Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPsec also includes protocols for establishing mutual authentication between agents at the beginning of the session ...

learn more… | top users | synonyms

3
votes
1answer
43 views

IPtables Linux Firewall and IPsec traffic

Can iptables filter out incoming datagrams that are IPSec-tunneled packets going to port 25?
0
votes
1answer
25 views

Why is HMAC truncated in IPsec?

I'm having a look at IPsec standard and I realized that integrity and data authentication check is based on 96-bit truncated version of HMAC algorithms. For example, in IPsec v3 we can use ...
1
vote
2answers
70 views

Which of the TLS/SSL and IPsec protocols is effective?

Which of those two protocols is the most effective for sending data from a client to a server on a local network (knowing that I aim to use it for FTP traffic)?
0
votes
0answers
8 views

IPSec Host-to-Host VPN (RedHat) needs IP Forwarding?

We would like to build a Host-to-Host IPSec VPN (both RedHat Linux). Is it really mandatory to activate IP Forwarding, which is by default deactivated because of our security policy (/etc/sysctl.conf ...
3
votes
3answers
5k views

When do I use IPsec tunnel mode or transport mode?

I basically understand how tunnel mode and transport mode works, but I don't know when I should use one instead of another. Among the two parties who want to communicate, if one computer B doesn't ...
1
vote
2answers
2k views

Why Use IPSEC AH vs ESP?

I am refreshing my understanding of IPSEC. IPSec is an IETF defined set of security services that use open standards to provide data confidentiality, integrity, and authentication between peers. ...
1
vote
0answers
25 views

Setting up IPSEC on LAN between two hosts (OpenBSD) [migrated]

I originally asked this on ServerFault, but got nothing. Hoping there are some OpenBSD experts here Trying to use IPSEC between two hosts on a LAN. No VPN involved Using OpenBSD 5.8 (in VirtualBox). ...
7
votes
1answer
77 views

Is PSK-protected IKEv2 secure against MITMs?

I've set up an IKEv2 VPN connection as an alternative to an HTTP proxy (since HTTP proxies' credentials fly in plaintext and iOS still can't correctly remember proxy credentials) and I'd like to know ...
3
votes
1answer
41 views

IPSEC End to End Tunnel Throughput

I have established a IPSEC tunnel ( standard configuration , with ESP) , on two Linux machines (centos6 , core i7) communicating over 1 gbps LAN , and i'am checking the communication throughput. It ...
0
votes
2answers
146 views

IPSEC - Remote Access Clients, Tunnel or Transport Mode?

I understand that transport mode encrypts only the payload. Do IPSec clients such as Cisco's AnyConnect and/or Cisco VPN Client use transport mode? Or do these clients and others like them use ...
6
votes
3answers
2k views

What is the difference between encrypted data and data sent through an encrypted tunnel?

I am looking at different VPN protocols. L2TP does not provide encryption so require IPSec to encrypt the data IPSec tunnel provide encryption to the tunnel What is the difference in terms of the ...
12
votes
1answer
2k views

What's are the advantages of L2TP/IPSEC over plain IPSEC?

As the title says, my firewall (Sonicwall) can do either IPSEC or L2TP/IPSEC for VPN connections. One advantage of L2TP/IPSEC I can see is that the client computer get allocated its own IP address on ...
2
votes
1answer
36 views

Why L2TP is required over IPSec

IPsec facilitates encryption and authentication with ESP. With tunnel mode, IPSec is also providing tunnelling. More importantly, one can use IPsec in tunnel mode, along with transport mode (i.e. ...
7
votes
0answers
69 views

Using certificates to secure

I'm working on an application that comprises of a C# WebAPI (on Azure Websites) and a native mobile app. Essentially, a client creates a series of messages using a Web interface and these can be ...
1
vote
0answers
41 views

TLS and IPsec use cases

I am currently reading about these protocols and was wondering what are the scenarios where TLS/SSL would be more useful than IPsec and vice versa?
5
votes
1answer
47 views

Does IPSec authenticate identity?

I know that SSL/TLS authenticates the identity of a server (and/or client) by presenting a certificate which the client sends to a CA to check the validity. This happens before the SSL/TLS connection ...
2
votes
1answer
34 views

Encryption algorithm selection in IPsec Phase 2

My question is, in which payload (transform or proposal) does the initiator specify the encryption algorithm to be used in Phase 2. Let us assume that PFS is turned off in this case for simplicity of ...
4
votes
2answers
7k views

Ipsec Native VPN on Windows 8 or 10

I have a Cisco PIX, and have been using the Cisco VPN client on windows however I would like to enable this to work with the native Windows 8/10 VPN client. It works fine with the native clients for ...
0
votes
3answers
38 views

enforce some peers to use IPsec and allow others to bypass it when reaching the same server

Lets assume I have a server that owns UDP socket. And then, for some clients, this server would expect to receive this UDP traffic encapsulated over IPsec. While for some others clients (the default), ...
2
votes
1answer
73 views

Hiding packets, requests, traffic from my PC through Ethernet connected to workplace network

Before everyone jumps on the bandwagon, as I so often see, of saying you shouldn't do anything on a workplace network that is to be done annonymously on your own home network, I want to know an actual ...
0
votes
2answers
90 views

TLS or IPsec protocol for client-server communication? [duplicate]

What is the best protocol for client-server communication? TLS or IPsec? I have a public channel where users communicate with each other using a digital certificate like X.509.
11
votes
5answers
10k views

Does IPSec use IKE or ISAKMP?

Does the IPSec protocol suite use IKE or ISAKMP? RFC 2828 states ISAKMP is the protocol used in IPSec to handle SAs, key management and system authentication. Other sources say IKE is the protocol ...
-1
votes
1answer
35 views

when router get's ipsec packet does it look into crypto map acl

So I have a question about IPSec. For example, we have an extended ACL with one line 10.10.10.0/24 10.20.20.0/24 on one side (R1) and 10.20.20.0/24 10.10.10.0/24 on the other (R2). When we see ...
5
votes
3answers
2k views

Encryption of headers in IPsec tunnel mode

I am learning about IPsec's transport and tunnel modes. I understand that transport mode encrypts only the payload of an IP packet and is used for communication between two entities that both ...
10
votes
1answer
374 views

Maximum number of nodes with IPSec?

From my understanding, for incoming packets over IPSec, the Security Association (SA) is identified by the SPI field of the ESP header. Then let's say I have a bunch of nodes where each node wants to ...
6
votes
2answers
4k views

which diffie-hellman group is needed for secure ike/ipsec

We're deploying ipsec on embedded devices and getting catastrophic performance from the diffie hellman 2048 group in ike.. afterwards the shared securet is used for 3des, sha1. ipsec negiation is ...
6
votes
5answers
543 views

Does mixing different types of encryption make the connection more secure?

Like when I browse a website using SSL from my laptop that is connected to my router using WPA2. My router talks to my ISP using IPsec. Is that more secure or do these types of encryption have ...
3
votes
3answers
123 views

Is there a reason to use both SSL & IPSec together?

As I understand, IPSec protects packets at IP layer and SSL/TLS at transport layer? Is there a scenario in which we might want to use both?
5
votes
2answers
2k views

How do I make or get computer certificates to use with IPSEC user authentication on Windows?

I am having trouble and need some direction using computer certificates with Windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
37
votes
7answers
62k views

What is the difference in security between a VPN- and a SSL-connection?

I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
3
votes
1answer
174 views

ip xfrm limit in iproute2 for ipsec

I am using ip xfrm state and ip xfrm policy commands from iproute2 tool to implement IPSec. I have read documentation of iproute2 (PDF) and ip-xfrm man page. The man page states: LIMIT-LIST := [ ...
5
votes
1answer
272 views

Does using NAT-T for L2TP / IPsec VPN pose a realistic security risk?

I'm working on upgrading an old Windows RAS server that hosts PPTP VPN. I want to move to a L2TP/IPsec VPN. Due to the firewall appliance we use, the VPN server has to be behind a NAT. This means ...
4
votes
1answer
716 views

Difference between IPSEC SA and CHILD SA

Let us consider two network entities. Linux1 (eth0)=============IPSEC=============Linux2(eth0) 192.168.1.1 192.168.1.2 The IPSEC Tunnel is V4 ...
1
vote
1answer
39 views

Can I use transport mode in IPsec if I tunnel via UDP?

Can I use tranport mode (instead of tunnel mode) in IPsec if I tunnel a VPN via UDP? I don't see why the header (that sets the protocol and port) needs to be encrypted in my case (I suspect it would ...
2
votes
0answers
52 views

Manual IPsec and session key(s)

I am evaluating IPsec. I have determined it is best for my case to not use AH (will use PSK for authentication). One issue I have is that at the start there will be no connectivity, so IKE will not ...
2
votes
2answers
130 views

is IPSEC Authentication between local domain hosts a part of normal behaviour in a Windows network?

I am seeing lot of IPSEC Authentication messages in eventlogs of Windows domain hosts. I was wondering if this - setting up IPSEC connections between domain workstations is a part of normal Windows ...
2
votes
0answers
41 views

Possibility of widespread deployment of IPsec

I want to know if IPsec is a candidate for a widespread deployment in the Internet. So far IPsec seems to be adopted merely in VPN networks. IPsec seems to have problems with NAT-traversal and another ...
5
votes
5answers
10k views

Are there any reasons for using SSL over IPSec?

is it recommended to use both protocols together? In which situation?
0
votes
0answers
107 views

IPSEC GRE packets based on key value with IP xfrm command

am trying to selectively encrypt GRE packet based on Key value in header using IP xfrm command in linux. Following commands are used for key value 3 ip xfrm state add src $machine2 dst $my_ip proto ...
0
votes
1answer
127 views

What exactly does ipsec and ssl do? [duplicate]

Im trying to figure out how SSL and ipsec works. I know the process in both SSL and ipsec but why do I need SSL if I can use IPsec when it runs below the transport layer. Wont IPsec encrypt everything ...
7
votes
2answers
742 views

Does DNSSec have any benefit if used with IPSec-enabled IPv6?

I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec? Is DNSSec an IPv4-only technology?
7
votes
2answers
8k views

Which is better for server-to-server-communication: IPSec or TLS?

Maybe you could help me with a small problem. Would you recommend IPSec or TLS for a Server-to-Server-Connection? I need two or three arguments for reasoning a decision within my final paper, but ...
5
votes
2answers
587 views

IPsec on multicast

I am trying to implement IPSec for multicast communication, I tried strongSwan for setting up IPSec for unicast but it doesn't support any standard for multicast ipsec as listed here ...
0
votes
0answers
129 views

What is the difference between AH and ESP for internet packets authentication and integrity?

What are the basic pros and cons when you have to choose between AH and ESP for authentication and security of IP packets? Why AH exists since the same functionality is provided by ESP for origin ...
0
votes
2answers
373 views

Finding the IP address origin of malware attacker behind VPN and proxies

I have a client that wants me to begin doing research on finding the origin of a persistent attacker to their network and employees. I haven't gotten the specifics yet, but I'm trying to think of ways ...
3
votes
1answer
112 views

IPsec: Is AH in tunnel mode secure?

I have a site-to-site IPsec VPN which was performing poorly (10 -20% upload/download speeds as a percentage of available WAN circuit bandwidth) when using ESP in tunnel mode with DES encryption and ...
2
votes
0answers
132 views

How secure is L2TP+IPSEC?

I understand PPTP is widely used still, but insecure. A convenient alternative is: L2TP+IPSEC. How secure is it? What steps in the server setup can I take to maintain a high degree of compatibility ...
2
votes
1answer
159 views

open source IKE for Windows 7/8 [closed]

Is there an open source implementation of Internet Key Exchange protocol for windows? I found only openiked for linux platforms. (http://www.openiked.org/)
0
votes
1answer
126 views

What to choose ipsec or tlsv1 for rdp

I found a link but it didn't answered on my questions. (http://www.k2esec.com/secure-communications/network-security-protocols-ipsec-vs-tlsssl-vs-ssh-part-ii). I want to create secure connection for ...
-3
votes
3answers
267 views

Basics - IP spoofing

I can't understand why IP spoofing (even basic) is very limited. Suppose Bob and Alice are about to communicate and Eve can see network communication, why eve can't use IP spoofing for making "Man ...