4

I have a site-to-site IPsec VPN which was performing poorly (10 -20% upload/download speeds as a percentage of available WAN circuit bandwidth) when using ESP in tunnel mode with DES encryption and MD5 Auth. After switching the Active Protocol to AH still in tunnel mode but now using SHA-256 for Authentication, I see a threefold increase in throughput across the VPN. I think the AH has a much lower overhead thanks to no encryption being performed on the packets. But isn't the data still being inherently encrypted since it is in tunnel mode?

The real question boils down to, "Is my data still secure in AH mode?" If so, this increased throughput is wonderful and I would like to keep my endpoint settings this way. If not, it's obviously not worth it and I need to revert to the previous ESP protocol.

Gateways are Zyxel Zywall USG 200s at sites ~3000 miles apart. Thanks in advance for your time.

Improve this question

1 Answer 1

Reset to default
5

It is not "secret", but it is "tamperproof". That may not meet your definition of "secure".

Your data is no longer confidential if only AH is used - anyone capturing packets can read your data because it is not encrypted. It is protected against modification, however; AH ensures that data tampering will be detected and discarded.

AH does not "inherently encrypt"; a "tunnel" does not imply encryption, although often if people are using tunnels they do so mostly so they can use encryption.

You might want to read some high-level descriptions:

  • AH guarantees connectionless integrity and data origin authentication of IP packets
  • ESP provides origin authenticity, integrity and confidentiality protection of packets
Improve this answer
2
  • Okay, thanks for your answer. Out of curiosity then, when would be an example of some instance where you'd want to authenticate but were unconcerned with confidentiality? I can't think of any case when that would be so in my world.
    – Tedwin
    Mar 15, 2015 at 23:54
  • @Tedwin one can imagine a case - sending out stock prices, for example, where the information is intended to be fully public but where the authenticity of the data is paramount. But in reality, you're correct, there's not so much need for AH without ESP. Combined with the ability of ESP to do integrity on its own, AH begins to look like a well-intentioned idea with a limited future...
    – gowenfawr
    Mar 16, 2015 at 1:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .