Now that we know about two of these major categories of VPNs,
let's talk about some implementations of them.
Of course,
we technically don't need any of these fancy implementations and
simply can create an IPsec VPN connection by itself,
but where's the fun in that?
Using this method,
you would configure it by just applying what's called
crypto maps to the individual interfaces to encrypt the
traffic that we define in the maps.
This is the simplest form of IPsec configuration in network devices.
So the next one, well, actually,
two that I'm going to talk about are GRE over IPsec and IPsec over GRE.
The latter is much less common than the former.
With GRE over IPsec, we encapsulate the entire packet within the IPsec datagram.
Conversely, with IPsec over GRE, only the payload is protected by IPsec,
and the routing information stays visible in the GRE portion of the datagram.
The GRE over IPsec is essentially DMVPN over IPsec.
I know I just mentioned it, but just using the IPsec connection is a possibility,
and this is used in some organizations today.
This can be done in the form of static and dynamic virtual tunnel interfaces,
or VTIs, as well as just using the crypto maps that I previously mentioned.
These VTIs can be used in both site-to-site and remote access connections,
with the former being mostly SVTIs.
These are the logical interfaces that are configured on the
devices that allow the IPsec suite to protect the traffic
that goes in and out of it.
These are very simple to set up and can be useful
for a quick IPsec implementation.
Another cool implementation that's available is what's called VRF-Aware IPsec.
This one allows us to create IPsec tunnels for different VRF domains and
gives us the ability to control the flow of traffic.
A VRF separates its routing table from the global routing
table and functions like a segmented router within the router
from the most basic perspective.
You can have multiple VRFs going in and out of your network.
This is a key concept for MPLS networks.
The VRF-Aware IPsec utilizes IPsec and maps those tunnels to each
VRF instance using the public-facing address.
Now this is some cool stuff.
The remote access VPN implementation is configured directly on
the operating system or through an application,
as stated before.
This is typically implemented in the IP stack of the operating system.
There are many vendors and products out there for organizations to utilize.
Most of the major network and security companies have their own
products for remote access VPN termination in clients.
What I'm going to be using in my lab today is the NordVPN service,
and I'll be configuring this directly on my Windows box to
get a secure VPN connection up and running.
It's always recommended to have a VPN connection in public Wi-Fi hotspots,
so why not learn about it here, right?
Something that we'll be covering much more in detail later on in
the course is the IPv6 implementation of IPsec.
To go along with that,
I'm going to start that conversation a little bit now by mentioning
the mixed mode and dual stack IPsec implementations.
These help us transition our networks over to IPv6 and gives us the
capability to run both versions simultaneously.
We talk about these more in detail later on in the course, along with all of the information about how IPsec fits in with IPv6.