Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPsec also includes protocols for establishing mutual authentication between agents at the beginning of the session ...

learn more… | top users | synonyms

3
votes
1answer
110 views

ip xfrm limit in iproute2 for ipsec

I am using ip xfrm state and ip xfrm policy commands from iproute2 tool to implement IPSec. I have read documentation of iproute2 (PDF) and ip-xfrm man page. The man page states: LIMIT-LIST := [ ...
1
vote
1answer
19 views

Can I use transport mode in IPsec if I tunnel via UDP?

Can I use tranport mode (instead of tunnel mode) in IPsec if I tunnel a VPN via UDP? I don't see why the header (that sets the protocol and port) needs to be encrypted in my case (I suspect it would ...
1
vote
0answers
36 views

Manual IPsec and session key(s)

I am evaluating IPsec. I have determined it is best for my case to not use AH (will use PSK for authentication). One issue I have is that at the start there will be no connectivity, so IKE will not ...
1
vote
0answers
31 views

Possibility of widespread deployment of IPsec

I want to know if IPsec is a candidate for a widespread deployment in the Internet. So far IPsec seems to be adopted merely in VPN networks. IPsec seems to have problems with NAT-traversal and another ...
0
votes
0answers
47 views

IPSEC GRE packets based on key value with IP xfrm command

am trying to selectively encrypt GRE packet based on Key value in header using IP xfrm command in linux. Following commands are used for key value 3 ip xfrm state add src $machine2 dst $my_ip proto ...
0
votes
1answer
83 views

What exactly does ipsec and ssl do? [duplicate]

Im trying to figure out how SSL and ipsec works. I know the process in both SSL and ipsec but why do I need SSL if I can use IPsec when it runs below the transport layer. Wont IPsec encrypt everything ...
1
vote
2answers
51 views

IPSEC - Remote Access Clients, Tunnel or Transport Mode?

I understand that transport mode encrypts only the payload. Do IPSec clients such as Cisco's AnyConnect and/or Cisco VPN Client use transport mode? Or do these clients and others like them use ...
0
votes
1answer
76 views

Why Use IPSEC AH vs ESP?

I am refreshing my understanding of IPSEC. IPSec is an IETF defined set of security services that use open standards to provide data confidentiality, integrity, and authentication between peers. ...
0
votes
0answers
74 views

What is the difference between AH and ESP for internet packets authentication and integrity?

What are the basic pros and cons when you have to choose between AH and ESP for authentication and security of IP packets? Why AH exists since the same functionality is provided by ESP for origin ...
4
votes
1answer
184 views

Difference between IPSEC SA and CHILD SA

Let us consider two network entities. Linux1 (eth0)=============IPSEC=============Linux2(eth0) 192.168.1.1 192.168.1.2 The IPSEC Tunnel is V4 ...
5
votes
2answers
346 views

IPsec on multicast

I am trying to implement IPSec for multicast communication, I tried strongSwan for setting up IPSec for unicast but it doesn't support any standard for multicast ipsec as listed here ...
3
votes
1answer
84 views

IPsec: Is AH in tunnel mode secure?

I have a site-to-site IPsec VPN which was performing poorly (10 -20% upload/download speeds as a percentage of available WAN circuit bandwidth) when using ESP in tunnel mode with DES encryption and ...
1
vote
0answers
62 views

How secure is L2TP+IPSEC?

I understand PPTP is widely used still, but insecure. A convenient alternative is: L2TP+IPSEC. How secure is it? What steps in the server setup can I take to maintain a high degree of compatibility ...
2
votes
1answer
62 views

open source IKE for Windows 7/8 [closed]

Is there an open source implementation of Internet Key Exchange protocol for windows? I found only openiked for linux platforms. (http://www.openiked.org/)
0
votes
1answer
84 views

What to choose ipsec or tlsv1 for rdp

I found a link but it didn't answered on my questions. (http://www.k2esec.com/secure-communications/network-security-protocols-ipsec-vs-tlsssl-vs-ssh-part-ii). I want to create secure connection for ...
2
votes
2answers
1k views

When do I use IPsec tunnel mode or transport mode?

I basically understand how tunnel mode and transport mode works, but I don't know when I should use one instead of another. Among the two parties who want to communicate, if one computer B doesn't ...
-2
votes
3answers
183 views

Basics - IP spoofing

I can't understand why IP spoofing (even basic) is very limited. Suppose Bob and Alice are about to communicate and Eve can see network communication, why eve can't use IP spoofing for making "Man ...
2
votes
1answer
105 views

How does IPsec turn KEYMAT into Encryption and Authentication Keys?

IPsec is a framework protocol that consists of the sub-protocols ESP and AH. IPsec, inately, doesn't include a Key Exchange mechanism, and is therefore dependent on manually setting Keys (archaic), ...
1
vote
2answers
185 views

ISAKMP and OSI layer

I'm trying to find out on which OSI layer the ISAKMP protocol resides on? It isn't listed under the wiki's list of network protocols, and the internet says it's either on the transport, network or ...
1
vote
0answers
45 views

Ipsec connection fails

I have two system with fedora12 installed Host1 IP address - 10.1.0.1 Host2 IP address - 10.1.0.2 Then configured IPsec in both machines as below Host 1 config (/etc/ipsec-tools.conf) #Host 1 ...
4
votes
1answer
1k views

which diffie-hellman group is needed for secure ike/ipsec

We're deploying ipsec on embedded devices and getting catastrophic performance from the diffie hellman 2048 group in ike.. afterwards the shared securet is used for 3des, sha1. ipsec negiation is ...
2
votes
1answer
294 views

Best Practice: frequency to change IPSec pre-shared key

Is there any Best Practice as far as changing IPSec pre-shared keys for security purposes? Obviously, larger companies would have a issue changing these and then pushing the new key out to the user ...
2
votes
1answer
155 views

how IPS and IPSec work together in a host

I want to know how they work together . for example , we implement IPSec tunnel between 2 routers and we establish Snort IPS on Router 1. when Router 1 get the packets , they're encrypted . Now which ...
0
votes
2answers
218 views

Finding the IP address origin of malware attacker behind VPN and proxies

I have a client that wants me to begin doing research on finding the origin of a persistent attacker to their network and employees. I haven't gotten the specifics yet, but I'm trying to think of ways ...
8
votes
1answer
282 views

Maximum number of nodes with IPSec?

From my understanding, for incoming packets over IPSec, the Security Association (SA) is identified by the SPI field of the ESP header. Then let's say I have a bunch of nodes where each node wants to ...
2
votes
1answer
106 views

Does mixing different types of encryption make the connection more secure?

Like when I browse a website using SSL from my laptop that is connected to my router using WPA2. My router talks to my ISP using IPSec. Is that more secure or these types of encryption have nothing ...
2
votes
1answer
134 views

Are all TCP connection protected by IPsec?

I hope this question fits this stackexchange: From what I understand, IPSec takes care of encrypting everything above the IP layer (transport, application). Does that mean that if I open a socket ...
4
votes
5answers
5k views

Are there any reasons for using SSL over IPSec?

is it recommended to use both protocols together? In which situation?
0
votes
2answers
412 views

Given an IP address can you ssh into /tmp without password?

I'm a Software Engineer, but I have no experience in security, so i'm trying to learn by doing (woot Experiential learning!). I know that the permission settings on the tmp folder are very relaxed. ...
1
vote
1answer
238 views

Practical way to communicate a pre-shared key?

Company A needs to set up an IPsec VPN with company B, where each side will configure its own devices. Is there a recommended practical and quick way to communicate a pre-shared key from A to B? I ...
0
votes
1answer
152 views

IPSec Protocol Sequence Number

On IPSec protocol, how can denial of service (DoS) be prevented or its effect be minimized? For example, assume an attacker intercepts a packet and changes its sequence number to a bogus one (say 10 ...
2
votes
1answer
123 views

IKEv2: Why is it important “that each side sign the other side's nonce”

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that ...
1
vote
1answer
3k views

Understanding the details of SPI in IKE and IPsec

I'm currently learning IKE and IPsec for an exam. I have a lot of information on how Security Parameter Indexes (SPI) are used in both protocols, but I'm having some problems figuring out the ...
3
votes
0answers
186 views

Does using NAT-T for L2TP / IPsec VPN pose a realistic security risk?

I'm working on upgrading an old Windows RAS server that hosts PPTP VPN. I want to move to a L2TP/IPsec VPN. Due to the firewall appliance we use, the VPN server has to be behind a NAT. This means ...
2
votes
2answers
127 views

is IPSEC Authentication between local domain hosts a part of normal behaviour in a Windows network?

I am seeing lot of IPSEC Authentication messages in eventlogs of Windows domain hosts. I was wondering if this - setting up IPSEC connections between domain workstations is a part of normal Windows ...
2
votes
1answer
312 views

PFS incentive during IKE Phase 2

I'm trying to see the actual point in implementing Perfect Forward Secrecy during Internet Key Exchange Phase 2, if it had already been used during Phase 1. Quoting the IKEv2 RFC: RFC 5596 ...
2
votes
1answer
270 views

IPSec sequence number

I was going through a study of IPsec and I found that there are redundant sequence numbers: one in the AH or ESP header, and the other is in the TCP header for a communication. Is it not an ...
1
vote
1answer
489 views

How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?

In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
1
vote
1answer
66 views

Is it possible to use AH in transport mode on an IPSec channel with mediation?

I understand that it's not possible to have Autentication Header with a regular NAT, because it messes with the IP header protected by AH. How about proxies? Do they change anything in the packet? ...
1
vote
1answer
149 views

IPSec optional advanced questions [homework] AH/ESP and Tunnel/Transport modes

I have 2 questions regarding IPSec. This is the last 2 optional questions of my homework: Scenario when combining AH and ESP can be needed? Scenario when combining Tunnel and Transport modes can be ...
2
votes
2answers
420 views

Skype Audio / Video Session over VPN?

Basically I'm wondering if a Skype video session along with audio could be logged (or recorded) over a virtual private network? I know whoever hosts the VPN server can log which websites you visit (or ...
1
vote
2answers
299 views

Is QuickVPN Secure

Does QuickVPN create a secure tunnel or how does it work to provide encryption and security? When I did a see my IP it was using the remote locations IP and not my office network's IP so does that ...
0
votes
1answer
428 views

NAT traversal for IPsec AH protocol

Wherever I looked I only saw the description of NAT traversal for ESP protocol (for example: http://pic.dhe.ibm.com/infocenter/iseries/v6r1m0/index.jsp?topic=/rzaja/rzajaudpencap.htm) It's looks that ...
1
vote
1answer
921 views

How does IPSec protect against IP spoofing?

IPsec is a security mechanism that provides peer-entity authentication, data-origin authentication, data integrity, and optionally data confidentiality. It relies on extensions to the standard IP ...
2
votes
2answers
2k views

How to detect NAT - network address translation?

How to detect if NAT is used in network or not ? I know if you have private address and you are able to connect public network or internet then there must be NAT. But How can I detect that NAT is ...
0
votes
1answer
222 views

how can I secure my static ip router?

hi I have a static ip and someone is hacking my computer trought it I tried to format my computer and making a clean install but he keeps penetrating it this time i tried to install the AV before ...
1
vote
1answer
137 views

Using secp256k1 and ECDSA with IKE

I just tried using an IKE daemon and EC certificates. I used the secp256k1 curve for key generation. The daemon claims signature scheme ECDSA-256 not supported by private key Now I am wondering ...
6
votes
2answers
3k views

What is the difference between SSH and IPsec?

There seems to be similar encryption going into both. They both use asymmetric (RSA, elliptic curves, etc) for the initial key exchange, then go to some symmetric (AES, Blowfish, etc) protocol. I'm ...
7
votes
2answers
6k views

Which is better for server-to-server-communication: IPSec or TLS?

Maybe you could help me with a small problem. Would you recommend IPSec or TLS for a Server-to-Server-Connection? I need two or three arguments for reasoning a decision within my final paper, but ...
1
vote
1answer
445 views

Is it necessary to use PEAP for L2TP/IPsec?

This is a sister question of Is EAP-MSCHAP v2 secure?. Based on my understanding, IPsec should have authenticated the server (we're using PKI) and secured the rest of the protocols before the user ...