Questions tagged [ipsec]

Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPsec also includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to be used during the session.

Filter by
Sorted by
Tagged with
2 votes
2 answers
2k views

How does IPsec turn KEYMAT into Encryption and Authentication Keys?

IPsec is a framework protocol that consists of the sub-protocols ESP and AH. IPsec, inately, doesn't include a Key Exchange mechanism, and is therefore dependent on manually setting Keys (archaic), ...
9 votes
4 answers
30k views

Diffie Hellman Group Matching to IPSec Encryption Algorithm

I'm looking for help determining acceptable Diffie Hellman (DH) Groups for specific IPSec IKE and ESP Encryption Algorithms. The goal is to choose DH groups that provide adequate protection for the ...
0 votes
1 answer
435 views

StrongSwan, IPsec remote certs and cert_policy

I'm looking for a way to limit the certs that my IPsec can accept. I'm using StrongSwan (swanctl version 5.7), I want to accept only certs coming from a remote with a name of yoji.*.example.com I ...
2 votes
2 answers
152 views

TCP Traffic, SSL or extra Tunnel

I have a situation where we (as a SaaS vendor) are migrating one of our clients away from their local premise to our public SaaS. However as a security concern they want to route all their TCP ...
2 votes
1 answer
281 views

IKEv2 Using Different PSKs

We're setting up some new tunnels and have been told to use IKEv2. I understand that IKEv2 allows different authentication methods, e.g. one side using PSK and the other using a certificate. We don't ...
0 votes
1 answer
642 views

Differentiating between IKEv2 and OpenVPN Traffic

There is a WiFi network that I regularly use, and it seems to be blocking all VPN traffic other than IKEv2. I tested this by downloading many of the free/freemium VPN apps from the Google Play Store ...
0 votes
0 answers
63 views

In IPSec, what block cipher mode of operation is "AES-256"?

Multiple IPSec implementations I've run across support "AES-256" as an encryption algorithm. (pfSense has this, Checkpoint has this.) What block cipher mode of operation is this?
2 votes
3 answers
5k views

IPSec VPNs and symmetric keys

When dealing with IPSec based VPNs, I understand that there is a slight "problem" with symmetric key exchange. Obviously, you can't send the keys over the VPN, since they are used to guarantee the ...
0 votes
1 answer
150 views

PKI or Digitally signed certificate

Please do mind, its a long read. I just confused myself again with how the CA server helps with the digital signature and the pki working flow. Please let me know if what I am describing below is the ...
0 votes
0 answers
152 views

Comparing Wireguard to IPsec: Is Wireguard working like transport- or tunnel-mode?

I'm deeper into different VPN technologies for university and wondering, how Wireguard is handling the IP-packets (header and payload) compared to IPsec's tunnel and transport mode. May someone ...
0 votes
1 answer
211 views

Where should private key(s) reside in IPsec VPN tunnel

I setup an IKE VPN server for road warriors. I actually have this working (YAY!) but took some shortcuts that are leaving me with a working yet not-right/secure setup. My setup is as follows: My ...
4 votes
2 answers
2k views

Why do we need IPSec when we can encrypt data at Application layer?

We can Process encryption of data at application layer according to given key. So why do we need to use IPSec for security ? Lets say I want to send message to other machine over internet. Which one ...
0 votes
1 answer
96 views

Trying to understand transport-mode IPSec and VPNs

Disclaimer: My understanding of the types of VPNs and IPSec is limited. What I am struggling to understand is the fact that the IP header is not encrypted in transport-mode IPSec. My understanding of ...
8 votes
1 answer
661 views

IPSec Host-to-Host VPN (RedHat) needs IP Forwarding?

We would like to build a Host-to-Host IPSec VPN (both RedHat Linux). Is it really mandatory to activate IP Forwarding which is by default deactivated because of our security policy (/etc/sysctl.conf ...
0 votes
1 answer
160 views

What's the significance of including port number in IPsec ESP mode?

In the AH mode for IPsec, we include the IP header to ensure data origin authentication, and in the ESP, we exclude the IP header. what are the security properties we lose by not authenticating the ...
0 votes
1 answer
730 views

How does VPN software work?

I have seen cases where people install a VPN app on their phones to circumvent governments which bar access to certain websites (I have heard China is an example of this). I am curious how these apps ...
11 votes
1 answer
6k views

How secure is L2TP+IPSEC?

I understand PPTP is widely used still, but insecure. A convenient alternative is: L2TP+IPSEC. How secure is it? What steps in the server setup can I take to maintain a high degree of compatibility ...
1 vote
0 answers
136 views

IPSec MTU DDos attack

I have this configuration: HOST-A <---> GAT-A <---> MiTM <---> GAT-B <---> HOST-B I'm doing a security project on MTU-IPsec vulnerabilities and following this guide of Hal-...
0 votes
1 answer
210 views

Should users have access to the IPsec pre-shared key?

We are in the process of switching from Hamachi to Meraki VPN by Cisco. Hamachi was managed internally, but this new VPN solution is managed by an external party and they have set it up as L2TP/IPsec ...
1 vote
1 answer
793 views

Ipsec: Is it possible to use both pre-shared keys and pubkeys auth methods at the same time?

So if we have a server configuration with local auth pubkeys and remove psk and at the same time for a client(initiator) a local auth psk and remote pubkey. Something like this. Server - local { ...
0 votes
1 answer
234 views

Is IPsec VPN still necessary when already using HTTPS protocol? [duplicate]

There are 2 sets of API each hosted in 2 different organisations: my client's organisation and her partner's organisation. The servers from the 2 organisations communicate between each other through ...
1 vote
1 answer
2k views

Windows 10 IPSec VPN not respecting configured parameters (notably: encryption method)

I am currently trying to establish a VPN connection from my Windows 10 Enterprise 1909 to a remote VPN gateway, using the built-in Windows VPN / IPSec client. Since the UI does not provide all options ...
1 vote
1 answer
133 views

ikev2 handshake : 4 or 8 packets? [closed]

I open wireshark to inspect the ikev2 handhsake and noticed it is 8 packets instead of 4. Two groups of 4 packets, one originating from the first peer and the other from the second peer. Is it normal ?...
25 votes
1 answer
4k views

How credible are the rumors that the NSA has compromised IPSec? [closed]

Part of the Snowden revelations was that the NSA had targeted IPSec. But I'm having trouble separating FUD from legitimate issues. How credible is this? Are there ways to use IPSec to be confident ...
2 votes
1 answer
256 views

Why does IKE have two phases?

Why does have IKE have two phases, two levels of security associations, two sets of authentication and encryption algorithms, two sets of options around lifetimes and renogiations? It seems ...
0 votes
0 answers
102 views

Can I use IPSec for anonymous browsing (like in commercial proxies)?

In class, we learned how to set up a VPN between two remote sites using IPSec in tunnel mode. I have a VPS for hosting my website (with root access), but if I set up a tunnel between my PC and the VPS,...
0 votes
2 answers
198 views

What does it mean that Ikev1 (IPSec) protects peer identities in main mode?

Does it mean that the source IP is replaced with something else (like if in IP spoofing) so intermediate routers don't know who is sending the packet?
1 vote
3 answers
3k views

IP Security (IPsec) vs Public Key Infrastructure (PKI)

I've found the following question on the internet and don't think the answer is right. Which of the following does IPsec use? A) SSL B) AES C) DES D) PKI The given answer is D, PKI ...
2 votes
2 answers
834 views

Certificates(CA certificate and EE/Local certiificate)

There is a small confusion related to CA certificate and Local certificate. I had asked a similar question before. This time, its a little specific. For authentication using PKI, below are the steps. -...
6 votes
1 answer
19k views

Difference between IPSEC SA and CHILD SA

Let us consider two network entities. Linux1 (eth0)=============IPSEC=============Linux2(eth0) 192.168.1.1 192.168.1.2 The IPSEC Tunnel is V4 ...
0 votes
1 answer
876 views

Why do IPSec VPN Phases have a lifetime?

I was working on a bug with our VPN, and read about VPN Phases 1 and 2, each of which have a lifetime in seconds. I was investigating to validate if these had anything to do with the bug we had and ...
6 votes
2 answers
10k views

Performance comparison between AES256 GCM vs AES 256 SHA 256

I understand GCM Crypto uses ESP Encryption only for ESP and Authentication algorithm. whereas AES 256 SHA256 uses AES for ESP Encrypt and SHA256 for Auth algorithm. Could someone help clarify the ...
0 votes
2 answers
720 views

What is the real risk of clicking a link? [closed]

If I were to click a link on any of my devices, be it over text message, email, or from a webpage, and enter no information/actions with the target page. What is the worst that could happen?
2 votes
1 answer
320 views

How does IKEv2 work on Android without raw sockets

I was exploring the IKEv2 StrongSwan client implementation for Android. What I fail to understand is that Android and Java do not support raw sockets, whilst the IKEv2/IPSec works below the transport ...
0 votes
1 answer
220 views

Is PFS recommended by the NCSC in the PRIME profile for IPsec

Guidance on the PRIME profile for IPsec (https://www.ncsc.gov.uk/guidance/using-ipsec-protect-data) does not explicitly mention the use of PFS. Is there a recommendation for its use in the Prime ...
0 votes
1 answer
552 views

CA certificate and Local certificate

There is something which is bothering me when i think about the CA cert and Local cert. Below are my queries which pertains to juniper but may be generic as well. 1) "request security pki ca-...
0 votes
1 answer
95 views

What are the changes in PKI when i move from TLS protocol to IPSec Protocol?

Currently i am using TLS protocol for a secure communication between my server and client. I use PKI for key/certificate Management. If i want to switch to IPsec for secure communication, how will the ...
2 votes
2 answers
2k views

Using IPsec through NAT

I have read that it is recommended to encapsulate IPsec packets into UDP (port 4500) packets in order to circumvent NAT. Could anyone please provide a detailed explanation of the reasons behind this ...
0 votes
2 answers
1k views

Is IKE aggressive mode really less secure than main mode?

This guy argues it is not: https://www.youtube.com/watch?v=DuowFgNKAIg I really confused about this. According to him, the only purpose of main mode is to make the peers anonymous, but in order to ...
-4 votes
1 answer
1k views

Which VPN offers more security conceptually, SSL VPN or L2TP/IPSEC?

Aside from possible implementation bugs, which VPN concept aims to offer more protection by design? SSL VPN (implementation example - OpenVPN) L2TP/IPSEC (implementation example - Strong Swan) After ...
7 votes
3 answers
56k views

authenticity, confidentiality & integrity - general questions

I am pretty new when it comes to information security. And before I move on with more specific things I wanted to ask if I understood the three main parts of IPsec correctly: authenticity, ...
69 votes
8 answers
138k views

What is the difference in security between a VPN- and a SSL-connection?

I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
1 vote
1 answer
1k views

Why doesn't IKEv2 use L2TP?

My guess is that with IPSec/IKEv1, since it doesn't support NAT, you either have to manually configure routes from your machine, or use a layer 2 tunnel (such as l2tp) to talk with devices on the ...
0 votes
1 answer
468 views

authby=secret serve as alternative to AH in ipsec.conf

I have employed strongSwan U5.5.1 for installing an IPsec tunnel between two Debian hosts with a firewall in between. My ipsec.conf specifies authby=secret but not ah=. The firewall currently permits ...
5 votes
6 answers
35k views

Why Use IPSEC AH vs ESP?

I am refreshing my understanding of IPSEC. IPSec is an IETF defined set of security services that use open standards to provide data confidentiality, integrity, and authentication between peers. ...
1 vote
0 answers
33 views

Could IPSec flows be decrypted using PSK [duplicate]

I created an IPSec tunnel between two VMs using StrongSwan. It relies on a Pre-Shared Key. I wonder, if this key is leaked, what could an attacker perform? Would he/she be able to decrypt previous ...
1 vote
0 answers
460 views

What is the Identification Payload of RFC2407 used for in IPsec?

RFC2407 outlines the Identification Payload in section 4.6.2, which appears in the fifth and sixth packets of the Main Mode's SA negotiation when using IKEv1. What is this information used for? From ...
2 votes
1 answer
201 views

IPsec installed algorithms

What happens if a laptop and a server don't have a encryption algorithm in common? Does IPSec abort the connection or does it always have default algorithms?
0 votes
0 answers
140 views

IP Encryptor and Firewall

Firewalls implement IPsec VPN and perform packet filtering. IP Encryptor, on the other hand implements IPsec VPN and achieve security goals (confidentiality, integrity and authentication). What are ...
1 vote
1 answer
389 views

Is a security association (SA) implemented in ESP and AH protocols?

I'm reading about security associations. I've understood that a SA is a virtual connection between a client and a sever, in which all the security parameters, such as encryption algorithm, IP origin ...

1
2 3 4 5