CND (312-38) Network Defense Simulation
In this simulation, you will analyze VPN traffic protocols to determine how data protection is enforced in transit. You will learn to differentiate between key exchange mechanisms, data integrity controls, and payload encryption standards.
Network Scenario
You are configuring a site-to-site VPN over the public internet connecting the Corporate HQ (203.0.113.5) and a newly acquired Branch Office (198.51.100.10).
The company’s security policy explicitly states: "All proprietary traffic traversing external networks MUST be encrypted to prevent eavesdropping and data interception." You are reviewing a packet capture to verify that the deployed IPsec tunnel complies with this confidentiality requirement.
Traffic & Logs
PCAP snippet from the edge firewall (External Interface):
# Active VPN Traffic (Payload cannot be read by deep packet inspection) 08:14:03.411 IP 203.0.113.5 > 198.51.100.10: ESP(spi=0x4a3b2c1d,seq=0x1), length 120 08:14:03.425 IP 198.51.100.10 > 203.0.113.5: ESP(spi=0x9f8e7d6c,seq=0x1), length 136 08:14:03.501 IP 203.0.113.5 > 198.51.100.10: ESP(spi=0x4a3b2c1d,seq=0x2), length 152
Question
Andrew would like to configure IPsec in a manner that provides confidentiality for the content of packets. What component of IPsec provides this capability?
Expert Analysis
Two gateways are establishing a secure site-to-site VPN. They first negotiate security parameters using IKE/ISAKMP (UDP 500). Once the Security Associations (SAs) are established, bulk data transfer begins.
To prevent MITM (Man-in-the-Middle) attacks and packet sniffing from compromising proprietary data, the VPN is enforcing Confidentiality by encrypting the inner packet payload before sending it across the WAN.
B. ESP (Encapsulating Security Payload) is the IPsec protocol (IP Protocol 50) responsible for providing data confidentiality (encryption), as well as origin authenticity and integrity. As seen in the logs, deep packet inspection only sees the ESP header; the TCP/UDP/ICMP payload underneath is mathematically unreadable.
- A. IKE (Internet Key Exchange): Negotiates the connection and keys but does not encrypt the bulk data.
- C. AH (Authentication Header): Provides integrity and authentication (IP Protocol 51), but does not encrypt the payload. Traffic sent via AH is readable in plaintext by sniffers.
- D. ISAKMP: Defines the framework for authentication and key exchange, operating as part of IKE Phase 1/2.
When configuring VPNs over untrusted networks (like the Internet), always select ESP in Tunnel Mode to hide both the payload and the original internal IP headers. AH is only suitable for trusted environments where encryption overhead is undesirable and only tampering detection is required.
- Protocol 50 (ESP): Encrypts payload (Confidentiality) + Integrity.
- Protocol 51 (AH): NO encryption. Digital signature for Integrity + Authentication only.
- UDP 500/4500 (IKE/ISAKMP): The control plane for the tunnel. UDP 4500 is used when NAT-Traversal is required.