Hi, everyone! Today I’m going to introduce what is ipsec vpn and how it works episode 1 REPRINT.
authorized reprint by author zhushigeng(Vinsoney)
1. Technical Background
The preceding figure shows the network of a large company. In addition to the central site, there are multiple branches or offices across a country and employees on business trips. The nodes need to communicate with one another. The simplest and most economical method is to use the Internet to implement mutual data access. However, the Internet is a shared network environment with many security threats. It is risky to transmit confidential data directly over the Internet. Traditionally, private lines are leased by such a company. A private line is a dedicated line, which is more secure but more expensive. In addition, the private lines cannot support mobility. IPsec VPN can solve the preceding problems.
IPsec VPN is a widely used and mature VPN technology. IPsec VPN transmits confidential data on the public network because IPsec provides various functions, such as security, integrity, identity authentication, and anti-replay defense. IPsec VPN networking is flexible. In addition to the typical site-to-site IPsec VPN networking, remote dialup networking is supported.
2. IPsec VPN Implementation
As shown in the preceding figure, if data is transmitted directly over the Internet, the data is exposed to many security risks. IPsec VPN technology can protect data transmission. The figure illustrates a typical site-to-site or LAN-to-LAN IPsec VPN application scenario. The two sites communicate with each other across the Internet. IPsec VPN is deployed on a firewall at each site to protect traffic exchanged between the two sites. After IPsec VPN is deployed, an IPsec VPN tunnel is established between the firewalls.
In this process, the two ends negotiate an encryption algorithm and a hash algorithm used to protect traffic transmitted along the tunnel. After a unified algorithm or policy is used, two ends exchange common values to generate matching keys for subsequent encryption and hash implementation. Then, peer identity authentication is performed to verify identities of the two firewalls. The packets exchanged between the two ends for identity authentication are protected using the negotiated encryption algorithm and hash algorithm.
After the preceding operations are complete, the two parties negotiate various security policies (IPsec proposals) for protecting traffic between internal networks at the two sites. The security policies include the security protocol type, encryption algorithm, and hash algorithm. After the preceding operations are complete, an IPsec VPN tunnel is established.
This means that an invisible and protected communication channel is established across the Internet. Protected traffic (also known as IPsec VPN traffic) between sites 1 and 2 is transmitted along the tunnel and encrypted during transmission, which ensures communication confidentiality. In addition, data integrity check is performed to check whether data is tampered with during transmission. As shown in the preceding figure, user data is to be protected. After being sent to a site firewall, the data is identified and is to be processed using IPsec VPN. Then the data is encrypted and hashed. In addition, a security protocol header (for example, an ESP header) is added to the data. To allow the data packets to be transmitted through the firewall of the other site on the Internet, a new IP header or a new tunnel header is added to the data.
The preceding figure illustrates an example of data transmission in an IPsec VPN environment. A node on the network segment (192.168.1.0/24) at site 1 wants to access site 2. The node can use the destination IP address in the 192.168.2.x format to access site 2. This is because IPsec VPN tunneling technology enables the two sites to communicate with each other using the actual peer IP addresses.
After a simple text data packet reaches the egress firewall at site 1, the firewall finds that the traffic matches the configured IPsec VPN. Therefore, the firewall uses the negotiated encryption policy and key to encrypt the packet and performs hash calculation on the encrypted data. Then the processed data packet is encapsulated behind a security protocol header. A new IP header is also added to the packet. The new IP header is called a tunnel header, with the source address of 100.1.1.1 and destination address of 200.2.2.2. Note that the source and destination IP addresses are public IP addresses that belong to the external interfaces of the firewall. Ultimately, the data packet is transmitted to the firewall at the peer site through the Internet.
The data packet has been securely processed and cannot be intercepted or tampered with during transmission. After the data packet arrives at the firewall at site 2, the tunnel header is removed. The firewall checks the security protocol header and obtains information, such as the locally stored security policy and key, and then performs integrity check and decryption on the data packet. Then the decrypted simple text data is sent to the destination network of 192.168.2.0.
learn more: what is ipsec vpn and how it works episode 2 REPRINT
If you have any problems, please post them in our Community. We are happy to solve them for you!
