Questions tagged [ipsec]
Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPsec also includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to be used during the session.
0
votes
0answers
9 views
Is there any way in which i can configure Windows IPSEC policy to use just AH mode and not ESP
I have done windows machine authentication with Linux running free swan server. With default configuration i could see ping encrypted with ESP. But i want to test it with AH also. Is there any way in ...
1
vote
2answers
58 views
Where would I go to use a reliably secure encrypted internet connection?
Lately, I’ve been paying $100 a month for Fios. I’m thinking of canceling this service because I rarely use my internet at home, since I’m at school most of the time and my college offers internet (...
2
votes
2answers
115 views
Maximum number of certificates generated by a CA
What is the maximum number of certificates that can be generated from a CA?
The use case is a VPN using certificate authentication and I would like to know what is the theoretical number of unique ...
0
votes
1answer
28 views
IKE Phase 1 /w PSK resource?
I can't seem to find a sufficiently detailed resource that describes the IKE phase 1 PSK identity authentication process. They seem to focus on differences between aggressive and main mode while ...
0
votes
0answers
27 views
How can the fact that ESP in IPSec does not provide integrity for the IP address be exploited?
I understand that ESP encrypts data and provides integrity for everything EXCEPT layer 3 (the IP address) and that AH provides integrity for everything but does not encrypt. What are the inherent ...
0
votes
1answer
34 views
IPsec down with unusual SNMP traffic [closed]
Time to time IPSec tunnel status become down, with unusual SNMP Traffic. when I disable and enable port manually, it become normal.
I am using 200E fortigate firewall.
Have you any idea or previous ...
0
votes
1answer
32 views
IPsec with PSK: Can PSK be used for passive eavesdroping?
I use a PSK to connect to an IPsec VPN.
Let's say an attacker can gain access to my PSK.
He can then impersonate me, that much is clear.
But would she also be able to decrypt intercepted traffic? ...
4
votes
2answers
75 views
IPSEC connection attempt to rogue server — is my PSK compromised?
I am setting up an IPSec connection between two sites using Ubiquiti EdgeOS-based equipment. Using a DDNS service (a static IP is unavailable from the ISP), they can be found at east.example.net and ...
0
votes
1answer
240 views
Which PFS Group is recommended for IPSec configuration?
I can't find much information on PFS (Perfect Forward Secrecy) Groups so I'm unsure what to suggest for a secure IPSec configuration.
Any suggestions on PFS groups that aren't recommended?
What is ...
0
votes
1answer
66 views
What alternatives to IPSec for diversifyed redundancy?
I need to provide redundancy to an IPSec link between two premises. I would like to have no single point of failure and to diversify technologies. What could I use please?
Are the following leads ...
1
vote
1answer
216 views
Please explain the vulnerability for the pre-shared Key for IKEv1 brute force IPSec
After the vulnerability was released for IPSec IKEv1 PSKs, our organization decided to increase the size and complexity of the PSK.
However, upon releasing the new PSK we had a few issues:
...
0
votes
1answer
150 views
Why doesn't IKEv2 use L2TP?
My guess is that with IPSec/IKEv1, since it doesn't support NAT, you either have to manually configure routes from your machine, or use a layer 2 tunnel (such as l2tp) to talk with devices on the ...
1
vote
2answers
52 views
Do I need Gateway Firewall for IoT network? [closed]
Do I need a gateway firewall to prevent attacks like DoS, if my IoT network can only talk to cloud using IPsec?
Even if there is need that can be implemented at cloud. Is there any need for it to ...
2
votes
1answer
246 views
How to use IPsec Transport mode between two gateways
I have read many comparisons of IPsec Transport vs. Tunnel mode, and there is a clear understanding that when two gateways are exchanging routed traffic they should use Tunnel mode. In other words, ...
-1
votes
2answers
712 views
How does Cisco Anyconnect VPN work?
I am looking for a deep down technical explanation of how it works.
My understanding is its an SSL VPN and works as follows:
- Anyconnect creates a TLS session to the configured remote servers, ...
0
votes
1answer
143 views
Differentiating between IKEv2 and OpenVPN Traffic
There is a WiFi network that I regularly use, and it seems to be blocking all VPN traffic other than IKEv2. I tested this by downloading many of the free/freemium VPN apps from the Google Play Store ...
1
vote
1answer
110 views
Is IP address whitelisting useful if the IP address is not “secret”?
I'm working on an application that will have access to API keys supplied by our users. The application makes API calls on behalf of our users.
The API we're using allows users to whitelist IP ...
0
votes
0answers
55 views
Disable SSLv3 in IPSec CentosOS
I have been told to shut down support to SSLV3 - TLS 1.0 - TLS 1.1 to all encrypted communications towards external web services.
Now, I have an IPSec/CentOS gateway in front of my Data Center.How ...
3
votes
1answer
201 views
IPsec Transport Mode NAT Traversal Security Risks
The strongSwan FAQ states:
NAT-Traversal with IPsec transport mode has some inherent security risks.
What kind of security risks is the documentation referring to?
(links to other resources are ...
2
votes
2answers
108 views
Why rekey long-lived connections?
Why is rekeying after a certain period of time, or after a certain volume of data transfer, often implemented in modern secure transport protocols such as ESP or TLS?
What are the security risks of ...
0
votes
0answers
46 views
“Request security” setting for IPSec on Windows hosts does not actually encrypt connections
I am trying to wrap my mind around Windows opportunistic encryption IPSEC policies and am having some trouble understanding the concept of the "Authentication mode" or "Security" setting in IPSEC ...
2
votes
2answers
145 views
What is meant by IPSec is “transparent”
While reading a guide on IPSec, i came across this sentence:
IPSec is transparent to the user and the applications.
Can someone please tell me what is meant by being transparent from security view ...
0
votes
2answers
492 views
IP Security (IPsec) vs Public Key Infrastructure (PKI)
I've found the following question on the internet and don't think the answer is right.
Which of the following does IPsec use?
A) SSL
B) AES
C) DES
D) PKI
The given answer is D, PKI ...
1
vote
0answers
66 views
IPSec and traffic mirroring [closed]
I have a VoIP server on which several SIP clients are connected to through IPSec tunnels.
This is kind of an automated attendant so I both have RTP and SIP signalling flows.
I need to be able to ...
0
votes
0answers
662 views
CHAP vs MS-CHAPv2
I'm setting up an L2TP/IPSec VPN, and I can't find any information about this. MS-CHAPv2 has a known vulnerability that makes cracking it relatively easy. Is CHAP more secure? Does MS-CHAPv2's vuln ...
1
vote
1answer
66 views
How often ciphers are used through an IPSEC session
I’m wondering how often a terminal needs to perform a cryptographic hash (ex: SHA) throughout the lifetime of an IPSEC session where both ends are authenticated using certificates. From what I can ...
0
votes
1answer
82 views
Is ESP without AH considered noncompliant with FIPS 140-2?
I have a CentOS 7.4 box running kernel 3.10 that has the fips=1 parameter defined in the kernel grub statement. If I attempt to add an IPSEC SA with the following command it fails:
ip xfrm state ...
2
votes
1answer
361 views
Question about ipsec prevent SYN flooding attack
how IPSec prevents SYN flooding attacks Like if A is sending packets to B using IPsec. Suppose B’s TCP ack gets lost, and A’s TCP retransmits the packet since it assumes the packet was lost. Will B’s ...
11
votes
3answers
4k views
How you can trust your Router to not steal your private IPSec keys?
I would like to connect to my VPN using IPSec protocol.
For that, I need a router or any other device that support it.
I found this on eBay:
https://www.ebay.com/itm/IPsec-VPN-server-military-secure-...
1
vote
0answers
116 views
What is the Identification Payload of RFC2407 used for in IPsec?
RFC2407 outlines the Identification Payload in section 4.6.2, which appears in the fifth and sixth packets of the Main Mode's SA negotiation when using IKEv1. What is this information used for?
From ...
1
vote
0answers
293 views
How does IKE with PSK really work and how secure is it?
There is many articles that describe some exploitation techniques on a VPN with IPSec - IKE-PSK.
However, I can't understand how the flaws may exist. Thus, I have some question relating to that:
1) ...
3
votes
2answers
758 views
Why do we need IPSec when we can encrypt data at Application layer?
We can Process encryption of data at application layer according to given key. So why do we need to use IPSec for security ?
Lets say I want to send message to other machine over internet. Which one ...
7
votes
2answers
8k views
Diffie Hellman Group Matching to IPSec Encryption Algorithm
I'm looking for help determining acceptable Diffie Hellman (DH) Groups for specific IPSec IKE and ESP Encryption Algorithms. The goal is to choose DH groups that provide adequate protection for the ...
0
votes
1answer
44 views
Behavior of IPSec when receive window gets full [closed]
How does IPSec behave when an incoming package can't be marked received in the receive window without the receive window being moved in such a way that a not-yet received package's spot is pushed out ...
0
votes
1answer
344 views
Known risks with the old IPSEC Cisco VPN client?
I have a couple of customers who still use the old discontinued/obsolete IPSEC based Cisco VPN client.
Obviously it is not a good idea to use software that is no longer supported, but that aside: ...
0
votes
1answer
107 views
What's the point of the second SA exchange in the Create_Child_SA exchange in IPsec
I have problems understanding why you would negotiate crypto-algorithms in the Create_Child_SA request in a IKEv2.
During IKE_SA_INIT you negotiate cryptographic algorithms which I assume (correct me ...
3
votes
2answers
894 views
What encryption/authentication methods to use on our VPN server?
I am in the process of setting up some site-to-site VPN connections between our sites.
Our new VPN servers at each site have numerous encryption/authentication methods and I want to know which are ...
0
votes
1answer
320 views
Is IKE aggressive mode really less secure than main mode?
This guy argues it is not: https://www.youtube.com/watch?v=DuowFgNKAIg
I really confused about this. According to him, the only purpose of main mode is to make the peers anonymous, but in order to ...
1
vote
1answer
501 views
Key exchange during IKE_AUTH phase of IKEv2
This is what a casual IKEv2 handshake looks like :
Initiator Responder
| ...
0
votes
1answer
1k views
IKEv2 and Dead Peer Detection
Some articles and Websites (Wikipedia and Cisco for instance) claim that unlike IKEv1, IKEv2 provides a support for Dead Peer Detection. However, unlike NAT traversal or DoS attacks for example, the ...
1
vote
2answers
421 views
Using IPsec through NAT
I have read that it is recommended to encapsulate IPsec packets into UDP (port 4500) packets in order to circumvent NAT. Could anyone please provide a detailed explanation of the reasons behind this ...
1
vote
0answers
184 views
TLS Proxy vs IPsec (gateway-to-host/gateway-to-gateway) [duplicate]
Given some company xyz willing to secure its communication with the external world, what would motivate an IT security architect to pick one solution over the other (i.e. TLS proxy vs IPsec gateway-to-...
0
votes
0answers
158 views
Is my IPsec VPN and PKI understanding correct?
IPsec
Firstly I read the accepted answer here in In IPsec VPN, how is the pre-shared key encrypted?.
Here's my understanding it bullet points;
The PSK is never shared on the wire
It's only used to ...
1
vote
0answers
97 views
Regarding IKE and IPSEC SA
Can anyone explain why Phase 1 is bidirectional and Phase 2 is unidirectional in IPSEC VPN.
I read in one book that Phase 1 uses shared symmetric key generated by DH and both peers uses same key hence ...
1
vote
0answers
136 views
How to block an IPSEC VPN yet allow a VOIP phone [closed]
How can I block VPN apps on my home network but allow my VOIP phone to continue to work? From what I can tell, the VPN app in question uses IPSEC, but when I block that in the firewall, it prevents ...
0
votes
1answer
958 views
What attacks does IPSec protect against? [closed]
As in the title, what attacks does IPSec protect against?
4
votes
1answer
711 views
What does OAKLEY stand for?
IPsec uses ISAKMP + OAKLEY + SKEME right? This is strange but even after checking the RFC of OAKLEY, i couldnt find what it basically stands for? Can someone please point me to the right direction or ...
0
votes
1answer
173 views
Is it possible to prevent SSL stripping attack via DNSSEC or IPSEC?
I am pondering about SSL Stripping attack. But is there any way to prevent this attack by DNSSEC or IPSEC?
0
votes
1answer
344 views
how to understand openssl
I am studying Openssl , but didn't getting that openssl is a tool/library.what is its main application and how it will be used?
And how this openssl is related to ipsec, i have studied the ipsec ...
1
vote
1answer
506 views
Can IPsec transport mode prevent DPI by your ISP?
It is well known that ISPs use deep packet inspection to deprioritize certain types of network traffic, such as that belonging to filesharing applications. If ISPs achieve this throttling of traffic ...
