One of the biggest questions in this course that we'll be asking and answering
is, what is IPsec? What makes up IPsec? How was it built?
How does it function?
What does it do for us in our enterprise environments or even at home?
What are the standards documents for this?
We'll answer all of these questions, but first, let's take a stroll
down through the history of IPsec. Encryption has been around for
several decades and truly serves as the basis for the development of
IPsec in my opinion. In the ARPANET days,
packet encryption devices were developed and utilized.
This evolved over time and over vendors to create
different encryption protocols,
devices, and drivers that helped shape the development of
the protocol suite as we know it today.
IPsec has been around for several years now, and the
original RFCs for it were published in 1995.
These are open security extensions that can be used by anyone
and is officially part of the IPv4 suite.
IPsec uses several different protocols and algorithms as part of the suite,
some of which you may know, some you may not.
These include not only the encryption algorithms that we use and
the Encapsulating Security Payload, or ESP, as well as the
Authentication Header, or AH, protocols,
but also a few others. As you can see here,
we have the IKE protocol that we're going to focus on
quite a bit as well in both versions.
This snip is pulled from RFC 6071 and is great to show
the architecture of the protocol.
We're going to cover these in so much more detail later on in the course as
well, so this won't be the last time we see this again.
IPsec functions in two different modes in the most
basic sense, tunnel and transport mode.
The differences between the two are outlined here in the datagram structures.
As you can see, in Tunnel mode, everything is encapsulated in the IPsec datagram.
So when the data is transmitted across something like the internet,
the Layer 3 devices only use the IPsec header to route the
packets until they get to their IPsec destination.
This is used typically in site‑to‑site VPNs and remote
access VPNs. In transport mode, all of the data is
protected by the protocol suite; however,
the original IP headers or not.
The payload is protected here still, which is very beneficial
and is more often used in peer‑to‑peer traffic scenarios, but
can be used in others as well.
We can implement IPsec in many different operating systems, from
network and security devices to end user workstations.
Another thing to note is that these here are slightly different
according to the RFCs between the Authentication Header and
Encapsulating Security Payload formats for each mode. We'll cover this a little later in the course.