8

For a corporate network, is there a way to possibly encrypt all network traffic on the local network?

I would like to ensure that there is nothing left for chance to be packet sniffed. Not even e-mails or machine to machine communications with chat devices.

5 Answers 5

13

Any decent VPN will ensure encryption, but of course it would have to be configured on each and every machine. IPsec is a VPN technology which has the advantage of being built-in at the IP level and already implemented in your operating system (if it is not, then learn that it is high time that you upgrade these Windows 98 machines).

Note, though, the following important points:

  • Any attacker would can subvert one of the machines will be able to snoop on every packet that the machine receives and is able to decrypt.
  • Even if you configure IPsec so that every two machines negotiate an encryption key which is shared between exactly these two machines (and none other), so that a subverted machine may see only these packets which are destined to it, it may happen that this subverted machine, by sending maliciously crafted packets, could redirect traffic to it (e.g. by poisoning the DNS).

That's a limitation of all these encryption setups: they are great at establishing a strong isolation between the local network machines, and the outside world. However, they usually do nothing against local attackers, i.e. attackers who could gain control of one "allowed" machine (as opposed to attackers who just plug into a free switch port or join a WiFi router).

Machine subversion is, unfortunately, a rather common occurrence. It usually goes through email viruses, malware from the Web, even malicious USB keys... (if a user finds a USB key in his mailbox, what will he do ? Well, 95% of the users will plug it in their machine, to see what is on it).


Another important point is that if you succeed at preventing packet sniffing, then, well, packet sniffing is no longer possible. In particular packet sniffing by sysadmin tools that look for malware and virus. Encryption is a multi-bladed weapon.

1

Check out tcpcrypt http://tcpcrypt.org/ but note, won't do anything for UDP. The other mechanism would be VPN endpoints between all connections which would be a management nightmare

1

IPSEC or encrypted VPN do this, but it would make for a complex and expensive setup should you want to have such an implementation. It is however not impossible.

1

a lot of daemons are ssl/tls - aware (webservers, mail, dbs like pg or mysql), for everything you could use stunnel - to encryptify this service (but you'll need a ssl/tls -a aware client OR use stunnel in clientmode on every client)

if you have more than 3 clients you should use a centralized config-management-tool like puppet, otherwise it will become a configuration-nightmare

i think using stunnel would be a little easier than using a vpn to access every server/service, because you have to use IPSEC and identification via client-certs and need to generate and manage a cert for every client on every vpn-endpoint.

0

In Windows, you can configure the built-in Firewall via Group Policy to only allow encrypted traffic outwards. To configure all applications to encrypt their traffic is another story.

If you really want that encryption, I would put hardware encrypters between the connections you want to encrypt. But even those need to be configured with their encryption key on both sides first. And these boxes must by physically secured; you can't put a decrypter box in front of the Switches, because attackers could just intercept the decrypted traffic there (or steal the decrypter box). This essentially means not using any decentralized Switches.

1
  • Good ole' KGs and TACLANEs... Sep 7, 2016 at 12:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .