Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPsec also includes protocols for establishing mutual authentication between agents at the beginning of the session ...

learn more… | top users | synonyms

39
votes
7answers
70k views

What is the difference in security between a VPN- and a SSL-connection?

I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
20
votes
4answers
2k views

IPsec (Internet Protocol Security) facts

Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
15
votes
5answers
673 views

What is the potential impact of the alleged OpenBSD IPSEC attack?

Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have. For instance, does ...
12
votes
1answer
3k views

If an attacker is intercepting all of my traffic, will he be able to listen on my VPN session?

If I am a remote user, connecting to my firm from home, using IPSec VPN tunnel or through SSL, and an attacker is intercepting all of my traffic, will he be able to watch my VPN session on the clear ...
12
votes
1answer
2k views

What's are the advantages of L2TP/IPSEC over plain IPSEC?

As the title says, my firewall (Sonicwall) can do either IPSEC or L2TP/IPSEC for VPN connections. One advantage of L2TP/IPSEC I can see is that the client computer get allocated its own IP address on ...
11
votes
5answers
11k views

Does IPSec use IKE or ISAKMP?

Does the IPSec protocol suite use IKE or ISAKMP? RFC 2828 states ISAKMP is the protocol used in IPSec to handle SAs, key management and system authentication. Other sources say IKE is the protocol ...
10
votes
4answers
6k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
10
votes
1answer
192 views

Using certificates to secure

I'm working on an application that comprises of a C# WebAPI (on Azure Websites) and a native mobile app. Essentially, a client creates a series of messages using a Web interface and these can be ...
9
votes
1answer
394 views

Maximum number of nodes with IPSec?

From my understanding, for incoming packets over IPSec, the Security Association (SA) is identified by the SPI field of the ESP header. Then let's say I have a bunch of nodes where each node wants to ...
8
votes
6answers
2k views

How can I restrict access to network data by an unauthorized computer that connects via Ethernet?

I assume I can configure most routers to only assign IP addresses to specific MAC addresses, as is possible with wireless routers. However what if a computer is connected via Ethernet and does not ...
8
votes
2answers
9k views

Which is better for server-to-server-communication: IPSec or TLS?

Maybe you could help me with a small problem. Would you recommend IPSec or TLS for a Server-to-Server-Connection? I need two or three arguments for reasoning a decision within my final paper, but ...
8
votes
2answers
767 views

Does DNSSec have any benefit if used with IPSec-enabled IPv6?

I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec? Is DNSSec an IPv4-only technology?
7
votes
5answers
14k views

Are there any reasons for using SSL over IPSec?

is it recommended to use both protocols together? In which situation?
7
votes
2answers
5k views

which diffie-hellman group is needed for secure ike/ipsec

We're deploying ipsec on embedded devices and getting catastrophic performance from the diffie hellman 2048 group in ike.. afterwards the shared securet is used for 3des, sha1. ipsec negiation is ...
7
votes
1answer
113 views

Is PSK-protected IKEv2 secure against MITMs?

I've set up an IKEv2 VPN connection as an alternative to an HTTP proxy (since HTTP proxies' credentials fly in plaintext and iOS still can't correctly remember proxy credentials) and I'd like to know ...
6
votes
5answers
576 views

Does mixing different types of encryption make the connection more secure?

Like when I browse a website using SSL from my laptop that is connected to my router using WPA2. My router talks to my ISP using IPsec. Is that more secure or do these types of encryption have ...
6
votes
2answers
6k views

What is the difference between SSH and IPsec?

There seems to be similar encryption going into both. They both use asymmetric (RSA, elliptic curves, etc) for the initial key exchange, then go to some symmetric (AES, Blowfish, etc) protocol. I'm ...
6
votes
3answers
2k views

What is the difference between encrypted data and data sent through an encrypted tunnel?

I am looking at different VPN protocols. L2TP does not provide encryption so require IPSec to encrypt the data IPSec tunnel provide encryption to the tunnel What is the difference in terms of the ...
5
votes
3answers
2k views

Encryption of headers in IPsec tunnel mode

I am learning about IPsec's transport and tunnel modes. I understand that transport mode encrypts only the payload of an IP packet and is used for communication between two entities that both ...
5
votes
1answer
3k views

Is L2TP as secure as IPSEC for VPNs?

Is it as secure to use L2TP for VPN access, rather than IPSEC? Am I introducing any risks by using L2TP?
5
votes
1answer
64 views

Does IPSec authenticate identity?

I know that SSL/TLS authenticates the identity of a server (and/or client) by presenting a certificate which the client sends to a CA to check the validity. This happens before the SSL/TLS connection ...
5
votes
1answer
1k views

IPSec Domain Isolation with Windows Server

I'm looking for a good way to secure my servers, I have a set of dedicated servers that are not in my office but hosted by an external provider. ALL the servers have only one public (WAN) IP. I don't ...
5
votes
2answers
888 views

What are the risks associated with relying on IPSec IP Filtering?

When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox). Because IPSec Filtering is not stateful, ...
5
votes
2answers
697 views

IPsec on multicast

I am trying to implement IPSec for multicast communication, I tried strongSwan for setting up IPSec for unicast but it doesn't support any standard for multicast ipsec as listed here ...
5
votes
2answers
2k views

How do I make or get computer certificates to use with IPSEC user authentication on Windows?

I am having trouble and need some direction using computer certificates with Windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
5
votes
0answers
831 views

SSL vs IPsec what's the difference [duplicate]

Possible Duplicate: What is the difference in security between a VPN- and a SSL-connection? Which is more secure? And offer better access control?
4
votes
3answers
262 views

How can an outsider tap into communications between two physical sites?

When referring to 'Sites' - I am not talking about a website, but of a physical place where a company resides. Today, to secure communications between two sites - Let's say between an office in ...
4
votes
2answers
2k views

IPsec - when to use AH only?

As far as I know, AH only covers integrity and authentication. So, suppose that an intermediate router receives the packet with AH and not ESP. Then, can't the router open its content (<- and ...
4
votes
2answers
11k views

Ipsec Native VPN on Windows 8 or 10

I have a Cisco PIX, and have been using the Cisco VPN client on windows however I would like to enable this to work with the native Windows 8/10 VPN client. It works fine with the native clients for ...
4
votes
1answer
2k views

IPSec AH + ESP used together

When ESP and AH are used together (ESP transport, AH transport) on the same packet does ESP encrypt the AH's hash, or is the hash left in the clear? If the hash isn't encrypted, there are obviously ...
4
votes
1answer
163 views

IPtables Linux Firewall and IPsec traffic

Can iptables filter out incoming datagrams that are IPSec-tunneled packets going to port 25?
4
votes
1answer
1k views

Difference between IPSEC SA and CHILD SA

Let us consider two network entities. Linux1 (eth0)=============IPSEC=============Linux2(eth0) 192.168.1.1 192.168.1.2 The IPSEC Tunnel is V4 ...
4
votes
1answer
326 views

Does using NAT-T for L2TP / IPsec VPN pose a realistic security risk?

I'm working on upgrading an old Windows RAS server that hosts PPTP VPN. I want to move to a L2TP/IPsec VPN. Due to the firewall appliance we use, the VPN server has to be behind a NAT. This means ...
4
votes
2answers
2k views

L2TP/IPsec shared secret: Can it be public?

My university provides a VPN service to gain access to internal services to all members. They are apparently using an L2TP/IPsec solution by Cisco. I'm able to connect just fine, but I'm a bit ...
3
votes
3answers
131 views

Is there a reason to use both SSL & IPSec together?

As I understand, IPSec protects packets at IP layer and SSL/TLS at transport layer? Is there a scenario in which we might want to use both?
3
votes
1answer
74 views

IPSEC End to End Tunnel Throughput

I have established a IPSEC tunnel ( standard configuration , with ESP) , on two Linux machines (centos6 , core i7) communicating over 1 gbps LAN , and i'am checking the communication throughput. It ...
3
votes
2answers
4k views

Why Use IPSEC AH vs ESP?

I am refreshing my understanding of IPSEC. IPSec is an IETF defined set of security services that use open standards to provide data confidentiality, integrity, and authentication between peers. ...
3
votes
1answer
120 views

IPsec: Is AH in tunnel mode secure?

I have a site-to-site IPsec VPN which was performing poorly (10 -20% upload/download speeds as a percentage of available WAN circuit bandwidth) when using ESP in tunnel mode with DES encryption and ...
3
votes
1answer
1k views

what is a security association and how does it relate to ipsec?

I am learning IPSec. My class notes define a security association as a one way relationship between sender and receiver that (1) affords security for traffic flow and (2) is identified by the ...
3
votes
1answer
6k views

strongswan setup for ipsec environment

I have created two virtualbox ubuntu clones for the purpose of setting up a test strongswan ipsec network; I'm trying to follow this guide. The virtualbox machines are on a bridged adapter and i ...
3
votes
1answer
209 views

ip xfrm limit in iproute2 for ipsec

I am using ip xfrm state and ip xfrm policy commands from iproute2 tool to implement IPSec. I have read documentation of iproute2 (PDF) and ip-xfrm man page. The man page states: LIMIT-LIST := [ ...
3
votes
3answers
7k views

When do I use IPsec tunnel mode or transport mode?

I basically understand how tunnel mode and transport mode works, but I don't know when I should use one instead of another. Among the two parties who want to communicate, if one computer B doesn't ...
3
votes
4answers
163 views

How can a network be secured against attacks coming from the inside?

(updated to (hopefully) be less broad) No matter how well one secures a network there's always the chance of an attacker gaining access. In a shared home + home office network (eg. for a remote ...
3
votes
0answers
63 views

How do i know when IPSEC Phase 2 Has completed with Openswan?

When I bring up a connection using openswan I get the following output but I don't see any ESP traffic through ports 50, 500 or 4500. # ipsec auto --up globacom-vpn 104 "globacom-vpn" #44: ...
2
votes
2answers
1k views

Strongswan crypto

How does StrongSwan enable different crypto libraries?
2
votes
2answers
4k views

How to detect NAT - network address translation?

How to detect if NAT is used in network or not ? I know if you have private address and you are able to connect public network or internet then there must be NAT. But How can I detect that NAT is ...
2
votes
1answer
58 views

Why L2TP is required over IPSec

IPsec facilitates encryption and authentication with ESP. With tunnel mode, IPSec is also providing tunnelling. More importantly, one can use IPsec in tunnel mode, along with transport mode (i.e. ...
2
votes
3answers
1k views

Filtering In Iran

Since many of you already know the Iranian government aggressively uses internet censorship to block sites such as facebook, flicker, bbc, etc. The Iranian people use various methods to bypass ...
2
votes
4answers
2k views

IPSec VPNs and symmetric keys

When dealing with IPSec based VPNs, I understand that there is a slight "problem" with symmetric key exchange. Obviously, you can't send the keys over the VPN, since they are used to guarantee the ...
2
votes
1answer
905 views

IPSec Tunnel Creation process

The IPSec tunnel creation process involves 2 steps: The ISAKMP Phase The IPSec Phase What is the reasoning behind having the two phases? From what i see, the first phase is already encrypted using ...