Encryption Technology Applications · Topic 2 of 3
VPN Overview
Learn VPN types and key technologies, GRE, L2TP, IPsec AH and ESP, transport and tunnel modes, IKE phases and SSL VPN for the HCIA-Security H12-711 exam.
- 5 min
- ESP is IP protocol 50 and encrypts; AH is protocol 51 and does not encrypt; IKE uses UDP 500, and UDP 4500 with NAT traversal.
- GRE (protocol 47) and L2TP (UDP 1701) tunnel traffic but do not encrypt it.
- An IPsec SA is one way and identified by SPI, destination address and security protocol.
What it is
A virtual private network (VPN) builds a private network over a shared public network such as the internet. Branches and remote users reach headquarters as if on a private line.
The core idea is the tunnel: the original packet is wrapped inside a new packet that crosses the public network. IPsec and SSL VPN also encrypt and authenticate the contents.
How it works
VPN classification
| Basis | Types |
|---|---|
| Application scenario | Site to site (branch to HQ); client to site, also called remote access (mobile user to HQ) |
| Network layer of the protocol | Layer 2: L2TP, PPTP; Layer 3: GRE, IPsec; application layer: SSL VPN |
| Who builds it | Enterprise built on its own firewalls; carrier provided, such as MPLS VPN |
Key VPN technologies
| Technology | Purpose |
|---|---|
| Tunneling | Encapsulates the original packet so it can cross the public network |
| Encryption and decryption | Keeps the data confidential |
| Identity authentication | Confirms that the peer or user is genuine |
| Data authentication | Confirms the data was not altered and came from the peer |
| Key management | Creates and refreshes keys safely, such as IKE in IPsec |
GRE and L2TP
GRE (Generic Routing Encapsulation, IP protocol 47) wraps one protocol inside IP. It carries multicast, so OSPF can run across it, but it has no encryption of its own.
L2TP (Layer 2 Tunneling Protocol, UDP port 1701) tunnels PPP frames from the LAC (L2TP access concentrator) to the LNS (L2TP network server) at headquarters, which authenticates the user. L2TP also lacks encryption, so it is often run over IPsec.
IPsec framework
IPsec is a suite of IETF protocols that protects IP traffic at the network layer. It has two security protocols and a key exchange protocol:
| Protocol | Identifier | Provides |
|---|---|---|
| AH (Authentication Header) | IP protocol 51 | Data origin authentication, integrity and anti-replay; no encryption |
| ESP (Encapsulating Security Payload) | IP protocol 50 | Encryption plus origin authentication, integrity and anti-replay |
| IKE (Internet Key Exchange) | UDP port 500 (4500 with NAT traversal) | Negotiates SAs and keys automatically and authenticates the peers |
AH also authenticates the outer IP header, so it fails when NAT changes the address. ESP does not, so it works with NAT traversal and is the usual choice.
Security associations
An SA is an agreement between two peers on the protocol, algorithms, keys and lifetime. An IPsec SA is one way, so a two way tunnel needs a pair, and each is identified by three values: the SPI, the destination IP address and the security protocol (AH or ESP).
SAs can be manual, but IKE normally negotiates and refreshes them.
Transport mode and tunnel mode
| Mode | What is added | Typical use |
|---|---|---|
| Transport mode | The AH or ESP header goes between the original IP header and the payload; the original IP header is kept | Host to host, when the two endpoints are the peers |
| Tunnel mode | The whole original packet is encapsulated, and a new outer IP header with the gateway addresses is added | Gateway to gateway, the normal choice for site to site VPN |
IKE negotiation
IKEv1 works in two phases:
- Phase 1 builds the IKE SA, a secure and authenticated channel. Main mode uses six messages and protects the peer identities. Aggressive mode uses three messages and is faster, but sends identities unprotected.
- Phase 2 uses quick mode, three messages inside the IKE SA, to negotiate the IPsec SAs that protect the data.
IKEv2 sets up the IKE SA and the first pair of IPsec SAs with only four messages in two exchanges. It is simpler and faster, and is the recommended version.
Peers authenticate with a pre-shared key or digital certificates, and DH creates the shared keying material.
SSL VPN
SSL VPN is a remote access VPN over SSL and TLS on TCP port 443. A user needs only a browser, or a light client for full access, and connects to a virtual gateway on the firewall.
It suits mobile staff, because HTTPS passes almost any firewall or NAT. IPsec suits fixed site to site links.
A worked example
A branch must exchange OSPF routes with HQ across the internet, encrypted. Policy based IPsec protects unicast traffic matched by an ACL and does not carry OSPF multicast.
The design uses GRE over IPsec: OSPF runs across the GRE tunnel, and IPsec encrypts the GRE packets.
How the exam asks about this
- "Which IPsec protocol provides encryption?" → ESP. AH gives integrity and authentication only.
- "How many messages does IKEv1 main mode use?" → Six.
- "Which VPN is classified as Layer 2?" → L2TP (also PPTP).
What to remember for the exam
- ESP is IP protocol 50 and encrypts; AH is protocol 51 and does not encrypt; IKE uses UDP 500, and UDP 4500 with NAT traversal.
- GRE (protocol 47) and L2TP (UDP 1701) tunnel traffic but do not encrypt it.
- An IPsec SA is one way and identified by SPI, destination address and security protocol.
- Tunnel mode adds a new IP header and suits gateways; transport mode keeps the original header and suits hosts.
- IKEv1: phase 1 main mode six messages or aggressive mode three, then phase 2 quick mode. IKEv2: four messages.
AH does not work through NAT, because NAT changes the IP header that AH authenticates. When the exam adds a NAT device between the peers, the answer is ESP with NAT traversal.
Common mistakes
Assuming every VPN encrypts. GRE and L2TP only build tunnels. Confidentiality comes from IPsec or SSL, often added on top.
Thinking one SA covers both directions. IPsec SAs are one way, so a working tunnel shows an inbound and an outbound SA. The IKE SA is two way.
Putting SSL VPN at the network layer. SSL VPN runs at the application side over TCP 443. IPsec and GRE are the Layer 3 VPNs.
Check yourself
Which IKEv1 mode should be used when peer identities must be protected in phase 1?
Main mode, which encrypts the identity exchange in its last two messages, unlike aggressive mode.
What does tunnel mode add to the original packet?
A new outer IP header with the gateway addresses, plus the AH or ESP header, with the whole original packet inside.
Why is GRE often combined with IPsec?
GRE carries multicast and routing protocols but has no encryption, while IPsec adds confidentiality and integrity.
Topic 2 of 3 in Encryption Technology Applications
Test yourself on Encryption Technology Applications
The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.