TechKnowSurge
Cisco CCNA 5.5 Cisco CCNA 2.6
VideoNetworkFree

Tunneling

Network tunneling encapsulates packets within an additional Layer 3 header so traffic can traverse networks that would otherwise block or expose it. Common use cases include routing protocols across ISP infrastructure and securing wireless guest traffic through encrypted tunnels to a wireless LAN controller.

Complete this video to capture a CTF flag worth 1 point.

About this video

Network tunneling is a method of transporting packets across a network by encapsulating them within an additional Layer 3 header. The outer header carries its own source and destination IP addresses corresponding to the tunnel's entry and exit points, and routers along the path make forwarding decisions based solely on that outer header while the original packet travels invisibly inside. When the encapsulated packet reaches the tunnel endpoint, the outer header is removed and the original packet is forwarded according to its own addressing, just as it would be in standard IP routing. The TTL in the outer header decrements at each hop to prevent routing loops, operating independently from the TTL of the inner packet. Tunneling addresses several practical networking challenges. One common scenario involves running OSPF between two routers separated by an ISP network or another transit infrastructure that an organization does not control and does not want participating in its routing process. By establishing a tunnel between the two edge routers, OSPF hellos and other routing traffic are encapsulated and carried transparently across the intermediate network. Another example is wireless guest traffic, where packets from client devices are encrypted and tunneled from access points back to a wireless LAN controller, keeping untrusted guest traffic off the internal network and delivering it directly to a segmented or public-facing connection. These scenarios illustrate the flexibility tunneling provides in both connectivity and security contexts.

What you'll learn

What's covered

Network Tunneling

Aligned to

Cisco CCNA
5.5 Describe IPsec remote access and site-to-site VPNs
2.6 Describe Cisco Wireless Architectures and AP modes

Key terms

Encapsulation
The process of wrapping data with protocol headers as it passes down the layers of the OSI model.
Packet
A unit of data formatted for transmission over a network, containing a header, payload, and sometimes a trailer.
Layer 3
The Network layer of the OSI model, responsible for logical addressing and routing packets between networks.
Payload
The actual data content of a packet or message, excluding headers and metadata.
Routing Protocol
A protocol used by routers to communicate and share routing information to determine the best path for data.
Virtual Private Network
VPN
A technology that creates a secure, encrypted tunnel over a public network to protect data in transit.
Time to Live
TTL
A value in a packet that limits its lifespan on a network, preventing it from circulating indefinitely.
Tunneling
A transition mechanism that encapsulates IPv6 packets within IPv4 headers (or vice versa) to carry traffic across a network that uses a different IP version.
Wireless LAN Controller
WLC
A network device that provides centralized management of multiple lightweight wireless access points, handling functions such as client authentication, roaming, radio frequency management, and security policy enforcement. WLCs communicate with APs using CAPWAP and allow network-wide wireless configuration from a single management point.

Transcript

What tunneling is

Tunneling is just getting traffic from one location to another, but by encapsulating it with some sort of other header so that way this information can be routed. We might do this for several different reasons, one of which might be that the information normally wouldn't be passed across the network, and so we encapsulate it to send it over to the other location. Or perhaps this is an insecure network and we want to secure our communication, so we use some sort of VPN in order to secure that communication.

Regular IP routing

Let's take a look at regular IP routing. Here we have a packet. The packet has some sort of payload to it, some sort of information that it's carrying, as well as the layer three header. Within the layer three header we have a source and destination IP address, so that way when a router receives that packet it can take a look at the destination IP address and figure out where it needs to send it next, the next hop, and then that router sends it to the next hop along its way.

Meanwhile, what's happening in this layer three header is the time to live is decrementing. That time to live prevents any kind of routing loops or problems. If there is a routing loop, then that gets decremented to know when to discard this packet.

What a tunnel looks like

Here's what we just talked about with the IP header, with the layer three header — we're just going to represent this as a pipe going across here. Now, what does a tunnel look like? A tunnel is where we're going to add an extra layer three header. When it comes into wherever the tunnel is going to start, then this gets added to it, with its own time to live and its own source and destination IP address, and that's going to be of where the tunnel is going to end.

So what will happen is now every hop along the way is going to take a look at this layer three header along the way, and it's going to ignore this packet right here. The time to live here gets decremented, and it looks at this source and destination IP address to do all of its routing. Once it gets to its final destination, it's going to remove that and then treat this as just a regular packet for the rest of the route.

Let's take a look at a little different example of what tunneling looks like. Let's say we have a letter that we want to deliver — that's the payload right here. We're going to put it inside an envelope which has addressing on it; that's this layer three header right here. But let's say we want to traverse across some other network here. What we can do is encapsulate it, or add it to another envelope with its own source and destination IP address that's going to be addressed to the end of the tunnel. Then what will happen is it'll use that information of the second envelope to route it along its way. Once it gets to the end of the tunnel, it will get rid of that extra envelope and then deliver the rest of the letter wherever it's supposed to go, using the source and destination IP address of that second, or the original, layer 3 header.

Example: OSPF across a provider network

Let's take a look at an example of where we might use tunneling. An example might be if we were using OSPF and we had it running on router 1 and router 3, but perhaps we don't have control over router 2, nor do we want it really to participate in our OSPF process here. Perhaps the reason why is because maybe it's owned by the internet service provider, or perhaps it's a whole network of routers — maybe this is representing a whole network of routers.

What we want to do is still run OSPF on router 1 and router 3 and any other routers we have for our whole corporate network, however we need to interconnect these two. Well, this is going to be a problem: that OSPF, if it can't talk to this in-between router and transfer the data between router 1 and router 3, that's going to be problematic.

So in this case right here we would want to set up a tunnel. We would set up a tunnel from this router over to this router, and then the OSPF communication is going to get encapsulated with this extra layer three header, sent across the ISP's network, and make it to router 3. Router 3 is the end of the tunnel, and so then it will take that extra layer off of it and then it will process those OSPF hello timers or whatever communication is going across this network.

Example: wireless LAN controller and access points

Another example might be a wireless LAN controller and access points. There's a tunnel that happens between an access point and this wireless LAN controller. Let's say we have a guest network, and this laptop is part of the guest network and is accessing it through this wireless access point. You wouldn't want to dump that traffic on your regular network right here, because that would be insecure. So what happens is that traffic gets encrypted and tunneled back to the wireless LAN controller, and maybe that wireless LAN controller has a direct connection to the internet, or some sort of firewall, or whatever the case, however we have it set up. But it lands this client to the public network without ever compromising anything internally.

So this is an example of where we might want to tunnel our traffic. There are lots of examples that we can use with tunneling.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →