U5.8 IPSEC

U5.8 IPSEC

1. Most implemented VPN protocol

   • Implemented at Network layer
     • Provides all common goals of a secure channel
     • Means all traffic at the internet layer is protected with IPSEC
       • At network level end to end protection, and application independent protection

2. Built into operating systems and gateway technologies

3. 2 different protocols

   • AH - Authentication Header
     • Authentication
       • Enables origin of messages to be authenticated
       • Vital for avoiding spoof communicatons
     • Data Integrity
     • anti replay detection
   • ESP - Encapsulating security payload
     • Also provides auth, data integ, anto replay detect
     • Also Confidentiality
       • Limitied traffic flow confidentiality
   • The 2 protocols can be used independently but if used together
     • Authentication provided for origin of message
     • And Confidentiality provided

4. 2 Modes

   • Tunnel mode
     • All traffic between 2 gateways
       • Endpoints are unaware of the VPN
       • Gateways need to construct the secure channel
       • Enables security management to be conducted from a single point, reduces conflict with any other security policies
     • Confidentiality applied to datagram as whole (including payload plus source info)
       • Entire packet encapsulated within IPSEC
   • Transport mode
     • For each datagram between 2 IPSEC enabled hosts
       • Hosts must be IPSEC capable
         • Hosts must agree to use IPSEC for particular comms
     • just payload is encrypted excluding header info
     • Disadvantages of transport mode
       • Encrypted comms will bypass security controls on gateways
         • Little means of checking of sensitive information is being disclosed outside the organisation
       • However if the sender is on the internet outside a protected NW then using transport mode would mask comms from any gateways
       • Each host must be configured to use IPSEC
         • Correct policy must be configured
     • Any intermediate gateways just pass on the traffic
       • end points do the IPSEC Processing
         • Advantage in not adding the load of provcessing onto the gateways