
only the negotiated parameters of the IPSec session
are going to be handled.
This key exchange occurs during the establishment
of an IPSec tunnel in two different phases.
So, let's take a look at how this happens.
First we have IKE phase one,
and here's where we're going to establish the encryption
and authentication protocols between our two VPN endpoints.
And this is going to help us to create the IKE phase one tunnel
when the devices authenticate using certificates
or pre-shared key.
Then we're going to have ISAKMP is going to be established,
and using our Main or Aggressive mode,
we're going to create what is known
as those Security Associations.
Each side then creates a private key and derives
a public key from it, using the Diffie-Hellman protocol.
And then a key exchange is going to occur in both directions.
This establishes the first phase.
So now that we have the IKE phase one tunnel created,
the shared secret key that was created in phase one
is then going to be used to establish encryption
and integrity protocols within that IPSec tunnel.
So we get a tunnel inside of a tunnel.
Then, the data is going to flow in each direction securely
within this new tunnel,
and that's going to complete our phase two.
Now, during those steps,
I mentioned a term called Security Association.
For the Security Plus exam, you need to know
what a Security Association is.
Well, a Security Association, or an SA,
is an establishment of secure connections
and shared security information using certificates
or cryptographic keys.
So, basically it's you trust me and I trust you,
we've shared information and now we know each other
and we've verified our identities.
Now, the next thing we have to talk about
is this concept of an Authentication Header,
this is because the Authentication Header
is a protocol using IPSec to provide integrity
and authentication.
The Authentication Header is actually hashed
to provide that integrity and it's often used
with an Encapsulating Security Payload known as an ESP.
An ESP is going to provide you integrity, confidentiality,
and authentication for the packets
by encapsulating them and encrypting them.
So, by using just the Authentication Header,
we're going to get integrity and authenticity.
But, if we use ESP as well we're going to get integrity,
confidentiality and authenticity.
So a lot of times we'll use both of them
to get us a more secure tunnel.
Now, IPSec can be operated in one of two modes.
There's Transport mode and there's Tunnel mode.
When we talk about Transport mode,
this is where there's a Host-to-Host transport mode
using only encryption of the payload of an IP packet
but not its header.
I like to think about this like a semi-truck.
The cab in the front that pulls the trailer,
that's the header, that part's not encrypted.
But everything in that back trailer is encrypted,
we put a lock on that back door.
That's the idea with Transport mode.
Now that means that we can route things around the network
and people are going to know where it went
and where it came from, but they're not going to know
what the payload is.
That's pretty good.
But, when we do that, that means people can see
where it's going, and so Transport mode is only used
for transmission between hosts on a private network,
or at least it should be.
If you're going to send things over the internet,
you really don't want to use Transport mode,
instead we want to use Tunnel mode.
And, Tunnel mode is going to create
an end-to-end network tunnel that's created
that's going to encrypt the entire IP packet,
the payload and the header.
So I like to think about this again as that semi-truck.
I've got the cab in the front where the driver sits
and I've got the payload in the back.
If I put that entire truck into another box
and put it on a ship, that's the idea of Tunnel mode,
nobody can see the driver and the payload
and where he's going,
and nobody can see what's in the back, the payload part.
And so by doing that encryption,
you're going to get the entire thing tunneled.
Usually we're going to use this when we're doing point-to-point
over something like the internet.
Tunnel mode is commonly used for transmission
between networks over an untrusted network.
And so you're going to see Tunnel mode used a lot
inside of VPNs.
(electronic music)