Welcome back to this course, and what a course it's been.
I really hope that you learned a lot through the modules as we built
up the IPsec protocol suite from the ground up.
It definitely has been a lot of information to cover.
Let's talk about this module's objectives really quickly.
In this module, we're going to wrap up the course.
First,
we're going to talk a little bit about each module
that we covered in the course.
We'll review some of the key points to take home.
Then,
we'll cover some additional resources to use if you
want to dig even deeper into IPsec.
After that, we'll wrap it all up and send you on your way.
Let's start out by talking about the need for IPsec.
So IPsec, it's a protocol, right?
Well, kind of.
It's more like a protocol suite.
The question is why do we need it?
Well,
security is a huge factor that plays a part in every
single organization's IT roadmap, or so it should anyway,
so protecting our data is crucial.
With the advent of multisite or multinational organizations,
the need for site-to-site connectivity is present,
so is the need for remote access to the organizational resources.
We need to protect this data transfer.
Prying eyes can see a lot of information and make our
infrastructure risks more prevalent.
IPsec is the solution to this.
It helps us protect our data through strong
authentication and encryption methods.
Now let's talk about the building blocks of this IPsec protocol suite.
Four main categories were discussed with these,
which are the security protocols, the security associations,
the key management, and the cryptographic algorithms.
We have many options and combinations that we can use within these.
With regards to the security protocols though,
we have the Authentication Header and the
Encapsulating Security Payload protocols.
One encrypts our data, one doesn't.
It's also worth mentioning here that the security associations are
essentially our tunnel mechanisms that unidirectionally connect to our IPsec
peers and provide the ability to use the IPsec services.
We also detailed how to use IPsec in the enterprise earlier in the course.
There were many implementation methods that we covered there,
but we focused quite a bit on two different categories:
site-to-site and remote access VPNs.
These two different types have many flavors and vendors that
implement them in many different ways.
site-to-site VPN links connect our headquarters with one or
multiple sites that need to access their resources.
With the remote access VPNs,
we learned that they're more for the endpoints and remote workers.
IKEv1 was a very big discussion point in this module.
It's considered obsolete by many, but it's still being widely used today.
It's relatively easy to configure,
and many engineers are very comfortable with the
technologies within it and how it works.
It has two phases, appropriately called phase 1 and phase 2.
In phase 1, we have two different modes,
main mode and the less secure, but quicker SA establishing,
aggressive mode.
Phase 2 has only one mode, which is quick mode.
This right here is how IPsec tunnels are established,
phase 1, then a secure phase 2 that rides on phase 1.
Speaking of IKE, we also discussed IKEv2 in detail.
It's crazy how similar this is to version 1, but also how different it is.
IKEv2 brought about many enhancements over version 1,
including one of my favorite benefits, reliability.
IKEv2 provides this along with many other enhancements.
It also brings us the ability to have multiple child
SAs created from a single parent SA.
We can have multiple address families in here and
multiple protocol combinations here.
IKEv2 is a very nice upgrade and gives us a lot of
flexibility in our configurations.
It's being adopted more and more every day,
and truthfully should be the standard for VPN
production in every single organization.
Finally, we dug into the IPsec use in the IPv6 protocol.
We learned that there wasn't much of a difference between IPv4
and IPv6 with regards to how IPsec works.
The differences are mainly in the implementation
methods and the datagram structures.
During this discussion,
we detailed a few different implementation methods and transition methods for IPv6 IPsec and saw how our data could be protected.