Key Features and Components

Encryption

• IPsec encrypts the data that is sent over the Internet, making it unreadable to anyone who intercepts it
• This ensures the confidentiality of sensitive data

Authentication

• IPsec uses various authentication methods (such as digital certificates or pre-shared keys) to verify that the devices involved in the VPN connection are who they claim to be
• This prevents unauthorized access to the network

Data Integrity

• IPsec provides mechanisms to ensure that data hasn't been altered during transmission
• This is done using cryptographic hash functions

Tunneling

• In an IPsec VPN, the data is encapsulated (or 'tunneled') within an encrypted IP packet
• This makes it appear as if the data is being sent to a different address, ensuring that even if it is intercepted, it cannot be easily traced to the original source

Security Associations (SA)

• An IPsec VPN relies on Security Associations, which are agreements between two endpoints on the encryption and authentication methods to use, as well as the keys to be shared

Protocols Used in IPsec

• AH (Authentication Header) 
  • IP Protocol 51
  • Ensures data integrity and authentication of the IP packets
  • However, it does not provide encryption
• ESP (Encapsulating Security Payload)
  • IP Protocol 50
  • Provides encryption, along with integrity and authentication
  • This is the more commonly used protocol in an IPsec VPN
  • ESP Modes of Operation
    • Transport
      • Payload is protected but the original IP header is not
      • Packet Representation - [Original IP Header] [ESP Header] [Encrypted Payload]
    • Tunnel
      • Original IP and payload packet are protected
      • Packet Representation - [New IP Header] [ESP Header] [Encrypted Original IP Header] [Encrypted Payload]

How IPsec VPN Works Via IKE Phases

IKE (Internet Key Exchange) Overview

• IPsec leverages a suite of protocols 
• Transform sets consist of these security protocols and algorithms that are shared between two endpoints to encrypt and authenticate data transmitted over the VPN
• IKE is therefore utilized for the negotiation of transform set parameters to establish a secure tunnel
• IKE and ISAKMP are often used interchangeably 
• Types of IKE
  • IKEv1
    • IKEv1 uses two phases for negotiation 
    • Phase 1 and Phase 2 as mentioned below
  • IKEv2
    • IKEv2 simplifies the process by combining both Phase 1 and Phase 2 into a single phase, making it more efficient 
    • IKEv2 uses a single exchange to handle both the security association and the key exchange, which reduces latency and speeds up overall setup process
    • IKEv2 is not compatible with IKEv1 
    • IKEv2 supports better encryption algorithms 

Phase 1 (IKE - Internet Key Exchange)

• This phase establishes a secure control plane communication channel between the two devices (the client and the VPN gateway or two routers)
• It negotiates the encryption methods and the keys to use
• The result is a secure, authenticated channel (often referred to as the 'IKE SA' or IKE Security Association) 
• Phase 1 HAGLE Parameters 
  • Hash
  • Authentication
  • Diffie-Hellman group
  • Lifetime (24 hour by default)
  • Encryption

Phase 2 (IPsec)

• Once the secure channel is established in Phase 1, Phase 2 sets up the actual data plane IPsec tunnel for transmitting encrypted data
• It uses the parameters established in Phase 1 to negotiate encryption keys for the data packets
• The IPsec VPN can now securely transmit data between the two endpoints, ensuring confidentiality, integrity, and authenticity
• Perfect Forward Secrecy (PFS) is supported and can be used to acquire new session keys for Phase 2 
• Lifetime of a Phase 2 tunnel is 12 hours by default in most vendors

Types of IPsec VPN Configurations

Site-to-Site VPN

• This type of VPN connects two networks over the Internet securely
• For example, it could be used to connect the headquarters of a company to a remote branch office
• Both sites use IPsec to encrypt and authenticate all communication between them

Remote Access VPN

• In this setup, individual users (often employees working remotely) connect to a central network (like a company's internal network) using an IPsec VPN client
• Their data is encrypted and securely transmitted over the Internet to the company's VPN gateway

DMVPN

• Referred to as Dynamic Multipoint VPN
• This Cisco VPN deployment is for Hub and Spoke topologies 
• The NHRP protocol is used to dynamically form tunnels with spokes
• Routing protocols can be run and utilizes either IKEv1 or IKEv2

FlexVPN

• An enhanced version of Cisco's DMVPN
• Solution for Hub and Spoke topologies 
• This VPN technology relies on IKEv2 only 

GetVPN

• Referred to as Group Encrypted Transport 
• This Cisco VPN technology is commonly used for Service Provider MPLS networks interconnecting branch sites
• An encrypted tunnel builds over the MPLS network preserving the original IP Header and QoS tags

Benefits of IPsec VPN

Security

• IPsec VPN provides robust encryption, ensuring that sensitive information is protected while being transmitted over the Internet
• By using cryptographic hashes and authentication protocols, IPsec ensures that the data has not been tampered with and that both parties are who they claim to be

Scalability

• IPsec VPNs can scale to support large networks, whether it's connecting multiple offices in a business or supporting hundreds of remote workers

Support for Multiple Platforms

• IPsec VPN is supported by a wide variety of devices and platforms, including routers, firewalls, operating systems, and mobile devices, making it a versatile solution for different environments

Compatibility with IPv6

• IPsec supports both IPv4 and IPv6, allowing it to work in modern networking environments

Potential Drawbacks

Complexity

• Configuring an IPsec VPN can be complex, especially when dealing with advanced features like multi-site connections or remote access configurations

NAT Traversal

• IPsec can have issues when passing through NAT (Network Address Translation) devices, as the IP addresses may get altered
• However, this can be resolved using features like NAT-T (NAT Traversal), which allows IPsec to work with NAT devices

IPsec VPN Topology