Welcome to the CND network defense simulation. In this exercise, you will learn to map VPN technologies to the OSI model. Understanding how IPsec encapsulates traffic is critical for configuring site-to-site VPNs and troubleshooting firewall rules.
CND (312-38) Network Defense Simulation
Network Scenario
You are a network security engineer tasked with establishing a secure Site-to-Site VPN between the corporate headquarters and a new branch office. You are configuring an IPsec tunnel using ESP (Encapsulating Security Payload) to provide confidentiality and integrity.
To ensure the tunnel establishes successfully, you must configure the edge firewall to allow the necessary IPsec protocols. You are reviewing the traffic capture to verify that encapsulation is occurring at the correct layer before entering the public WAN.
Heather has been tasked with setting up and implementing VPN tunnels to remote offices. She will most likely be implementing IPsec VPN tunnels to connect the offices. At what layer of the OSI model does an IPsec tunnel function on?
Hint: Look at the PCAP snippet. The protocol being encapsulated directly inside the IPv4 header is ESP (Protocol 50). IPv4 operates at Layer 3. IPsec operates at this same layer to encrypt and route the encapsulated packets.
Expert Analysis
1. What is happening in the network
A site-to-site IPsec VPN is being established. IKE (Internet Key Exchange) over UDP port 500 is handling the key negotiation. Once the Security Associations (SAs) are established, the actual data is being encrypted and encapsulated by ESP (Encapsulating Security Payload) under IP Protocol 50.
2. Identify the behavior
This is legitimate network administration. The edge firewall must be explicitly configured to allow these protocols. IPsec is encapsulating internal IP packets within external, routable IP packets (Tunnel Mode) to securely traverse the internet.
3. Why the correct answer is correct
B. They work on the network layer. IPsec operates at the Network Layer (OSI Layer 3). It interacts directly with IP (Internet Protocol) routing, securing IP packets by adding ESP or AH (Authentication Header) extensions to the IP headers.
4. Why others are wrong
A. Data link layer (Layer 2): Layer 2 protocols like L2TP or PPTP are older VPN technologies. While L2TP is often paired with IPsec, IPsec itself is strictly Layer 3.
C. Application or physical layer (Layer 7 / Layer 1): VPNs like SSL/TLS (OpenVPN, AnyConnect) operate at the Application/Session layers. IPsec does not operate at the Physical layer (wires/radio).
D. Session layer (Layer 5): SOCKS proxies and SSL/TLS session establishment operate here, but IPsec encapsulates traffic much lower in the stack.
5. Defensive action
To establish site-to-site IPsec VPNs, defenders must configure edge firewalls to permit ISAKMP (UDP 500), IPsec NAT-Traversal (UDP 4500), and the ESP protocol (IP Protocol 50). Ensure you are allowing "IP Protocol 50", not "TCP/UDP Port 50".
6. MINI LESSON:
Tunnel vs Transport Mode: In IPsec Tunnel mode (used for Site-to-Site), the entire original IP packet is encrypted, and a new IP header is added. In Transport mode (used for Client-to-Site or Host-to-Host), only the payload is encrypted, keeping the original IP header.
Protocol Number vs Port Number: Analysts frequently make the mistake of creating firewall rules for UDP/TCP Port 50. ESP is a Layer 3 protocol assigned IP Protocol number 50. It does not use ports like TCP or UDP.
Traffic Analysis: Since the payload is encrypted (ESP), standard deep packet inspection (DPI) or IDS signatures will not work on the tunneled traffic. Decryption or endpoint monitoring is required to inspect the underlying data.
Master Network Defense
Sharpen your skills with hundreds of scenario-based CND questions.