0:00–0:15
Command Reference
0:15–1:00
IPSec & PKI Walk-through
1:00–1:40
WireGuard Walk-through
1:40–2:00
Open Lab / Q&A
0:00 – 0:15Command Reference · 15 min
Quick-fire command reference — Week 5
Only one week to cover today, so more time goes to the walk-throughs. Week 5 was the technical peak of the course — expect this section to run a little long, and that's fine.
- IPSec:
sudo ipsec status · sudo ipsec statusall · sudo grep charon /var/log/syslog | tail -20
- PKI:
sudo ipsec pki --print --in cert.pem · verifying a certificate chain against the root CA
- WireGuard:
sudo wg show · sudo wg-quick up wg0 · sudo wg-quick down wg0
0:15 – 1:00IPSec & PKI Walk-through · 45 min
Reading ipsec status output and tracing a certificate chain
- ipsec status interpretation drill: Put sample output on the board showing an ESTABLISHED SA. Ask students to identify the local and remote endpoints, the negotiated encryption algorithm, and whether the SA is using PSK or certificate-based authentication.
- PSK-to-cert migration recap: Walk back through why the course moved from a pre-shared key to certificate-based auth — a PSK is one shared secret every peer must know, while a CA lets each peer hold its own identity, independently issued and independently revocable.
- Scenario: "The tunnel won't come up and charon's log mentions a certificate verification failure." Walk through checking: does the peer's certificate chain back to the same root CA both sides trust, has the certificate expired, and does the certificate's subject match what ipsec.conf expects for that connection (leftid/rightid).
1:00 – 1:40WireGuard Walk-through · 40 min
Bringing up a tunnel from a blank config, and the IPSec/WireGuard comparison
- Live build: On the projector, generate a fresh WireGuard key pair, write a minimal [Interface]/[Peer] config from memory, and bring the interface up. Narrate every field — Address, PrivateKey, ListenPort in [Interface]; PublicKey, AllowedIPs, Endpoint in [Peer].
- AllowedIPs double duty: Reinforce that AllowedIPs serves two purposes at once — it's both a routing directive (what traffic goes through this peer) and a firewall filter (what source addresses are accepted from this peer). This trips up almost every student at least once.
- Comparison discussion: Ask students to contrast IPSec and WireGuard directly — config complexity, negotiation overhead (IKE phases vs. WireGuard's simpler handshake), and where each is a better operational fit. There's no single right answer; the goal is showing they understand the trade-offs, not memorising a verdict.
1:40 – 2:00Open Lab / Q&A · 20 min
Students catch up on any outstanding Lab 9 work
Circulate and help with anything from the StrongSwan PSK tunnel, the certificate migration, or the WireGuard setup that isn't finished. If everyone is caught up, open the floor to PKI and VPN questions.
Instructor note: Week 5 is the week students are least confident about heading into the exam. Prioritise the WireGuard live build if time runs short — it's the most exam-relevant skill (Task 6 on the practical) and the fastest to demonstrate cleanly.