Questions tagged [ipsec]

Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPsec also includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to be used during the session.

23 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
1answer
489 views

IPSec Host-to-Host VPN (RedHat) needs IP Forwarding?

We would like to build a Host-to-Host IPSec VPN (both RedHat Linux). Is it really mandatory to activate IP Forwarding which is by default deactivated because of our security policy (/etc/sysctl.conf ...
3
votes
0answers
894 views

How do i know when IPSEC Phase 2 Has completed with Openswan?

When I bring up a connection using openswan I get the following output but I don't see any ESP traffic through ports 50, 500 or 4500. # ipsec auto --up globacom-vpn 104 "globacom-vpn" #44: ...
2
votes
1answer
62 views

IKEv2 Using Different PSKs

We're setting up some new tunnels and have been told to use IKEv2. I understand that IKEv2 allows different authentication methods, e.g. one side using PSK and the other using a certificate. We don't ...
2
votes
0answers
158 views

Manual IPsec and session key(s)

I am evaluating IPsec. I have determined it is best for my case to not use AH (will use PSK for authentication). One issue I have is that at the start there will be no connectivity, so IKE will not ...
2
votes
0answers
64 views

Possibility of widespread deployment of IPsec

I want to know if IPsec is a candidate for a widespread deployment in the Internet. So far IPsec seems to be adopted merely in VPN networks. IPsec seems to have problems with NAT-traversal and another ...
1
vote
0answers
206 views

What is the Identification Payload of RFC2407 used for in IPsec?

RFC2407 outlines the Identification Payload in section 4.6.2, which appears in the fifth and sixth packets of the Main Mode's SA negotiation when using IKEv1. What is this information used for? From ...
1
vote
0answers
507 views

How does IKE with PSK really work and how secure is it?

There is many articles that describe some exploitation techniques on a VPN with IPSec - IKE-PSK. However, I can't understand how the flaws may exist. Thus, I have some question relating to that: 1) ...
1
vote
0answers
130 views

Regarding IKE and IPSEC SA

Can anyone explain why Phase 1 is bidirectional and Phase 2 is unidirectional in IPSEC VPN. I read in one book that Phase 1 uses shared symmetric key generated by DH and both peers uses same key hence ...
1
vote
0answers
4k views

IPSec - Configuration best practices, performance, and realistic tradeoffs for my chosen Ciphers

I understand the term "best" is subjective but I would like to try to keep this discussion as objective as possible and get the opinion of other security professionals for my chosen cipher suite ...
1
vote
0answers
59 views

IPSEC is Creating Multiple SAD's at rekeying in phase2

I am trying to create a tunnel between two peers with ipsec.while establishing the tunnel at first time, the number of sad(inbound & outbound) entries are as per number of peers. Once after ...
1
vote
0answers
182 views

When would IPSec sequence numbers be ignored?

Under what circumstances and why are IPSec sequences ignored by the recipient? The only reason I can think of anyone wishing to ignore sequence numbers and therefore not use anti-replay protection ...
1
vote
0answers
73 views

Ipsec connection fails

I have two system with fedora12 installed Host1 IP address - 10.1.0.1 Host2 IP address - 10.1.0.2 Then configured IPsec in both machines as below Host 1 config (/etc/ipsec-tools.conf) #Host 1 /etc/...
0
votes
1answer
25 views

What are the changes in PKI when i move from TLS protocol to IPSec Protocol?

Currently i am using TLS protocol for a secure communication between my server and client. I use PKI for key/certificate Management. If i want to switch to IPsec for secure communication, how will the ...
0
votes
0answers
60 views

“ip xfrm state deleteall” vs “ip xfrm state flush” commands

Please explain the purpose of the following commands and differences between them. ip xfrm state deleteall ip xfrm state flush According to the man page : ip xfrm state deleteall - delete all ...
0
votes
0answers
19 views

how ipsec differentiates between re-transmitted tcp segment and malicious one?

How Ipsec protocol differentiates between re-transmitted TCP segment (which is re-transmitted because the sender didnt get the ACK last time) and a malicious one?
0
votes
1answer
210 views

Ipsec: Is it possible to use both pre-shared keys and pubkeys auth methods at the same time?

So if we have a server configuration with local auth pubkeys and remove psk and at the same time for a client(initiator) a local auth psk and remote pubkey. Something like this. Server - local { ...
0
votes
0answers
72 views

IP Encryptor and Firewall

Firewalls implement IPsec VPN and perform packet filtering. IP Encryptor, on the other hand implements IPsec VPN and achieve security goals (confidentiality, integrity and authentication). What are ...
0
votes
0answers
90 views

IPSec Sniff Traffic

I'm wondering if it is possible to Sniff IPSec connections. At the beginning of a connection, the two peers agree on a SA and exchange a PSK or Certificates. What I'm thinking about, is to ...
0
votes
1answer
370 views

Differentiating between IKEv2 and OpenVPN Traffic

There is a WiFi network that I regularly use, and it seems to be blocking all VPN traffic other than IKEv2. I tested this by downloading many of the free/freemium VPN apps from the Google Play Store ...
0
votes
0answers
95 views

Disable SSLv3 in IPSec CentosOS

I have been told to shut down support to SSLV3 - TLS 1.0 - TLS 1.1 to all encrypted communications towards external web services. Now, I have an IPSec/CentOS gateway in front of my Data Center.How ...
0
votes
0answers
1k views

CHAP vs MS-CHAPv2

I'm setting up an L2TP/IPSec VPN, and I can't find any information about this. MS-CHAPv2 has a known vulnerability that makes cracking it relatively easy. Is CHAP more secure? Does MS-CHAPv2's vuln ...
0
votes
1answer
524 views

How does VPN software work?

I have seen cases where people install a VPN app on their phones to circumvent governments which bar access to certain websites (I have heard China is an example of this). I am curious how these apps ...
-4
votes
1answer
117 views

Which VPN offers more security conceptually, SSL VPN or L2TP/IPSEC?

Aside from possible implementation bugs, which VPN concept aims to offer more protection by design? SSL VPN (implementation example - OpenVPN) L2TP/IPSEC (implementation example - Strong Swan) After ...