‫Hi and welcome.
‫In this section we will talk about secret extensible network deployment and this sixth sense contains
‫the following topic.
‫The security control plane operation secured control plane deployment secured data plane operation the
‫cloud deployment and redundancy
‫in this video.
‫We will talk about secure control plane operations
‫okay.
‫So let's talk how the keys and the certificate exchange during the delay device put up in this diagram
‫you can see in this diagram float that the V I have created it here you can see how the devices extends
‫the certificate during the build up process.
‫So let's start from the Be smart.
‫So when the V smart device boots up when you click on the power button here when device boots up the
‫software generates the public and private keys the administrator installed those sign the certificate
‫that Mr. install the serial file number.
‫So basically this serial number file is nothing it is the file the Justice number and the serial number
‫of devices which is going to join the overlay.
‫And by using these serial file number the B smart controller authenticate devices and under v bond as
‫well acquire new power on the V born device after boot up the software generates the public and the
‫private key that administered installed a signed certificate administrator installed a CDL file serial
‫number file which is again the this j system but and the serial number of devices with which will be
‫joining the overly and the next is beeped club VHF device and the hardware device when you pass on this
‫device this device has inbuilt TPM chip which contains the public and private keys and the certificate
‫this keys is invalid to the VHA devices during the manufacturing of these devices and these private
‫keys the public keys and the certificate can not be exported outside of the hardware it can only be
‫bond it cannot export ah it cannot be tampered and the hardware
‫so let's see how the the keys are exchanged and how the devices authenticate each other so in the first
‫do any good in this floor you can see the beast smart and the smart and V bond saves the certificate
‫the exchange the certificate with each other and get that indicated
‫here you can see the V H will send down bill extends the certificate and the keys and the vice versa
‫the rebound will say today exchange a certificate
‫then the rebound will validate the serial number against the number of games the serial number file
‫hard to rebound holds
‫and then it high it will send it the address of the B smart to the village devices it will form the
‫details connection that temporary detail its connection and then it will send the address of the B smart
‫once the VHA has the address of B smart the details the V smart will exchange the certificate and the
‫keys with the these smart said well then V smart will validate the serial number of the VH against the
‫serial number file of what it holds and once it is matched it authenticate the these devices and a permanent
‫deal that details are DLC connections established between the these smart and the VS so you will have
‫a temporary detail this connection with the V bond the VHA will have the temporary detail this connection
‫with the V bond but the permanent details connection with the V smart
‫so this is how the keys and certificates are exchanged during the device put up and how they are authenticate
‫each other in the teller fabric
‫okay.
‫So let's talk about the virtual fabric bring up the G2 trust model so as we have seen in the previous
‫videos the placement of the devices and how they attend to each other.
‫So in the zero trust models what happens you don't you do not need to do any configuration changes on
‫the VH you just need to plug into each device with that van transport circuit on interface which has
‫a DCP enabled so the VHF will get the IP from the DCP and then it will directly reach out to the V bond
‫we will talk about the GDP gyro test provisioning later videos but this is just zero trust the model
‫that I will give you the explanation.
‫So the V.A. wants it it has IP and it knows to be born the IP of that organization the V age will reach
‫out to the V bond and it will present the certificates and the serial number the V bond will authenticate
‫the V age device
‫against though serial number file of what it holds.
‫And once that is authenticated v bond will sear the these smart no be smart details the address and
‫then V as a device will talk to the V smart and it will get authenticated using the same method the
‫certificate and the serial number once v smart will authenticate the VH V is will have a connection
‫V is will try to form the connection and get authenticated with V manage and then V manage will post
‫a contribution to the V age devices and the is will join the overly automatically without Eurotrash
‫demand.
‫So this is a gyro to model.
‫You don't need to do anything that devices will get authenticated with digital testimonial.
‫Here you can see the ways for the of smart controller.
‫Also talks to V1 and get that authenticated so the v Board has the information after the smart controller
‫in that overlay.
‫And these are the information which v bond provide to the viewers devices during during the gyro test
‫provisioning
‫so this V bond is to be on the public deciding patients who can see in this diagram it mentioned as
‫in the AMG because the devices has to reach out to the V bond to authenticate and in order to join the
‫overly
‫OK.
‫So let the stockholders as and controllers authenticate each other.
‫In the overlay so you can see in this diagram you have a v bond here you have a v smart here you have
‫a v manage here.
‫So all three controllers out here and as we discussed the level of security which SD Van overlay provides
‫that any devices.
‫Does not matter it is a controller does not matter it is v age device.
‫If that device needs to join to overlay that device has to be authenticated by each other.
‫It will never join the overlay until that device is authenticated and that authentication happens by
‫the certificate by the file.
‫The public and private keys and the file and the serial number and Genesis number what it is it is available
‫in the allowed list.
‫So let's talk here.
‫So you can see though the certificates are the exchange between the V1 and the smart controller.
‫It will always via directional the be smart will say to the certificate to v born v vulnerability to
‫the certificate to the these smart because both devices need to authenticate each other.
‫It has to be bi directional to their indication.
‫It can never be one way if any time it happens that in either one way either until are doing any of
‫the process that continues and fails it will tear down the details.
‫Audit the Ellis connection so it is like a V smart will say the certificate with V bond and it will
‫say to the certificate with the V manage in the wise words of V manageable share with the VS Mark and
‫with the V Bon Vivant will serve it the V smart the controller and the v manage and then board certified
‫both all three devices Bill authenticate each other.
‫So v bond the setting here the V bond device here it authenticate the V smart and V manage certificate
‫and a serial number.
‫Against authorized allowed list so basically v bond has outraged a list of devices which is going to
‫join the overlay and once these devices say that the certificate it validate the certificate and the
‫serial number of device to authenticate it the V smart controller and the v Manish these two devices
‫authenticate the V bond by the organization name.
‫So basically the organization name is locally configured on these two devices during the boot up process
‫to configure the you give the organization name and also the V bonus say the death certificate to extract
‫the organization name from the certificate and authenticate the device.
‫If there is any mismatch in the organization name it will clear down the details connection.
‫That application will be filled and once if it is authenticated all the devices authenticate each other
‫it permanently details less secure connection will be established with the controllers
‫Okay let's see in the little more details hold the authentication happened between the V bond orchestrator
‫and the v smart controller.
‫So in this diagram you can see that you have a v smart controller and you have a v bond.
‫And as we were discussing it is always a two way indication.
‫It is not a one way it is to that indication.
‫We have bought two big authentication of the diagram and the flowchart available here.
‫This is one way and this is to be.
‫So let's talk how the things happen.
‫So in the initial that we want send that trusted group C assign a certificate which is installed on
‫the V1 and a VHF tries to see deal number file.
‫So basically we go on will say that V H authorized serial number files to the V smart v smart will verify
‫the organization name it will extract organization name from the certificate it will verify it out of
‫magician name if organization name matches then it will verify that particular certificate is signed
‫by a group C or not if it is signed by rootsy see if one B SSL authentication is completed so one way
‫communication is authenticated.
‫Now the V smart will sear that trusted group certificate.
‫Now the VE smart will say to the trusted group C assign a certificate to the V bond V will verify the
‫serial number again to which it is applied file number what we want holds it will verify the organization
‫name then it will verify whether the certificate is signed vital C are not if any of these three fails
‫it will clear down the details connection and if it all three matches it will form the permanent details
‫connection with the V smart and now the two we as a select indication is complete and this channel is
‫fully secure.
‫OK now let's talk how the V smart controller's authentication happened between each other like Colby
‫smart controllers authenticate each other so as the V smart controller needs to be authenticated by
‫the V bond the be smart controllers also need to authenticated by other v smart controllers which is
‫available in the overly so let's see what you have to be smart controllers here.
‫The smart one and the v smart to the smart one will take that trusted group CSI and the certificate
‫the V smart too will verify the serial number the organization name and it will verify whether that
‫certificate is signed by rootsy or not.
‫If all three matches the one v SSL authentication is complete and one with details connection will be
‫done.
‫In another way the V smart will then send out that trusted to see a signed certificate to the smart
‫one.
‫Now the smart one will validate the serial number.
‫It will verify the organization name it will verify whether the certificate which is certifiably smart
‫is validated by the looks we are not signed by the rootsy or not.
‫Once all three matches it will form permanent details connection with the VS Mark and then to the SS
‫electron application is complete and if any of these is not matching.
‫If there is any mismatch the connection will be teardown.
‫It will never come up.
‫OK and now let's talk how the V bond and the v is authenticate each other.
‫OK so if you can see in this floor you have a v bond here so that you have a V is it out there here
‫and you have a v bond here.
‫And for two weeks of the communication you have a V is here again and you have a v bond so this is the
‫same device it is not a different device but the I have a put it in such a manner as we know it is always
‫to the authentication right.
‫So the process is a little bit like the done one device will attend to one then that will authenticate
‫to other OK so let's talk about it the V1 will 0 0 the certificate with the serial number
‫do the V age the age will verify verified organization name from the in block from the local configuration
‫that is done under the age it will verify that certificate is signed away it will see if the organization
‫name and the certificate is signed away it would say here is matches it will form a one way detail connection
‫with the V bond and one v SSL authentication is done
‫now here then once that one v authentication is done the V bond will challenge with VH with the 256
‫with n random number that is signed by the public key the private key of a V bond and then V ball VH
‫will share these details.
‫The VH will respond with the serial number.
‫The chair says no.
‫The plastic board I.D. certificate which is installed on the TPM chip and 256 bit design available with
‫the private key the private key which is folded under TPM chip once the reborn will receive all this
‫information.
‫It will verify the serial number because it has authorized a list of these devices which is going to
‫join then it will verify that 256 with random value it will validate that certificate is signed away
‫plasterboard Heidi Soviet v born no.
‫The list of plastic board I.D. which can sign the certificate on the TPM chip which is installed on
‫the TPM chip.
‫If all three matches it will form that temporary detail connection with the age and two races all authentication
‫is complete.
‫When we set temporary the details connection between V H to V born this temporary because it is just
‫neat.
‫The V bond of the V is need a first point of authentication from the V bond and a list of 4 v smart
‫and V managed devices.
‫So once this is done the V bond will say to the list out for v smart and V managed devices in the overly
‫and this connection will be there down
‫OK let us stock go the V.A. set out the identity.
‫I mean how the visa holders of identity they have.
‫So you have to you have a visa which is a hardware device you have a V V is Cloud which is a software
‫device on the cloud either on the VM so you can say this is a TPM chip which we were talking about.
‫It is inbuilt during the manufacturing of the device.
‫It has the public key.
‫It has a private key.
‫It has a device certificate and that is signed by the state board I.D. like you can see Avnet
‫and then you have a similar semantic route in certificate that is in software that is needed when to
‫authenticate the controllers on the overly v vs need to validate the certificate sere divide the controllers
‫whether that certificate is signed by the group C or not.
‫On the virtual vs devices as you know it is the virtual device it does not have any serial number or
‫this number it is a software so that is a sign of either of you manage to basically though when you
‫the boot up config you generated from the we manage it gives you two things.
‫One is you IP which is universally unique IP and another thing is a token IP and this divide both you
‫IP and the token idea that is used to activate this VH router.
‫We will see how that happens in the later slide and video during the VHS deployment.
‫But this is how the VHS VH cloud router gets identity that is signed by V Manish and then it is it is
‫activated and installed under the s cloud and then you have a route Gen certificate and by using the
‫ID certificate to authenticate the controllers.
‫OK let's talk how the authentication between the VH and the v manage and the VS smart so previously
‫we saw how that complication happened with the V bond and the V8.
‫Now the two more controllers we have initiative n which is we manage and be smart and how they can learn
‫that indication happened.
‫So that certificates are exchanged for mutual authentication though these smart will say that the certificate
‫the V age will say the certificate serial number then the age will set to with a V Manish and the v
‫manageable share with the V age.
‫So like a mutual certificate if scenes happen so you can see the certificate and with the public is
‫exchanged between each other.
‫To initiate the V is does not have the information for V manage and be smart but once it is authenticated
‫by the V bond and then V volunteers these V manage and be smart details and then this particular process
‫happened which starts.
‫So V smart.
‫Once the certificate that exchange the V smart controller and the man manager validated the VH serial
‫number and the chess number which is installed on the we manage and the smart so basically V smart and
‫V Man as have the serial number and the chess society the valid the serial number and chess society.
‫For the viewers devices which are good which is going to join the overlay and their ten decade of age
‫against that particular allowed list once that that authentication is done.
‫The V age is out or validated a V smart and a V manage cert organization name.
‫So basically the ones with the certificate is here it be extracted organization name and it will match
‫with the locally configured organization name ones that configure your organization name matches.
‫It will form a permanent Beatles connection with the be smart and manage but if any of those is not
‫matching it will be aired on the connection so you can see how much organization name is critical in
‫the authentication process.
‫So we need to ensure when we are configuring the organization name on the devices that has to be accurate
‫and exactly same even these spaces and it is a case sensitive to so that it has to be exact what it
‫will on all the devices and because those spaces are not allowed.
‫When you configuring the organization name ensure you are configuring in the double quotes in the brackets.
‫So we will see how will configuring in the later slide
‫and then let's see the detail the work will detail the flow how the authentication happened between
‫the V is outer and the v manage the network management system so you can see you have a v edge here
‫you have a v manager in the first line the V manage will sear the certificate with the seat number
‫the V manager will verify the organization name by extracting it from the certificate it will validate
‫verify that certificate is signed by routes you
‫and they do both of them matches it will form one with DTA less connection and if any of them failed
‫it will tear down the connection
‫in the next process.
‫The the manager will challenge with 256 of its random value similar to the V bond that it does in the
‫previous slide.
‫Then V is value at this point with the serial number Jazz's number the trusted board I.D. certificate
‫the TPM chip which is installed there under the age router in built there and a 256 bit signed value
‫with the private key ones to V manage it receive all these information it will verify that the particular
‫certificate is signed by that trusted board i.e. Ah it is signed of either my signed a certificate.
‫So as you know you have to live with type of devices right.
‫One is the Ace Hardware one is of the S cloud so that is the reason it validates whether it is V is
‫cloud that is signed divider v manage either it is or is it either it is hardware device with which
‫which is signed by that trusted board I.D. certificate then it will verify that 256 with random value
‫it is signed by the private key r for VH It will it is it is like it will decrypt here using the public
‫key of VH and it will verify the value then it will verify that certificates it is signed by that trusted
‫board Idi J and once all three matches it will form the permanent details connection with the age and
‫the two V SSL authentication is complete
‫now let stockholder authentication between the V smart controller and the v is about what happened so
‫you have a V device here and you have a v smart controller here so in the first process the B smart
‫will challenge with the two flips 256 with referendum value no similar v manage and V bonded and that
‫will be signed by the private key of the we manage the viewers will respond with the serial number the
‫chest this number the trusted boat I.D. certificate and 250 256 bit sign value with the private key
‫to basically it will be encrypted and then it will find value with the private key of the VH 1 stuff.
‫Be this smart received all these information it will verify the serial number against the allowed list
‫what V smart is having it will verify that 256 with random value it will verify that certificates signed
‫by trusted by writing if all three matches the one with details connects and is completed the no devices
‫and devices having one really DNS connection in the next point no the be smart will send the route C
‫assign a certificate to VH We will validate the organization name and the serial number it will verify
‫the certificate is signed it looks here and if all those all these two matches the permanent details
‫connection will be formed between the VH and the v smart controller and now the two V SSL authentication
‫is complete
‫OK let's talk about the control connection ports.
‫So basically there are five based but there are five ports that is used in the control connection so
‫you can see that you can see here that before the waistcoat is one two three four six which is right
‫here I need to has a port off set of 0 and you can configure a static offset from the standard port
‫like plus plus 20 to minus 20.
‫And we also you how this works.
‫So and this helps in increments from a standard port to first let the Nat travel itself.
‫It helps when your device is behind it that device.
‫Right.
‫So how will it authenticate the first.
‫It will try to authenticate on the base port which is one two three four six.
‫If there is no response it will add 20 to the base port.
‫And now the base port has become one two three six six like one two three four six plus 20 which is
‫no.
‫1 2 3 6 6.
‫And it will try to communicate with the device onboard.
‫1 2 3 6 6.
‫If that there is no response it will add it on again and it will try to connect on 1 2 3 8 6 and so
‫on.
‫So it will keep adding 20.
‫And then once it reaches 1 2 4 to 6 if we want it there is no response here.
‫It will roll back again to the 1 2 3 46 so that is plus 20.
‫Banished Dundee
‫4 did indeed force protection how the V V is allowed to protect.
‫Again the details attack so you can see the visa holders have a three connection.
‫One is details dealer's connection with the V Mark not only be smart with the V smart controller the
‫bond and the v manage
‫and it has the IP sectional with the remote VHS devices which is your data plane
‫and they need it has a connection with the Internet so in the DNS connection default it denies everything
‫allows when these specific IP board provided via B bond so it will only allow a specific IP and the
‫port which is allowed provided vital V1 during that indication like it provide do the V smart and the
‫v manage leashed so only those eyepiece and ports are allowed under the DNS connection in the IP sic
‫the deposit is denial allow a specific Piers provided by V smart so it is like once that Beatles connection
‫is done with the V smart the be smart exchange the control plane information between the VH outers so
‫control plane information also includes the encryption keys and the key lock information from the other
‫V.A. devices so this the is remote device only allows this specific period piece that locks that is
‫provided by the V smart
‫from the Internet I would like from other interfaces it is like default it is denied all will lead the
‫ABI they polled only few protocols which is allowed that is ICMP DNS and the DCP because that is needed
‫on the VPN zero transport interface to do so that it can receive the IP from DCP from the van interface
‫on and that is it that is actually needed for the G2 does provisioning right you can manually allow
‫the SSL and NPP on that interface so other than other than that if any communication comes on these
‫interfaces that will be denied that is purely blocked and this is how the V is wrong to protect against
‫Toledo's attack
‫and that's end of this lecture thanks for watching.