Questions tagged [ipsec]
Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPsec also includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to be used during the session.
205
questions
1
vote
0answers
32 views
Why does ipsec create a new connection? [migrated]
I have two gateways, I start IPSec in both via ipsec start --nofork in gw2 first (but the same problem happens if I start IPSec on gw1 first)
However, about 10 seconds after the ike SA is done, the ...
1
vote
1answer
35 views
ikev2 handshake : 4 or 8 packets?
I open wireshark to inspect the ikev2 handhsake and noticed it is 8 packets instead of 4. Two groups of 4 packets, one originating from the first peer and the other from the second peer. Is it normal ?...
2
votes
1answer
46 views
Why does IKE have two phases?
Why does have IKE have two phases, two levels of security associations, two sets of authentication and encryption algorithms, two sets of options around lifetimes and renogiations?
It seems ...
24
votes
1answer
4k views
How credible are the rumors that the NSA has compromised IPSec? [closed]
Part of the Snowden revelations was that the NSA had targeted IPSec.
But I'm having trouble separating FUD from legitimate issues.
How credible is this? Are there ways to use IPSec to be confident ...
0
votes
0answers
35 views
Can I use IPSec for anonymous browsing (like in commercial proxies)?
In class, we learned how to set up a VPN between two remote sites using IPSec in tunnel mode. I have a VPS for hosting my website (with root access), but if I set up a tunnel between my PC and the VPS,...
0
votes
2answers
58 views
What does it mean that Ikev1 (IPSec) protects peer identities in main mode?
Does it mean that the source IP is replaced with something else (like if in IP spoofing) so intermediate routers don't know who is sending the packet?
2
votes
2answers
156 views
Certificates(CA certificate and EE/Local certiificate)
There is a small confusion related to CA certificate and Local certificate. I had asked a similar question before. This time, its a little specific.
For authentication using PKI, below are the steps.
-...
1
vote
1answer
208 views
Windows 10 IPSec VPN not respecting configured parameters (notably: encryption method)
I am currently trying to establish a VPN connection from my Windows 10 Enterprise 1909 to a remote VPN gateway, using the built-in Windows VPN / IPSec client. Since the UI does not provide all options ...
0
votes
1answer
55 views
Why do IPSec VPN Phases have a lifetime?
I was working on a bug with our VPN, and read about VPN Phases 1 and 2, each of which have a lifetime in seconds. I was investigating to validate if these had anything to do with the bug we had and ...
3
votes
2answers
1k views
Performance comparison between AES256 GCM vs AES 256 SHA 256
I understand GCM Crypto uses ESP Encryption only for ESP and Authentication algorithm.
whereas AES 256 SHA256 uses AES for ESP Encrypt and SHA256 for Auth algorithm.
Could someone help clarify the ...
-1
votes
2answers
163 views
What is the real risk of clicking a link? [closed]
If I were to click a link on any of my devices, be it over text message, email, or from a webpage, and enter no information/actions with the target page. What is the worst that could happen?
2
votes
1answer
98 views
How does IKEv2 work on Android without raw sockets
I was exploring the IKEv2 StrongSwan client implementation for Android. What I fail to understand is that Android and Java do not support raw sockets, whilst the IKEv2/IPSec works below the transport ...
0
votes
1answer
86 views
Is PFS recommended by the NCSC in the PRIME profile for IPsec
Guidance on the PRIME profile for IPsec (https://www.ncsc.gov.uk/guidance/using-ipsec-protect-data) does not explicitly mention the use of PFS.
Is there a recommendation for its use in the Prime ...
0
votes
1answer
155 views
StrongSwan, IPsec remote certs and cert_policy
I'm looking for a way to limit the certs that my IPsec can accept. I'm using StrongSwan (swanctl version 5.7), I want to accept only certs coming from a remote with a name of yoji.*.example.com
I ...
0
votes
1answer
163 views
CA certificate and Local certificate
There is something which is bothering me when i think about the CA cert and Local cert.
Below are my queries which pertains to juniper but may be generic as well.
1) "request security pki ca-...
0
votes
1answer
55 views
What are the changes in PKI when i move from TLS protocol to IPSec Protocol?
Currently i am using TLS protocol for a secure communication between my server and client. I use PKI for key/certificate Management. If i want to switch to IPsec for secure communication, how will the ...
-4
votes
1answer
422 views
Which VPN offers more security conceptually, SSL VPN or L2TP/IPSEC?
Aside from possible implementation bugs, which VPN concept aims to offer more protection by design?
SSL VPN (implementation example - OpenVPN)
L2TP/IPSEC (implementation example - Strong Swan)
After ...
2
votes
1answer
124 views
IKEv2 Using Different PSKs
We're setting up some new tunnels and have been told to use IKEv2. I understand that IKEv2 allows different authentication methods, e.g. one side using PSK and the other using a certificate. We don't ...
0
votes
1answer
97 views
authby=secret serve as alternative to AH in ipsec.conf
I have employed strongSwan U5.5.1 for installing an IPsec tunnel between two Debian hosts with a firewall in between. My ipsec.conf specifies authby=secret but not ah=. The firewall currently permits ...
1
vote
0answers
26 views
Could IPSec flows be decrypted using PSK [duplicate]
I created an IPSec tunnel between two VMs using StrongSwan. It relies on a Pre-Shared Key. I wonder, if this key is leaked, what could an attacker perform?
Would he/she be able to decrypt previous ...
2
votes
1answer
97 views
IPsec installed algorithms
What happens if a laptop and a server don't have a encryption algorithm in common?
Does IPSec abort the connection or does it always have default algorithms?
0
votes
1answer
474 views
Ipsec: Is it possible to use both pre-shared keys and pubkeys auth methods at the same time?
So if we have a server configuration with local auth pubkeys and remove psk and at the same time for a client(initiator) a local auth psk and remote pubkey.
Something like this.
Server -
local {
...
0
votes
0answers
83 views
IP Encryptor and Firewall
Firewalls implement IPsec VPN and perform packet filtering. IP Encryptor, on the other hand implements IPsec VPN and achieve security goals (confidentiality, integrity and authentication).
What are ...
2
votes
2answers
76 views
TCP Traffic, SSL or extra Tunnel
I have a situation where we (as a SaaS vendor) are migrating one of our clients away from their local premise to our public SaaS.
However as a security concern they want to route all their TCP ...
1
vote
1answer
147 views
Is a security association (SA) implemented in ESP and AH protocols?
I'm reading about security associations. I've understood that a SA is a virtual connection between a client and a sever, in which all the security parameters, such as encryption algorithm, IP origin ...
2
votes
1answer
655 views
How hard is it to retrieve IKEv2 Server Certificate from the server?
I got access to a VPN via IPsec and IKEv2. The provider gave me a username, a shared secret and a server certificate. Since the certificate was self-signed, the manual came with specific instructions ...
0
votes
0answers
115 views
IPSec Sniff Traffic
I'm wondering if it is possible to Sniff IPSec connections.
At the beginning of a connection, the two peers agree on a SA and exchange a PSK or Certificates.
What I'm thinking about, is to ...
1
vote
2answers
85 views
Where would I go to use a reliably secure encrypted internet connection?
Lately, I’ve been paying $100 a month for Fios. I’m thinking of canceling this service because I rarely use my internet at home, since I’m at school most of the time and my college offers internet (...
2
votes
2answers
400 views
Maximum number of certificates generated by a CA
What is the maximum number of certificates that can be generated from a CA?
The use case is a VPN using certificate authentication and I would like to know what is the theoretical number of unique ...
0
votes
1answer
185 views
IKE Phase 1 /w PSK resource?
I can't seem to find a sufficiently detailed resource that describes the IKE phase 1 PSK identity authentication process. They seem to focus on differences between aggressive and main mode while ...
0
votes
1answer
73 views
IPsec down with unusual SNMP traffic [closed]
Time to time IPSec tunnel status become down, with unusual SNMP Traffic. when I disable and enable port manually, it become normal.
I am using 200E fortigate firewall.
Have you any idea or previous ...
2
votes
1answer
92 views
IPsec with PSK: Can PSK be used for passive eavesdroping?
I use a PSK to connect to an IPsec VPN.
Let's say an attacker can gain access to my PSK.
He can then impersonate me, that much is clear.
But would she also be able to decrypt intercepted traffic? ...
4
votes
2answers
139 views
IPSEC connection attempt to rogue server — is my PSK compromised?
I am setting up an IPSec connection between two sites using Ubiquiti EdgeOS-based equipment. Using a DDNS service (a static IP is unavailable from the ISP), they can be found at east.example.net and ...
0
votes
1answer
7k views
Which PFS Group is recommended for IPSec configuration?
I can't find much information on PFS (Perfect Forward Secrecy) Groups so I'm unsure what to suggest for a secure IPSec configuration.
Any suggestions on PFS groups that aren't recommended?
What is ...
0
votes
1answer
274 views
What alternatives to IPSec for diversifyed redundancy?
I need to provide redundancy to an IPSec link between two premises. I would like to have no single point of failure and to diversify technologies. What could I use please?
Are the following leads ...
1
vote
1answer
675 views
Please explain the vulnerability for the pre-shared Key for IKEv1 brute force IPSec
After the vulnerability was released for IPSec IKEv1 PSKs, our organization decided to increase the size and complexity of the PSK.
However, upon releasing the new PSK we had a few issues:
...
1
vote
1answer
772 views
Why doesn't IKEv2 use L2TP?
My guess is that with IPSec/IKEv1, since it doesn't support NAT, you either have to manually configure routes from your machine, or use a layer 2 tunnel (such as l2tp) to talk with devices on the ...
1
vote
2answers
92 views
Do I need Gateway Firewall for IoT network? [closed]
Do I need a gateway firewall to prevent attacks like DoS, if my IoT network can only talk to cloud using IPsec?
Even if there is need that can be implemented at cloud. Is there any need for it to ...
2
votes
1answer
666 views
How to use IPsec Transport mode between two gateways
I have read many comparisons of IPsec Transport vs. Tunnel mode, and there is a clear understanding that when two gateways are exchanging routed traffic they should use Tunnel mode. In other words, ...
0
votes
2answers
9k views
How does Cisco Anyconnect VPN work?
I am looking for a deep down technical explanation of how it works.
My understanding is its an SSL VPN and works as follows:
- Anyconnect creates a TLS session to the configured remote servers, ...
0
votes
1answer
473 views
Differentiating between IKEv2 and OpenVPN Traffic
There is a WiFi network that I regularly use, and it seems to be blocking all VPN traffic other than IKEv2. I tested this by downloading many of the free/freemium VPN apps from the Google Play Store ...
2
votes
1answer
374 views
Is IP address whitelisting useful if the IP address is not “secret”?
I'm working on an application that will have access to API keys supplied by our users. The application makes API calls on behalf of our users.
The API we're using allows users to whitelist IP ...
0
votes
0answers
111 views
Disable SSLv3 in IPSec CentosOS
I have been told to shut down support to SSLV3 - TLS 1.0 - TLS 1.1 to all encrypted communications towards external web services.
Now, I have an IPSec/CentOS gateway in front of my Data Center.How ...
3
votes
1answer
615 views
IPsec Transport Mode NAT Traversal Security Risks
The strongSwan FAQ states:
NAT-Traversal with IPsec transport mode has some inherent security risks.
What kind of security risks is the documentation referring to?
(links to other resources are ...
2
votes
2answers
352 views
Why rekey long-lived connections?
Why is rekeying after a certain period of time, or after a certain volume of data transfer, often implemented in modern secure transport protocols such as ESP or TLS?
What are the security risks of ...
2
votes
2answers
471 views
What is meant by IPSec is “transparent”
While reading a guide on IPSec, i came across this sentence:
IPSec is transparent to the user and the applications.
Can someone please tell me what is meant by being transparent from security view ...
0
votes
3answers
2k views
IP Security (IPsec) vs Public Key Infrastructure (PKI)
I've found the following question on the internet and don't think the answer is right.
Which of the following does IPsec use?
A) SSL
B) AES
C) DES
D) PKI
The given answer is D, PKI ...
1
vote
0answers
80 views
IPSec and traffic mirroring [closed]
I have a VoIP server on which several SIP clients are connected to through IPSec tunnels.
This is kind of an automated attendant so I both have RTP and SIP signalling flows.
I need to be able to ...
0
votes
0answers
2k views
CHAP vs MS-CHAPv2
I'm setting up an L2TP/IPSec VPN, and I can't find any information about this. MS-CHAPv2 has a known vulnerability that makes cracking it relatively easy. Is CHAP more secure? Does MS-CHAPv2's vuln ...
1
vote
1answer
112 views
How often ciphers are used through an IPSEC session
I’m wondering how often a terminal needs to perform a cryptographic hash (ex: SHA) throughout the lifetime of an IPSEC session where both ends are authenticated using certificates. From what I can ...
