Implementing Virtual Private Networks (VPN)

Split tunneling is a VPN feature that allows a user to access a public network (the internet) and a private network (the VPN) simultaneously, separating traffic based on the destination.

ISAKMP (Internet Security Association and Key Management Protocol) policies require five parameters: Encryption, Hash, Authentication, Group (Diffie-Hellman), and Lifetime.

Before any tunnel can be established, the gateway must identify traffic that is designated to be protected by the IPsec tunnel, which is known as interesting traffic.

3DES (Triple Data Encryption Standard) is a symmetric-key block cipher used to encrypt data, which provides confidentiality by ensuring that only authorized parties can read the information.

AH (Authentication Header) provides data integrity and authentication for IP packets but does not provide encryption, meaning it does not offer confidentiality.

The IKE (Internet Key Exchange) protocol uses the Diffie-Hellman algorithm to securely exchange keys over an insecure network, allowing peers to calculate a shared secret key.

Interesting traffic is typically identified using an access control list (ACL) that specifies which source and destination IP addresses or subnets should trigger the VPN tunnel.

IKE Phase 1 establishes a secure channel (ISAKMP SA), while IKE Phase 2 uses that secure channel to negotiate the IPsec security associations (SAs) that will protect the actual data traffic.

Integrity ensures that the data has not been altered in transit. This is typically verified using hashing algorithms like HMAC-MD5 or HMAC-SHA.

VPNs allow remote users to access internal network resources securely over the internet, which scales better than physical network expansion for every new user. While security is a feature, the ability to accommodate growth without physical infrastructure changes is the primary scalability benefit.

NAT-Traversal (NAT-T) detection occurs during the initial IKE Phase 1 exchange (specifically in the main or aggressive mode) to determine if there is a NAT device between the peers. If detected, the peers will encapsulate ESP packets in UDP port 4500.

GRE (Generic Routing Encapsulation) is a tunneling protocol that creates a virtual point-to-point link to encapsulate a wide variety of network layer protocols inside virtual point-to-point links. It does not provide encryption by itself, which is why it is often paired with IPsec.

An ISAKMP policy defines the security parameters (encryption, hash, authentication method, Diffie-Hellman group, and lifetime) that two peers agree to use to establish a secure management tunnel (Phase 1).