1. TCP/IP Protocols Contains Five Layers
Top three layers contains many protocols
Actual transmission at the physical layer

2. TCP/IP Layers Application Presentation Session SMTP FTP DNS TELNET
Applications
SMTP
FTP
DNS
TELNET
HTTP
Transport
TCP
UDP
Network
ICMP
ARP
RARP
Data Link
Physical
Protocols specific to the underlying physical media used for data communication at the hardware level IP

3. Message Transfer using TCP/IP
Original Message
Original Message
TCP header
IP header
Frame header
Source
Destination

4. TCP Reliable transport layer communication
Establishes a logical connection between the communicating hosts
Socket-to-socket communication (Socket = Port + IP address)

5. TCP Segment Format Source Port number Destination Port number
Sequence Number
Acknowledgement Number
Data
2 bytes
4 bytes
20-to-60 bytes header consisting of the following fields
Header Length
4 bits
Reserved
6 bits
Flag
Window size
Checksum
Urgent pointer
Options
0 to 40 bytes

6. IP Best effort delivery Does not guarantee success
Leaves error checking to higher layers (e.g. to TCP)

7. Destination IP address
IP Datagram Format
Version HLEN Service Type Total Length
(4 bits) (4 bits) (8 bits) (16 bits)
Identification Flags Fragmentation Offset
(16 bits) (3 bits) (13 bits)
Time to live Protocol Header Checksum
(8 bits) (8 bits) (16 bits)
Source IP address
(32 bits)
Destination IP address
Data
Options

8. Network Aspects Internal network (e.g. LAN)
External Network (e.g. Internet)
Threats from the External Network to the Internal Network

9. Network Threats N e t w o r k B a c k b o n e
Router
To Internet
Outside dangers can come in from here
Inside information can leak out from here
Corporate network

10. Firewall Special type of router
Controls transmission between internal and external networks
Decides what to allow/disallow

11. NAT Implementation Internal network with internal IP addresses

Internet
Router’s internal IP address
Router’s external IP address
NAT router

12. Internal network with internal IP addresses
NAT Example
Internal network with internal IP addresses
Internet
NAT router
Source:
Source:
Destination:
Destination:

13. NAT Translation Table Source: 192.168.10.1 Destination: 210.10.20.20
Source:
Destination:
Destination:
Internal …
External
Translation table

14. Firewall Concept N e t w o r k B a c k b o n e To Internet Firewall
Corporate network
Firewall

15. Firewall Types
Firewalls
Packet Filters
Application Gateways

16. Internal (Private) Network
Packet Filter
Internet
Internal (Private) Network
Packet filter
Protected zone

17. Packet Filter Operation
Outgoing packets
Incoming packets
Receive each packet.
Apply rules.
If no rules, apply default rules.

18. Packet Filter Defeating IP Spoofing Attack
Incoming packet

Internal network and the IP addresses of the hosts
Packet filter
Source address:
STOP!

19. Application Gateway Inside connection Outside connection
HTTP
SMTP
FTP
TELNET
Outside connection
Inside connection
Application gateway

20. Circuit Gateway Source address = 178.29.10.90
HTTP
SMTP
FTP
TELNET
Application gateway
IP address =
IP address =
Source address =
Source address =
IP packet
Inside host
Outside host

21. Application Gateway - Illusion
HTTP
SMTP
FTP
TELNET
External host
Internal host
Application gateway
User’s illusion
Real connection

22. Firewall Configurations
Screened host firewall,
Single-homed bastion
Dual-homed bastion
Screened subnet firewall

23. Screened Host Firewall, Single-homed Bastion

Packet filter
HTTP
SMTP
FTP
TELNET
Internet
Application gateway
Internal network

24. Screened Host Firewall, Dual-homed Bastion

Packet filter
HTTP
SMTP
FTP
TELNET
Internet
Application gateway
Internal network

25. Screened Subnet Firewall

Packet filter
HTTP
SMTP
FTP
TELNET
Internet
Application gateway
Internal network

26. Demilitarized Zone (DMZ)

Internet
Internal private network
Demilitarized Zone (DMZ)
Firewall

27. Security at multiple Layers
Application Layer
Transport Layer
Internet Layer
Data Link Layer
Physical Layer
First level of security
Second level of security

28. IPSec Not concerned with application layer security
Applies security at the Internet layer
More effective in IPv6

29. IPSec Processing Result
Actual data (Encrypted)
Transport header (Encrypted)
Internet header
(Not encrypted)

30. IPSec in TCP/IP Sender Receiver Original message Application Transport
Transmission medium
Application
Transport
IPSec
Internet
Data link
Sender
Receiver

31. Authentication Header (AH) Encapsulating Security Payload (ESP)
IPSec Protocols
IPSec
Authentication Header (AH)
Encapsulating Security Payload (ESP)

32. AH and ESP Operation Modes
AH and ESP modes of operation
Tunnel mode
Transport mode

33. Tunnel Mode X
 P1
Proxy P2 Y
Network 1
Network 2
Tunnel

34. Tunnel Mode Implementation
A <---> B
P1 <---> P2 …
Internal IP header and data (encrypted)
External IP header
(not encrypted)

35. IPSec steps Step 1 Algorithm and Key negotiations using IKE Step 2
Actual AH and ESP operations

36. Security Parameter Index (SPI) Authentication data (Variable size)
AH Format
Bit
Next header Payload length Reserved
Security Parameter Index (SPI)
Sequence number
Authentication data (Variable size)

37. Receiver’s Sliding Window
Receiver’s sliding window (W = 8)
N – W
Marked if a valid packet is received
Unmarked if a valid packet is not yet received N

38. AH Transport Mode IP header TCP header Original data
(a) Before applying AH
(b) After applying AH AH

39. AH Tunnel Mode IP header TCP header Original data
(a) Before applying AH
Original IP header
(b) After applying AH AH
New IP header

40. ESP Format Bit 0 16 24 31 Security Parameter Index (SPI)
Sequence Number
Padding (0-255 bytes)
Payload data (Variable size)
Padding length
Next header
Authentication data (Variable size)

41. (a) Before applying ESP
ESP Transport Mode
IP header
TCP header
Original data
(a) Before applying ESP
(b) After applying ESP
ESP header
Original IP header
ESP trailer
ESP auth
Encrypted
Authenticated

42. (a) Before applying ESP
ESP Tunnel Mode
IP header
TCP header
Original data
(a) Before applying ESP
(b) After applying ESP
ESP header
Original IP header
ESP trailer
ESP auth
Encrypted
Authenticated
New IP header

43. ISAKMP Header Format Bit 0 8 16 24 31 Initiator cookie
Responder cookie
Next payload
Major version
Minor version
Exchange type
Flags
Message ID
Length

44. Virtual Private Network (VPN)
Uses the Internet as if it is a private network
Far less expensive than a leased line
Uses IPSec protocol

45. VPN Between Two NetworksX

Network 1 Y
Network 2
Firewall 1
Firewall 2
VPN tunnel
Internet