1. IPSec VPN
Chapter 13 of Malik

2. Outline Types of IPsec VPNs IKE (or Internet Key Exchange) protocol

3. Types of IPsec VPNs Site-to-site (aka LAN-to-LAN) IPsec VPN
Figure 13-1
Question: no concentrator?
Remote-access client IPsec VPN
Figure 13-2
Unique challenges: (see p.317)
IPsec clients use unknown-to-gateway IP addresses to connect to the gateway
Client’s IP address assigned by the ISP is not compatible with the private network’s addressing.
The clients must use the DNS server, DHCP server, and other such servers on the private network.
PAT can no longer function as normal (because ESP encrypts all the port info in the TCP or UDP header).
* dialup POTS: Plain Old Telephone System
Also called PSTN (Public Switched Telephone Network)
* LCP negotiation:
Short for Link Control Protocol, a protocol that is part of the PPP. In PPP communications, both the sending and receiving devices send out LCP packets to determine specific information that will be required for the data transmission. The LCP checks the identity of the linked device and either accepts or rejects the peer device, determines the acceptable packet size for transmission, searches for errors in configuration and can terminate the link if the parameters are not satisfied. Data cannot be transmitted over the network until the LCP packet determines that the link is acceptable.

4. Phases of IPsec Connection initiated IKE main mode or aggressive mode
Results:
creation of an IKE Security Association (SA) between the two IPsec peers
A set of 3 session keys are established
Quick mode
creation of two IPsec SAs between the two peers (incoming SA and outgoing SA)
Generate a pair of IPsec keys (one for each of the SAs)
Data communication (using ESP or AH)
* dialup POTS: Plain Old Telephone System
Also called PSTN (Public Switched Telephone Network)
* LCP negotiation:
Short for Link Control Protocol, a protocol that is part of the PPP. In PPP communications, both the sending and receiving devices send out LCP packets to determine specific information that will be required for the data transmission. The LCP checks the identity of the linked device and either accepts or rejects the peer device, determines the acceptable packet size for transmission, searches for errors in configuration and can terminate the link if the parameters are not satisfied. Data cannot be transmitted over the network until the LCP packet determines that the link is acceptable.

5. IPsec Negotiation using IKE
P.279: Authentication methods vs modes
Preshared
key
Digital
signature
Encrypted
nonces
Main mode
Aggressive
mode
* dialup POTS: Plain Old Telephone System
Also called PSTN (Public Switched Telephone Network)
* LCP negotiation:
Short for Link Control Protocol, a protocol that is part of the PPP. In PPP communications, both the sending and receiving devices send out LCP packets to determine specific information that will be required for the data transmission. The LCP checks the identity of the linked device and either accepts or rejects the peer device, determines the acceptable packet size for transmission, searches for errors in configuration and can terminate the link if the parameters are not satisfied. Data cannot be transmitted over the network until the LCP packet determines that the link is acceptable.

6. IPsec Negotiation using IKE
Example 1: Main mode using preshared key authentication followed by Quick mode negotiation pp
Example 2: Main mode using DS authentication followed by Quick mode negotiation pp
Example 3: Aggressive mode using Preshared key authentication (followed by Quick mode negotiation) pp
* dialup POTS: Plain Old Telephone System
Also called PSTN (Public Switched Telephone Network)
* LCP negotiation:
Short for Link Control Protocol, a protocol that is part of the PPP. In PPP communications, both the sending and receiving devices send out LCP packets to determine specific information that will be required for the data transmission. The LCP checks the identity of the linked device and either accepts or rejects the peer device, determines the acceptable packet size for transmission, searches for errors in configuration and can terminate the link if the parameters are not satisfied. Data cannot be transmitted over the network until the LCP packet determines that the link is acceptable.