Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPsec also includes protocols for establishing mutual authentication between agents at the beginning of the session ...

learn more… | top users | synonyms

2
votes
0answers
151 views

How secure is L2TP+IPSEC?

I understand PPTP is widely used still, but insecure. A convenient alternative is: L2TP+IPSEC. How secure is it? What steps in the server setup can I take to maintain a high degree of compatibility ...
2
votes
1answer
192 views

open source IKE for Windows 7/8 [closed]

Is there an open source implementation of Internet Key Exchange protocol for windows? I found only openiked for linux platforms. (http://www.openiked.org/)
0
votes
1answer
135 views

What to choose ipsec or tlsv1 for rdp

I found a link but it didn't answered on my questions. (http://www.k2esec.com/secure-communications/network-security-protocols-ipsec-vs-tlsssl-vs-ssh-part-ii). I want to create secure connection for ...
-3
votes
3answers
300 views

Basics - IP spoofing

I can't understand why IP spoofing (even basic) is very limited. Suppose Bob and Alice are about to communicate and Eve can see network communication, why eve can't use IP spoofing for making "Man ...
2
votes
1answer
197 views

How does IPsec turn KEYMAT into Encryption and Authentication Keys?

IPsec is a framework protocol that consists of the sub-protocols ESP and AH. IPsec, inately, doesn't include a Key Exchange mechanism, and is therefore dependent on manually setting Keys (archaic), ...
1
vote
2answers
417 views

ISAKMP and OSI layer

I'm trying to find out on which OSI layer the ISAKMP protocol resides on? It isn't listed under the wiki's list of network protocols, and the internet says it's either on the transport, network or ...
1
vote
0answers
56 views

Ipsec connection fails

I have two system with fedora12 installed Host1 IP address - 10.1.0.1 Host2 IP address - 10.1.0.2 Then configured IPsec in both machines as below Host 1 config (/etc/ipsec-tools.conf) #Host 1 ...
2
votes
1answer
730 views

Best Practice: frequency to change IPSec pre-shared key

Is there any Best Practice as far as changing IPSec pre-shared keys for security purposes? Obviously, larger companies would have a issue changing these and then pushing the new key out to the user ...
10
votes
4answers
6k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
1
vote
1answer
319 views

how IPS and IPSec work together in a host

I want to know how they work together . for example , we implement IPSec tunnel between 2 routers and we establish Snort IPS on Router 1. when Router 1 get the packets , they're encrypted . Now which ...
2
votes
1answer
174 views

IKEv2: Why is it important “that each side sign the other side's nonce”

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that ...
2
votes
1answer
186 views

Are all TCP connection protected by IPsec?

I hope this question fits this stackexchange: From what I understand, IPSec takes care of encrypting everything above the IP layer (transport, application). Does that mean that if I open a socket ...
0
votes
1answer
200 views

IPSec Protocol Sequence Number

On IPSec protocol, how can denial of service (DoS) be prevented or its effect be minimized? For example, assume an attacker intercepts a packet and changes its sequence number to a bogus one (say 10 ...
0
votes
2answers
494 views

Given an IP address can you ssh into /tmp without password?

I'm a Software Engineer, but I have no experience in security, so i'm trying to learn by doing (woot Experiential learning!). I know that the permission settings on the tmp folder are very relaxed. ...
1
vote
1answer
409 views

Practical way to communicate a pre-shared key?

Company A needs to set up an IPsec VPN with company B, where each side will configure its own devices. Is there a recommended practical and quick way to communicate a pre-shared key from A to B? I ...
2
votes
2answers
599 views

Skype Audio / Video Session over VPN?

Basically I'm wondering if a Skype video session along with audio could be logged (or recorded) over a virtual private network? I know whoever hosts the VPN server can log which websites you visit (or ...
1
vote
1answer
7k views

Understanding the details of SPI in IKE and IPsec

I'm currently learning IKE and IPsec for an exam. I have a lot of information on how Security Parameter Indexes (SPI) are used in both protocols, but I'm having some problems figuring out the ...
0
votes
1answer
259 views

how can I secure my static ip router?

hi I have a static ip and someone is hacking my computer trought it I tried to format my computer and making a clean install but he keeps penetrating it this time i tried to install the AV before ...
2
votes
1answer
498 views

PFS incentive during IKE Phase 2

I'm trying to see the actual point in implementing Perfect Forward Secrecy during Internet Key Exchange Phase 2, if it had already been used during Phase 1. Quoting the IKEv2 RFC: RFC 5596 ...
2
votes
1answer
363 views

IPSec sequence number

I was going through a study of IPsec and I found that there are redundant sequence numbers: one in the AH or ESP header, and the other is in the TCP header for a communication. Is it not an ...
2
votes
1answer
658 views

How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?

In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
1
vote
2answers
343 views

Is QuickVPN Secure

Does QuickVPN create a secure tunnel or how does it work to provide encryption and security? When I did a see my IP it was using the remote locations IP and not my office network's IP so does that ...
1
vote
1answer
668 views

Is it necessary to use PEAP for L2TP/IPsec?

This is a sister question of Is EAP-MSCHAP v2 secure?. Based on my understanding, IPsec should have authenticated the server (we're using PKI) and secured the rest of the protocols before the user ...
1
vote
1answer
85 views

Is it possible to use AH in transport mode on an IPSec channel with mediation?

I understand that it's not possible to have Autentication Header with a regular NAT, because it messes with the IP header protected by AH. How about proxies? Do they change anything in the packet? ...
1
vote
1answer
175 views

IPSec optional advanced questions [homework] AH/ESP and Tunnel/Transport modes

I have 2 questions regarding IPSec. This is the last 2 optional questions of my homework: Scenario when combining AH and ESP can be needed? Scenario when combining Tunnel and Transport modes can be ...
0
votes
1answer
661 views

NAT traversal for IPsec AH protocol

Wherever I looked I only saw the description of NAT traversal for ESP protocol (for example: http://pic.dhe.ibm.com/infocenter/iseries/v6r1m0/index.jsp?topic=/rzaja/rzajaudpencap.htm) It's looks that ...
1
vote
1answer
1k views

How does IPSec protect against IP spoofing?

IPsec is a security mechanism that provides peer-entity authentication, data-origin authentication, data integrity, and optionally data confidentiality. It relies on extensions to the standard IP ...
2
votes
2answers
4k views

How to detect NAT - network address translation?

How to detect if NAT is used in network or not ? I know if you have private address and you are able to connect public network or internet then there must be NAT. But How can I detect that NAT is ...
1
vote
1answer
163 views

Using secp256k1 and ECDSA with IKE

I just tried using an IKE daemon and EC certificates. I used the secp256k1 curve for key generation. The daemon claims signature scheme ECDSA-256 not supported by private key Now I am wondering ...
6
votes
2answers
6k views

What is the difference between SSH and IPsec?

There seems to be similar encryption going into both. They both use asymmetric (RSA, elliptic curves, etc) for the initial key exchange, then go to some symmetric (AES, Blowfish, etc) protocol. I'm ...
2
votes
3answers
1k views

Filtering In Iran

Since many of you already know the Iranian government aggressively uses internet censorship to block sites such as facebook, flicker, bbc, etc. The Iranian people use various methods to bypass ...
2
votes
1answer
227 views

network improvements over ipsec

I have a specific environment in which TCP is not optimal due to its general assumptions, and thus needs to be improved. This small improvement has been done successfully. It operates at various ...
1
vote
1answer
525 views

How to authenticate to racoon with a certificate chain if only the root CA is known

I'm trying to setup IPsec using x509 certificates on Linux. I'm using racoon for that task. I've come to the point where the authentication works fine if I keep every link of the certificate chain on ...
2
votes
2answers
5k views

IPsec using pre-shared keys

I am trying to understand why do we really use those pre-shared keys when creating a IPSec tunnel. From all the reading that I have done the DH group creates the keys that are used to do the actual ...
2
votes
2answers
1k views

Strongswan crypto

How does StrongSwan enable different crypto libraries?
2
votes
4answers
2k views

IPSec VPNs and symmetric keys

When dealing with IPSec based VPNs, I understand that there is a slight "problem" with symmetric key exchange. Obviously, you can't send the keys over the VPN, since they are used to guarantee the ...
-1
votes
1answer
138 views

Where else is IPSec used, besides with VPNs? [closed]

IPSec is most commonly used to secure VPN traffic. Where else is this protocol suite used? What else can it be used for?
1
vote
1answer
136 views

IPSec, hubs, crypto maps

I thought hubs were layer 1 devices, and so would have no active role in IPSec. I am reading to understand crypto maps, Dynamic crypto map policies are used in site-to-site VPNs when an unknown ...
2
votes
1answer
328 views

Normalizing Windows Advanced Firewall rules

How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen ...
3
votes
1answer
1k views

what is a security association and how does it relate to ipsec?

I am learning IPSec. My class notes define a security association as a one way relationship between sender and receiver that (1) affords security for traffic flow and (2) is identified by the ...
4
votes
1answer
2k views

IPSec AH + ESP used together

When ESP and AH are used together (ESP transport, AH transport) on the same packet does ESP encrypt the AH's hash, or is the hash left in the clear? If the hash isn't encrypted, there are obviously ...
4
votes
2answers
2k views

IPsec - when to use AH only?

As far as I know, AH only covers integrity and authentication. So, suppose that an intermediate router receives the packet with AH and not ESP. Then, can't the router open its content (<- and ...
4
votes
3answers
262 views

How can an outsider tap into communications between two physical sites?

When referring to 'Sites' - I am not talking about a website, but of a physical place where a company resides. Today, to secure communications between two sites - Let's say between an office in ...
-2
votes
2answers
914 views

What software can I used to edit and replay packets? [closed]

From the Wikipedia article on anti-replay: The main goal of anti-replay is to avoid hackers injecting or making changes in packets that travel from a source to a destination. Is this commonly ...
4
votes
2answers
2k views

L2TP/IPsec shared secret: Can it be public?

My university provides a VPN service to gain access to internal services to all members. They are apparently using an L2TP/IPsec solution by Cisco. I'm able to connect just fine, but I'm a bit ...
20
votes
4answers
2k views

IPsec (Internet Protocol Security) facts

Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
5
votes
1answer
1k views

IPSec Domain Isolation with Windows Server

I'm looking for a good way to secure my servers, I have a set of dedicated servers that are not in my office but hosted by an external provider. ALL the servers have only one public (WAN) IP. I don't ...
2
votes
1answer
889 views

IPSec Tunnel Creation process

The IPSec tunnel creation process involves 2 steps: The ISAKMP Phase The IPSec Phase What is the reasoning behind having the two phases? From what i see, the first phase is already encrypted using ...
2
votes
2answers
185 views

Using External Certificates on a network that doesn't permit outbound HTTP/S access

Some highly secure networks and DMZs prevent all communication to outside hosts. This can cause issues with validating externally signed data I can guess that issues with signature validation occur ...
8
votes
6answers
2k views

How can I restrict access to network data by an unauthorized computer that connects via Ethernet?

I assume I can configure most routers to only assign IP addresses to specific MAC addresses, as is possible with wireless routers. However what if a computer is connected via Ethernet and does not ...