IPsec and VPNs provide secure communication over insecure public networks like the Internet. IPsec uses cryptography to authenticate and encrypt IP packets. It supports two security services: Authentication Header (AH) for authenticating senders and detecting data changes, and Encapsulating Security Payload (ESP) for authentication, encryption, and encrypting packet payloads. IPsec can operate in two modes - Tunnel Mode encapsulates the entire IP packet for site-to-site VPNs, while Transport Mode only encapsulates the payload for client-to-site VPNs. Virtual Private Networks (VPNs) use IPsec to securely transmit data between private networks over public networks. Common VPN protocols are PPTP, L2TP/IP

1. IPsec and Vpn
PRODUCED BY:
TAPPAL SHETTY KISHORE

2. What is IPsec
•Internet protocol security (IPsec) is a set of protocols that provides
security for Internet Protocol.
•It can use cryptography to provide security.
•IPsec can be used for the setting up of virtual private networks
(VPNs) in a secure manner

3. IPsec Architecture

4. IPsec security services
IPsec involves two security services. They are as follows
•Authentication Header (AH): This authenticates the sender and it
discovers any changes in data during transmission.
•It uses MD5 and SHA
•Encapsulating Security Payload (ESP): This not only performs
authentication for the sender but also encrypts the data being sent
•It used DES, 3DES and AES

5. IPsec Authentication header

6. IPsec modes
There are two modes of IPsec. They are as follows
•Tunnel Mode: This will take the whole IP packet to form
secure communication between two places, or gateways.
•Transport Mode: This only encapsulates the IP payload (not
the entire IP packet as in tunnel mode) to ensure a secure
channel of communication.

7. IPsec ESP

8. IPsec Tunnel mode
• Tunnel mode protects the internal routing information by
encrypting the IP header of the original packet.
• The original packet is encapsulated by a another set of IP headers.
•It is widely implemented in site-to-site VPN scenarios.
•NAT traversal is supported with the tunnel mode.
•Additional headers are added to the packet; so the payload MSS is
less.

9. IPsec Transport mode
•The Transport mode encrypts only the payload and ESP trailer, so the IP header
of the original packet is not encrypted.
•The IPsec Transport mode is implemented for client-to-site VPN scenarios.
•NAT traversal is not supported with the transport mode.
•MSS is higher, when compared to Tunnel mode, as no additional headers are
required.
•The transport mode is usually used when another tunneling protocol (such as
GRE, L2TP) is used to first encapsulate the IP data packet, then IPsec is used to
protect the GRE/L2TP tunnel packets.

10. VPN

11. What is VPN
•A Virtual Private Network is a connection method used to add
security and privacy to private and public networks, like WiFi
Hotspots and the Internet.
•Virtual Private Networks are most often used by corporations to
protect sensitive data.
•Subscribers can obtain an IP address from any gateway city the VPN
service provides. For instance, you may live in San Francisco, but
with a Virtual Private Network, you can appear to live in Amsterdam,
New York, or any number of gateway cities.

12. Why do I need a VPN?
Hide your IP address:
Connecting to a Virtual Private Network often conceals your real IP address.
Change your IP address:
Using a VPN will almost certainly result in getting a different IP address.
Encrypt data transfers:
A Virtual Private Network will protect the data you transfer over public WiFi.
Mask your location:
With a Virtual Private Network, users can choose the country of origin for their Internet connection.
Access blocked websites:
Get around website blocked by governments with a VPN

13. VPN diagrammatic representation

14. Setting Up a VPN
•Setting up a Virtual Private Network is a straightforward process.
•It's often as simple as entering a username and sever address.
•The dominant smartphones can configure Virtual Private Networks
using PPTP and L2TP/IPsec protocols.
•All major operating systems can configure PPTP VPN connections.
OpenVPN and L2TP/IPsec protocols require a small open source
application (OpenVPN) and certificate download respectively.

15. VPN Protocols
PPTP: PPTP has been around since the days of Windows 95. The main selling point of PPTP is
that it can be simply setup on every major OS. In short, PPTP tunnels a point-to-point connection
over the GRE protocol. Unfortunately, the security of the PPTP protocol has been called into
question in recent years. It is still strong, but not the most secure.
L2TP/IPsec: L2TP over IPsec is more secure than PPTP and offers more features. L2TP/IPsec is a
way of implementing two protocols together in order to gain the best features of each. For
example, the L2TP protocol is used to create a tunnel and IPsec provides a secure channel. These
measures make for an impressively secure package.
Open VPN: OpenVPN is an SSL-based Virtual Private Network that continues to gain popularity.
The software used is open source and freely available. SSL is a mature encryption protocol, and
OpenVPN can run on a single UDP or TCP port, making it extremely flexible

16. IPsec VPN

17. IPsec VPN overview
•A virtual private network (VPN) provides a means by which remote computers communicate
securely across a public WAN such as the Internet.
•A VPN connection can link two LANs (site-to-site VPN) or a remote dial-up user and a LAN.
•The traffic that flows between these two points passes through shared resources such as
routers, switches, and other network equipment that make up the public WAN.
•To secure VPN communication while passing through the WAN, the two participants create an IP
Security (IPsec) tunnel.
•NOTE: The term tunnel does not denote tunnel mode. Instead, it refers to the IPsec connection

18. IPsec VPN overview
•IPsec is a suite of related protocols for cryptographically securing
communications at the IP Packet Layer.
•IPsec also provides methods for the manual and automatic negotiation of
security associations (SAs) and key distribution, all the attributes for which are
gathered in a domain of interpretation (DOI).
•The IPsec DOI is a document containing definitions for all the security
parameters required for the successful negotiation of a VPN tunnel—essentially,
all the attributes required for SA and IKE negotiations.

19. IPsec Key Management
•The distribution and management of keys are critical to using VPNs successfully.
•Junos OS supports IPsec technology for creating VPN tunnels with three kinds of key creation
mechanisms:
Manual key
AutoKey IKE with a preshared key or a certificate
Diffie-Hellman Exchange
•You can choose your key creation mechanism—also called authentication method—during Phase 1
and Phase 2 proposal configuration.
•Note: Junos OS is the single operating system that powers Juniper’s broad portfolio of physical and
virtual networking and security products. Built with 20+ years of reliability, security, and flexibility at
its core, it runs some of the world’s most sophisticated network deployments, giving operators a
competitive advantage over other network operating systems.

20. IPsec Key Management
•Manual Key: With manual keys, administrators at both ends of a tunnel configure all the
security parameters.
•AutoKey IKE: When you need to create and manage numerous tunnels, you need a method
that does not require you to configure every element manually. IPsec supports the automated
generation and negotiation of keys and security associations using the Internet Key Exchange
(IKE) protocol. Junos OS refers to such automated tunnel negotiation as AutoKey IKE and
supports AutoKey IKE with preshared keys and AutoKey IKE with certificates.
•Diffie-Hellman Exchange: A Diffie-Hellman (DH) exchange allows participants to produce a
shared secret value. The strength of the technique is that it allows participants to create the
secret value over an unsecured medium without passing the secret value through the wire.

21. Diffie-Hellman Exchange

22. IPsec Tunnel Negotiation
To establish an AutoKey IKE IPsec tunnel, two phases of negotiation
are required:
•In Phase 1, the participants establish a secure channel in which to
negotiate the IPsec security associations (SAs).
•In Phase 2, the participants negotiate the IPsec SAs for encrypting
and authenticating the ensuing exchanges of user data

23. Thank You

24. Questions?