Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPsec also includes protocols for establishing mutual authentication between agents at the beginning of the session ...

learn more… | top users | synonyms

23
votes
7answers
36k views

What is the difference in security between a VPN- and a SSL-connection?

I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
18
votes
4answers
1k views

IPsec (Internet Protocol Security) facts

Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
13
votes
5answers
569 views

What is the potential impact of the alleged OpenBSD IPSEC attack?

Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have. For instance, does ...
11
votes
1answer
2k views

If an attacker is intercepting all of my traffic, will he be able to listen on my VPN session?

If I am a remote user, connecting to my firm from home, using IPSec VPN tunnel or through SSL, and an attacker is intercepting all of my traffic, will he be able to watch my VPN session on the clear ...
10
votes
4answers
3k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
9
votes
1answer
1k views

What's are the advantages of L2TP/IPSEC over plain IPSEC?

As the title says really, my firewall (Sonicwall) can do either IPSEC or L2TP/IPSEC for VPN connections. One advantage of L2TP/IPSEC I can see is that the client computer get allocated it's own IP ...
7
votes
6answers
1k views

How can I restrict access to network data by an unauthorized computer that connects via Ethernet?

I assume I can configure most routers to only assign IP addresses to specific MAC addresses, as is possible with wireless routers. However what if a computer is connected via Ethernet and does not ...
6
votes
5answers
4k views

Does IPSec use IKE or ISAKMP?

Does the IPSec protocol suite use IKE or ISAKMP? RFC 2828 states ISAKMP is the protocol used in IPSec to handle SAs, key management and system authentication. Other sources say IKE is the protocol ...
6
votes
0answers
103 views

Maximum number of nodes with IPSec?

From my understanding, for incoming packets over IPSec, the Security Association (SA) is identified by the SPI field of the ESP header. Then let's say I have a bunch of nodes where each node wants to ...
5
votes
3answers
782 views

Books on Cryptography, with a focus on application to Network Security?

Looking for some nice text books in the field of network security as part of my course. Our course covers mainly tls, ssl, pgp, smime, vpn, md5, hmac ....
5
votes
2answers
3k views

Which is better for server-to-server-communication: IPSec or TLS?

Maybe you could help me with a small problem. Would you recommend IPSec or TLS for a Server-to-Server-Connection? I need two or three arguments for reasoning a decision within my final paper, but ...
5
votes
2answers
1k views

Encryption of headers in IPsec tunnel mode

I am learning about IPsec's transport and tunnel modes. I understand that transport mode encrypts only the payload of an IP packet and is used for communication between two entities that both ...
5
votes
2answers
577 views

Does DNSSec have any benefit if used with IPSec-enabled IPv6?

I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec? Is DNSSec an IPv4-only technology?
5
votes
1answer
869 views

IPSec Domain Isolation with Windows Server

I'm looking for a good way to secure my servers, I have a set of dedicated servers that are not in my office but hosted by an external provider. ALL the servers have only one public (WAN) IP. I don't ...
5
votes
3answers
1k views

What is the difference between encrypted data and data sent through an encrypted tunnel

I am looking at different VPN protocols. [1] L2TP does not provide encryption so require IPSec to encrypt the data [2] IPSec tunnel provide encryption to the tunnel What is the difference in terms ...
5
votes
2answers
676 views

What are the risks associated with relying on IPSec IP Filtering?

When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox). Because IPSec Filtering is not stateful, ...
5
votes
1answer
1k views

How do I make or get computer certificates to use with IPSEC user authentication on Windows?

I am having trouble and need some direction using computer certificates with Windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
5
votes
0answers
824 views

SSL vs IPsec what's the difference [duplicate]

Possible Duplicate: What is the difference in security between a VPN- and a SSL-connection? Which is more secure? And offer better access control?
4
votes
3answers
218 views

How can an outsider tap into communications between two physical sites?

When referring to 'Sites' - I am not talking about a website, but of a physical place where a company resides. Today, to secure communications between two sites - Let's say between an office in ...
4
votes
2answers
863 views

IPsec - when to use AH only?

As far as I know, AH only covers integrity and authentication. So, suppose that an intermediate router receives the packet with AH and not ESP. Then, can't the router open its content (<- and ...
4
votes
1answer
3k views

Is L2TP as secure as IPSEC for VPNs?

Is it as secure to use L2TP for VPN access, rather than IPSEC? Am I introducing any risks by using L2TP?
4
votes
2answers
2k views

L2TP/IPsec shared secret: Can it be public?

My university provides a VPN service to gain access to internal services to all members. They are apparently using an L2TP/IPsec solution by Cisco. I'm able to connect just fine, but I'm a bit ...
3
votes
2answers
2k views

What is the difference between SSH and IPsec?

There seems to be similar encryption going into both. They both use asymmetric (RSA, elliptic curves, etc) for the initial key exchange, then go to some symmetric (AES, Blowfish, etc) protocol. I'm ...
3
votes
1answer
85 views

which diffie-hellman group is needed for secure ike/ipsec

We're deploying ipsec on embedded devices and getting catastrophic performance from the diffie hellman 2048 group in ike.. afterwards the shared securet is used for 3des, sha1. ipsec negiation is ...
2
votes
2answers
706 views

Strongswan crypto

How does StrongSwan enable different crypto libraries?
2
votes
2answers
2k views

How to detect NAT - network address translation?

How to detect if NAT is used in network or not ? I know if you have private address and you are able to connect public network or internet then there must be NAT. But How can I detect that NAT is ...
2
votes
1answer
71 views

Best Practice: frequency to change IPSec pre-shared key

Is there any Best Practice as far as changing IPSec pre-shared keys for security purposes? Obviously, larger companies would have a issue changing these and then pushing the new key out to the user ...
2
votes
1answer
77 views

Does mixing different types of encryption make the connection more secure?

Like when I browse a website using SSL from my laptop that is connected to my router using WPA2. My router talks to my ISP using IPSec. Is that more secure or these types of encryption have nothing ...
2
votes
1answer
72 views

IKEv2: Why is it important “that each side sign the other side's nonce”

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that ...
2
votes
1answer
135 views

IPSec sequence number

I was going through a study of IPsec and I found that there are redundant sequence numbers: one in the AH or ESP header, and the other is in the TCP header for a communication. Is it not an ...
2
votes
3answers
739 views

Filtering In Iran

Since many of you already know the Iranian government aggressively uses internet censorship to block sites such as facebook, flicker, bbc, etc. The Iranian people use various methods to bypass ...
2
votes
1answer
72 views

how IPS and IPSec work together in a host

I want to know how they work together . for example , we implement IPSec tunnel between 2 routers and we establish Snort IPS on Router 1. when Router 1 get the packets , they're encrypted . Now which ...
2
votes
1answer
103 views

Are all TCP connection protected by IPsec?

I hope this question fits this stackexchange: From what I understand, IPSec takes care of encrypting everything above the IP layer (transport, application). Does that mean that if I open a socket ...
2
votes
2answers
2k views

IPsec using pre-shared keys

I am trying to understand why do we really use those pre-shared keys when creating a IPSec tunnel. From all the reading that I have done the DH group creates the keys that are used to do the actual ...
2
votes
1answer
325 views

what is a security association and how does it relate to ipsec?

I am learning IPSec. My class notes define a security association as a one way relationship between sender and receiver that (1) affords security for traffic flow and (2) is identified by the ...
2
votes
1answer
5k views

strongswan setup for ipsec environment

I have created two virtualbox ubuntu clones for the purpose of setting up a test strongswan ipsec network; I'm trying to follow this guide. The virtualbox machines are on a bridged adapter and i ...
2
votes
1answer
39 views

How does IPsec turn KEYMAT into Encryption and Authentication Keys?

IPsec is a framework protocol that consists of the sub-protocols ESP and AH. IPsec, inately, doesn't include a Key Exchange mechanism, and is therefore dependent on manually setting Keys (archaic), ...
2
votes
1answer
224 views

PFS incentive during IKE Phase 2

I'm trying to see the actual point in implementing Perfect Forward Secrecy during Internet Key Exchange Phase 2, if it had already been used during Phase 1. Quoting the IKEv2 RFC: RFC 5596 ...
2
votes
2answers
268 views

Skype Audio / Video Session over VPN?

Basically I'm wondering if a Skype video session along with audio could be logged (or recorded) over a virtual private network? I know whoever hosts the VPN server can log which websites you visit (or ...
2
votes
1answer
1k views

IPSec AH + ESP used together

When ESP and AH are used together (ESP transport, AH transport) on the same packet does ESP encrypt the AH's hash, or is the hash left in the clear? If the hash isn't encrypted, there are obviously ...
2
votes
1answer
249 views

Normalizing Windows Advanced Firewall rules

How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen ...
2
votes
2answers
111 views

Using External Certificates on a network that doesn't permit outbound HTTP/S access

Some highly secure networks and DMZs prevent all communication to outside hosts. This can cause issues with validating externally signed data I can guess that issues with signature validation occur ...
2
votes
1answer
211 views

network improvements over ipsec

I have a specific environment in which TCP is not optimal due to its general assumptions, and thus needs to be improved. This small improvement has been done successfully. It operates at various ...
2
votes
1answer
342 views

Does iOS use built-in certificates to authenticate peers when using ipsec VPNs?

Suppose I am setting up an IPsec VPN for Apple iOS clients with the requirement that the iOS clients need to know that the server is legitimate and vice-versa. I create a root CA and issue a ...
1
vote
1answer
115 views

IPSec, hubs, crypto maps

I thought hubs were layer 1 devices, and so would have no active role in IPSec. I am reading to understand crypto maps, Dynamic crypto map policies are used in site-to-site VPNs when an unknown ...
1
vote
4answers
1k views

IPSec VPNs and symmetric keys

When dealing with IPSec based VPNs, I understand that there is a slight "problem" with symmetric key exchange. Obviously, you can't send the keys over the VPN, since they are used to guarantee the ...
1
vote
1answer
475 views

IPSec Tunnel Creation process

The IPSec tunnel creation process involves 2 steps: The ISAKMP Phase The IPSec Phase What is the reasoning behind having the two phases? From what i see, the first phase is already encrypted using ...
1
vote
1answer
120 views

Practical way to communicate a pre-shared key?

Company A needs to set up an IPsec VPN with company B, where each side will configure its own devices. Is there a recommended practical and quick way to communicate a pre-shared key from A to B? I ...
1
vote
1answer
49 views

Is it possible to use AH in transport mode on an IPSec channel with mediation?

I understand that it's not possible to have Autentication Header with a regular NAT, because it messes with the IP header protected by AH. How about proxies? Do they change anything in the packet? ...
1
vote
1answer
545 views

How does IPSec protect against IP spoofing?

IPsec is a security mechanism that provides peer-entity authentication, data-origin authentication, data integrity, and optionally data con´Čüdentiality. It relies on extensions to the standard IP ...