IPSEC with PSK

IPSEC with PSK

1. Control Plane

   • Unicast IPv4/IPv6 UDP 500 UDP 4500 if going through NAT
   • Security Association (SA)
     • An agreement of IPSec parameters Mantains encryption and authentication keys on peers
     • ISAKMP/IKE
       • ISAKMP - Internet Security Association Key Management Protocol - Says that authentication and Keying should occur IKE - Internet Key Exchange - Defines how authentication and keying occurs
       • IKEv1
         • IPsec Phase 1
           • IPsec Phase 2
             • IPsec SA/ IPsec transform Set
               • Estabilish the tunnel used to protect the actual data traffic
               • Security Protocol
                 • ESP  - 50 AH - 51 AH doesn't support encryption AH used for OSPFv3 authentication
                 • AH
                   • IP protocol number 51 Data origin Authentication includes IP header Data Integrity
                 • ESP
                   • IP protocol number 50 Just a framework a placeholder you can choose the payload (sha1,AES..etc) Data origin Authentication excludes IP header Data Integrity Data encryption Anti-replay
               • Encapsulation Mode
                 • Tunnel Mode Transport Mode
                 • Tunnel Mode
                   • Adds new IP header Original header & payload authenticated/encrypted with ESP  Typically used between IPsec gateways or host to IPsec gateways
                 • Transport Mode
                   • Orignal IP header retained Payload and Layer 4 header authenticated/encrypted with ESP Typically used in host to host IPsec
               • Encryption
                 • DES 3DES AES
               • Authentication
                 • MD5 SHA SHA-256 SHA-512
               • Proxy identities
                 • - Define what traffic will be protected - Also called proxy ACLs - We estabilish 1 SA per entry on ACL (crypto map) - old style - ACL needs to be a mirror of each other on peers
               • Security Association (SA) Lifetimes
                 • How often should we rekey value can be in time or bits whichever one has the lower value is chosen
                 • Perfect Forward Secrecy (PFS)
                   • Should we renegotiate Diffie-Hellman before we re-key?
           • ISAKMP SA
             • Authenticate end points and build a secure tunnel for further negotiation
             • Authentication Method
               • Pre-shared Key (PSK) X.509 certificates (PKI)
             • Diffie-Hellman group
               • 1 2 or 5 - Groups Method to exchange crypto keys Higher numbers are better, but at expense of CPU
             • Encryption type
               • DES 3DES AES AES-128 AES-256 Higher is more secure
             • Hash Algorithm
               • MD5 SHA1 Guarantee that the packet wasn't changed
       • IKEv2
         • More flexible designs Use PSK on one side but certificates on the other

2. Data Plane

   • Unicast IPv4 / IPv6 ESP 50 ESP over UDP 4500 if going through NAT AH 51
   • Security Parameter Index (SPI)
     • Field in packet header to select  SA on receiver Analagous on to vlan header or MPLS label

3. Authentication

   • Hash
     • MD5

4. Data Integrity

5. Confidentiality

   • Encryption
   • Synmetric
     • 3DES
       • PKI Pre-shared Key
     • AES

6. Anti Replay