Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPsec also includes protocols for establishing mutual authentication between agents at the beginning of the session ...

learn more… | top users | synonyms

1
vote
1answer
50 views

IPSec Host-to-Host VPN (RedHat) needs IP Forwarding?

We would like to build a Host-to-Host IPSec VPN (both RedHat Linux). Is it really mandatory to activate IP Forwarding, which is by default deactivated because of our security policy (/etc/sysctl.conf ...
1
vote
1answer
32 views

What exactly does L2TP (over IPsec) mean?

I understand that one of the ways in which a VPN can be implemented is via L2TP over IPSEC. What does this mean exactly? I know that IPSEC is a network layer protocol. On the other hand L2TP is a data ...
0
votes
1answer
37 views

How VPN software apps work?

I have seen cases where people install a VPN app on their phones to circumvent governments which bar access to certain websites (I have heard China is an example of this). I am curious how these apps ...
0
votes
1answer
10 views

Is it possible to use custom DH parameters for IKEv1 / IKEv2 /IPSEC?

While researching how to deploy TLS for web servers most securely, I have learned that using custom DH parameters is one of the key aspects. Now I am in the process of deploying IKE / IPSEC. As far ...
2
votes
2answers
34 views

How can IPSec provide confidentiality between two hosts on private networks?

Can you use transport mode with IPsec processing to provide confidentiality between two hosts in geographically separate private IP networks? I have read somewhere that transport mode is the default ...
0
votes
0answers
13 views

Dead Peer Detection and IKEv1

The ol' IKE v1 in aggressive mode vulnerability has raised it's head, so I was doing some investigation into how bad it could really be on this particular endpoint. Looking at various analyses from ...
11
votes
2answers
243 views

Using certificates to secure

I'm working on an application that comprises of a C# WebAPI (on Azure Websites) and a native mobile app. Essentially, a client creates a series of messages using a Web interface and these can be ...
1
vote
1answer
50 views

VPN / VPS and IP logs

Here's the situation: 1) I rent a VPS at a hoster and install VPN on it. 2) Completely disable all logs. Those logs that can not be disabled - permanently delete. 3) I connect to my VPS via VPN (...
1
vote
0answers
27 views

When would IPSec sequence numbers be ignored?

Under what circumstances and why are IPSec sequences ignored by the recipient? The only reason I can think of anyone wishing to ignore sequence numbers and therefore not use anti-replay protection ...
3
votes
4answers
173 views

How can a network be secured against attacks coming from the inside?

(updated to (hopefully) be less broad) No matter how well one secures a network there's always the chance of an attacker gaining access. In a shared home + home office network (eg. for a remote ...
0
votes
1answer
25 views

content of Informational packets in ipsec between phase1 & phase2

I want to know about Informational packets in IKE negotiation between main mode & quick mode. what are the contents those packets will contain? here i am uploading the screen shot of ike ...
2
votes
0answers
50 views

what are the advantages and disadvantages of using ipsec protocol, how vulnerable is it? [closed]

There are several ways through which the VPN can be applied, like SSL, TLS etc. But most of the VPN use IPSec. What kind vulnerabilities does ipsec possess?
1
vote
4answers
173 views

Which of the TLS/SSL and IPsec protocols is effective?

Which of those two protocols is the most effective for sending data from a client to a server on a local network (knowing that I aim to use it for FTP traffic)?
1
vote
0answers
17 views

Where can i find information about Ipsec Xfrm framework?

I have searched online and found very little information about the ipsec xfrm framework, including the book Networking implementation and Theory.. Where can i get more information about xfrm ...
3
votes
0answers
141 views

How do i know when IPSEC Phase 2 Has completed with Openswan?

When I bring up a connection using openswan I get the following output but I don't see any ESP traffic through ports 50, 500 or 4500. # ipsec auto --up globacom-vpn 104 "globacom-vpn" #44: ...
4
votes
1answer
281 views

IPtables Linux Firewall and IPsec traffic

Can iptables filter out incoming datagrams that are IPSec-tunneled packets going to port 25?
0
votes
1answer
51 views

Why is HMAC truncated in IPsec?

I'm having a look at IPsec standard and I realized that integrity and data authentication check is based on 96-bit truncated version of HMAC algorithms. For example, in IPsec v3 we can use HMAC-MD5-96,...
4
votes
3answers
8k views

When do I use IPsec tunnel mode or transport mode?

I basically understand how tunnel mode and transport mode works, but I don't know when I should use one instead of another. Among the two parties who want to communicate, if one computer B doesn't ...
3
votes
2answers
5k views

Why Use IPSEC AH vs ESP?

I am refreshing my understanding of IPSEC. IPSec is an IETF defined set of security services that use open standards to provide data confidentiality, integrity, and authentication between peers. ...
7
votes
1answer
142 views

Is PSK-protected IKEv2 secure against MITMs?

I've set up an IKEv2 VPN connection as an alternative to an HTTP proxy (since HTTP proxies' credentials fly in plaintext and iOS still can't correctly remember proxy credentials) and I'd like to know ...
3
votes
1answer
101 views

IPSEC End to End Tunnel Throughput

I have established a IPSEC tunnel ( standard configuration , with ESP) , on two Linux machines (centos6 , core i7) communicating over 1 gbps LAN , and i'am checking the communication throughput. It ...
0
votes
2answers
204 views

IPSEC - Remote Access Clients, Tunnel or Transport Mode?

I understand that transport mode encrypts only the payload. Do IPSec clients such as Cisco's AnyConnect and/or Cisco VPN Client use transport mode? Or do these clients and others like them use ...
6
votes
3answers
2k views

What is the difference between encrypted data and data sent through an encrypted tunnel?

I am looking at different VPN protocols. L2TP does not provide encryption so require IPSec to encrypt the data IPSec tunnel provide encryption to the tunnel What is the difference in terms of the ...
13
votes
1answer
2k views

What's are the advantages of L2TP/IPSEC over plain IPSEC?

As the title says, my firewall (Sonicwall) can do either IPSEC or L2TP/IPSEC for VPN connections. One advantage of L2TP/IPSEC I can see is that the client computer get allocated its own IP address on ...
3
votes
1answer
78 views

Why L2TP is required over IPSec

IPsec facilitates encryption and authentication with ESP. With tunnel mode, IPSec is also providing tunnelling. More importantly, one can use IPsec in tunnel mode, along with transport mode (i.e. ...
1
vote
0answers
73 views

TLS and IPsec use cases

I am currently reading about these protocols and was wondering what are the scenarios where TLS/SSL would be more useful than IPsec and vice versa?
5
votes
1answer
80 views

Does IPSec authenticate identity?

I know that SSL/TLS authenticates the identity of a server (and/or client) by presenting a certificate which the client sends to a CA to check the validity. This happens before the SSL/TLS connection ...
2
votes
1answer
58 views

Encryption algorithm selection in IPsec Phase 2

My question is, in which payload (transform or proposal) does the initiator specify the encryption algorithm to be used in Phase 2. Let us assume that PFS is turned off in this case for simplicity of ...
5
votes
2answers
13k views

Ipsec Native VPN on Windows 8 or 10

I have a Cisco PIX, and have been using the Cisco VPN client on windows however I would like to enable this to work with the native Windows 8/10 VPN client. It works fine with the native clients for ...
0
votes
3answers
43 views

enforce some peers to use IPsec and allow others to bypass it when reaching the same server

Lets assume I have a server that owns UDP socket. And then, for some clients, this server would expect to receive this UDP traffic encapsulated over IPsec. While for some others clients (the default), ...
2
votes
1answer
98 views

Hiding packets, requests, traffic from my PC through Ethernet connected to workplace network

Before everyone jumps on the bandwagon, as I so often see, of saying you shouldn't do anything on a workplace network that is to be done annonymously on your own home network, I want to know an actual ...
0
votes
2answers
142 views

TLS or IPsec protocol for client-server communication? [duplicate]

What is the best protocol for client-server communication? TLS or IPsec? I have a public channel where users communicate with each other using a digital certificate like X.509.
11
votes
5answers
11k views

Does IPSec use IKE or ISAKMP?

Does the IPSec protocol suite use IKE or ISAKMP? RFC 2828 states ISAKMP is the protocol used in IPSec to handle SAs, key management and system authentication. Other sources say IKE is the protocol ...
-1
votes
1answer
56 views

when router get's ipsec packet does it look into crypto map acl

So I have a question about IPSec. For example, we have an extended ACL with one line 10.10.10.0/24 10.20.20.0/24 on one side (R1) and 10.20.20.0/24 10.10.10.0/24 on the other (R2). When we see ...
5
votes
3answers
2k views

Encryption of headers in IPsec tunnel mode

I am learning about IPsec's transport and tunnel modes. I understand that transport mode encrypts only the payload of an IP packet and is used for communication between two entities that both ...
9
votes
1answer
406 views

Maximum number of nodes with IPSec?

From my understanding, for incoming packets over IPSec, the Security Association (SA) is identified by the SPI field of the ESP header. Then let's say I have a bunch of nodes where each node wants to ...
7
votes
2answers
6k views

which diffie-hellman group is needed for secure ike/ipsec

We're deploying ipsec on embedded devices and getting catastrophic performance from the diffie hellman 2048 group in ike.. afterwards the shared securet is used for 3des, sha1. ipsec negiation is ...
6
votes
5answers
594 views

Does mixing different types of encryption make the connection more secure?

Like when I browse a website using SSL from my laptop that is connected to my router using WPA2. My router talks to my ISP using IPsec. Is that more secure or do these types of encryption have ...
3
votes
3answers
142 views

Is there a reason to use both SSL & IPSec together?

As I understand, IPSec protects packets at IP layer and SSL/TLS at transport layer? Is there a scenario in which we might want to use both?
5
votes
2answers
3k views

How do I make or get computer certificates to use with IPSEC user authentication on Windows?

I am having trouble and need some direction using computer certificates with Windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
41
votes
7answers
73k views

What is the difference in security between a VPN- and a SSL-connection?

I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
3
votes
1answer
226 views

ip xfrm limit in iproute2 for ipsec

I am using ip xfrm state and ip xfrm policy commands from iproute2 tool to implement IPSec. I have read documentation of iproute2 (PDF) and ip-xfrm man page. The man page states: LIMIT-LIST := [ ...
4
votes
1answer
362 views

Does using NAT-T for L2TP / IPsec VPN pose a realistic security risk?

I'm working on upgrading an old Windows RAS server that hosts PPTP VPN. I want to move to a L2TP/IPsec VPN. Due to the firewall appliance we use, the VPN server has to be behind a NAT. This means ...
4
votes
1answer
1k views

Difference between IPSEC SA and CHILD SA

Let us consider two network entities. Linux1 (eth0)=============IPSEC=============Linux2(eth0) 192.168.1.1 192.168.1.2 The IPSEC Tunnel is V4 ...
1
vote
1answer
47 views

Can I use transport mode in IPsec if I tunnel via UDP?

Can I use tranport mode (instead of tunnel mode) in IPsec if I tunnel a VPN via UDP? I don't see why the header (that sets the protocol and port) needs to be encrypted in my case (I suspect it would ...
2
votes
0answers
64 views

Manual IPsec and session key(s)

I am evaluating IPsec. I have determined it is best for my case to not use AH (will use PSK for authentication). One issue I have is that at the start there will be no connectivity, so IKE will not ...
2
votes
2answers
133 views

is IPSEC Authentication between local domain hosts a part of normal behaviour in a Windows network?

I am seeing lot of IPSEC Authentication messages in eventlogs of Windows domain hosts. I was wondering if this - setting up IPSEC connections between domain workstations is a part of normal Windows ...
2
votes
0answers
45 views

Possibility of widespread deployment of IPsec

I want to know if IPsec is a candidate for a widespread deployment in the Internet. So far IPsec seems to be adopted merely in VPN networks. IPsec seems to have problems with NAT-traversal and another ...
9
votes
5answers
17k views

Are there any reasons for using SSL over IPSec?

is it recommended to use both protocols together? In which situation?
0
votes
1answer
160 views

What exactly does ipsec and ssl do? [duplicate]

Im trying to figure out how SSL and ipsec works. I know the process in both SSL and ipsec but why do I need SSL if I can use IPsec when it runs below the transport layer. Wont IPsec encrypt everything ...