1

Given a site to site IPSEC VPN most firewalls allow for the selection of which DH group the site to site tunnel will use to perform the key exchange prior to encrypting the traffic.

I have noticed that with client IPSEC VPNs typically you only have the choice of entering a pre shared key.

Do client IPSEC VPNs not use DH Groups? Do they only use the pre shared key (and since the key is pre shared there is not a need to perform a key exchange)? Do you know of any vendors who make a product that allows DH groups to be used with client IPSEC VPNs so the key exchange is dynamic and not pre shared?

I don't have a use case that requires this, I just want to make sure I understand why the Cisco ASA allows you to select a DH group for site to site IPSEC VPNs but not for client IPSEC VPNs.

Improve this question

3 Answers 3

Reset to default
1

There is no need for a key exchange, that typically applies to SSL/TLS protocols (and such). VPN's often use preshared keys. Sometimes (OpenVPN) you can define a DH keyfile but only for the ephemeral key exchange that takes place after the connection is established, this enables forward secrecy.

Update

There are VPN's that do a key exchange, IIRC both Cisco and Dell support this in their Enterprise VPN products.

Improve this answer
1
  • So with both the client and site to site VPNs being IPSEC, I was asking why one would give you the option to choose a DH group and the other would not. They are both IPSEC. I assume the answer is that with a client VPN the key is normally pre shared so there is no need for keys to be exchanged. Thanks for the answer about OpenVPN, because I wasn't aware of that.
    – user5870571
    Aug 29, 2016 at 13:09
1

The IKE protocol used to create IPsec security associations (SA) always requires a DH exchange to create dynamic keying material. The pre-shared key is used to authenticate the peers (for IKEv1 it is also added to the IKE key material). For IKEv1 all IPsec SAs may optionally use a separate DH exchange to create new key material (instead of deriving it from the IKE key material), for IKEv2 this is possible for all IPsec SAs except the first one that's created with the initial IKE exchange.

Whether the DH groups are configured explicitly or the server just accepts whatever the client proposes (if acceptable to its local policy) is a different matter. I suppose it could simplify configuration if the server does not restrict the config to a single group in roadwarrior scenarios, where there might be different clients from different vendors using different DH groups by default.

Improve this answer
4
  • If DH exchange occurs regardless of VPN tunnel type why are DH groups not shown in ASA ASDM for Client IPSEC VPN tunnels?
    – user5870571
    Aug 29, 2016 at 13:20
  • I don't know anything about Cisco devices, but as I mentioned they might just have simplified the configuration options as client may use different groups and many clients won't provide an option to select a specific DH group, so multiple groups have to be accepted anyway.
    – ecdsa
    Aug 29, 2016 at 13:24
  • So you and Yorick de Wild both answered a third of my question so I upvoted each of your answers. I found the answer to the remaining third of my question which I will post as an answer.
    – user5870571
    Aug 29, 2016 at 13:35
  • @ecdsa good addition, I didn't want to go into the IKE details :)
    – Yorick de Wid
    Aug 29, 2016 at 13:46
0

To answer the last part of my question on why selecting a DH group is not available in Cisco ASA ASDM for a client IPSEC VPN tunnel configuration (why does the Cisco ASA allows you to select a DH group for site to site IPSEC VPNs but not for client IPSEC VPNs), there is a discussion about this on Cisco's forums where it is pointed out that the ASA (version 8.3 with VPN Client 5) uses DH group 2 unless the configuration is using certificate authentication if it does then the DH group used in 5.

https://supportforums.cisco.com/discussion/11045371/cisco-asa-dh-group-5-isakmp-policy-and-not-working-ra-vpn

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .