Welcome back.
In the previous modules of the course,
we detailed IPsec and its functionality by looking
at it through the IPv4 window.
This module is all about IPv6,
and we're going to learn all about how IPsec works within it.
The functionality is similar in many ways,
but the differences between IPv4 and IPv6 with regards to IPsec are key.
Throughout this module,
we'll be talking about the protocol that many in the
industry still don't like to talk about,
IPv6.
We're going to start off this conversation by discussing the
nuances of IPsec in IPv6 and how it works.
We'll then get into the implementations that are possible with this combination.
After,
we'll detail some ways to migrate your environment from IPv4 to
IPv6 using a few special tunnels and modes.
During this section,
we'll hop into the lab and configure and analyze one of these methods.
After that,
we're going to hop into the lab again and configure a
site-to-site VPN using IPsec for IPv6 and analyze what's
going on there so we can see it in action.
Then, we'll wrap up the module and get ready for the next one.
So starting in the conversation about how IPsec works in IPv6,
we need to go back in time to the development of the protocol,
IPv6 that is.
Back then, IPsec was already in use in IPv4,
and the creators of IPv6 knew that security was a crucial,
fundamental concept that had to be included in the
internet protocol they were creating.
Through the use of something called extension headers,
IPsec with IPv6 is possible and is thought of as being built into the protocol.
Some say it's mandatory, some say it's not.
Truthfully,
implementing IPsec in IPv6 isn't mandatory at all for an
IPv6 network to function properly.
The only requirement is that all implementations of
IPv6 should support this feature, not actually require it for implementation.
Hopefully that clears up some confusion as you're reading and learning about it.
So these extension headers are something in the IPv6 stack that are
very useful for identifying different types of traffic and allowing
for the use of extensions to the protocol.
What's cool about these is that they are only added to the datagram as
needed for a particular service that they're providing.
In our case, the service is the IP security using AH and ESP.
Instead of changing and removing headers to implement services like ESP in IPv4,
IPv6 allows us to simply add an extension header to the already created stack,
and it already has a place to go in the datagram.
These headers vary in size based on the service provided and
give us great flexibility in the protocol.
As in IPv4,
AH and ESP can be used either independently of each other or
in conjunction with each other in IPv6.
Just like we would want,
it gives us great flexibility in choosing our
services that we implement in IPv6.
I still recommend using ESP at the very least so you can
provide encryption services for your data.
In IPv6, there's still many similar concepts,
such as the tunnel and transport modes, the security associations,
and authentication methods.
So essentially,
the functionality and services provided in IPv6 for
IPsec are similar to those of IPv4.
IKEv1 and IKEv2 function similarly between the two IP versions,
but there are some key differences in the configurations
and in the analysis of the packets.
One of those differences is the addresses, of course.
Something that I want you to remember as we're going through this module and
detailing the implementation methods is that with IKEv1 we can only have one
of those IP versions in each tunnel or SA.
The address families must match.
With IKEv2, we can have multiple,
which allows us to ride the protocols together across the SAs. This allows us to transition our address scheme slowly over time.