Hello Everyone, From my Recent Experiences and studies, I have come across many RFCs and different vendor KB’s that teaches IP SEC tunneling in a very informative way, but I realized that there are some very essential things that are primarily required for us to understand IP SEC for troubleshooting. In this discussion, I have simulated the IP SEC tunnel scenario in a gns3 platform with two firewalls for peering and one firewall that acts as a NAT device Before we start the discussion, why do we require IP SEC ? If we say IP SEC as IP security, why do we have to secure our IP traffic in the first place? Let me explain with a scenario, consider Alice is a Network engineer in an MNC company and the company has multiple offices spanning across the country (consider LOC A, LOC B), Bob being a server administrator has requested Alice to help him access the SMTP server in one of the mentioned locations securely. I know what you guys are thinking of now? Build a dedicated MPLS network from Head office to remote branch offices, As we all know not all routers support MPLS labeling, moreover, using MPLS for accessing a single network is not a scalable solution. Is there a better solution we can think of? Yes, you are absolutely correct, IP SEC would be the best solution for sending the traffic securely to the destination through the internet channel. Why do you think the internet is not secure ? Let us speak about the terms which make the sender believe the traffic is secure if it fulfills the terms. Confidentiality :
Traffic on the internet cross multiple ISP’s to reach the destination, How sure are we that our traffic is not seen by any unauthorized person in transit? So, we need some encryption mechanism to encrypt our network traffic so that any network attacker whose intention is to sniff may have no clue about the traffic without a key to decrypt it. Thanks to Strong encryption Algorithms! Now our traffic is encrypted and hence we achieved confidentiality Integrity :
The network attacker is smart enough here, once he finds the data is unencrypted, what if he changes the data and sends it to the destination considering Alice is the sender sending a message “Hang him not, leave him ”, EVE who is a network attacker was unaware of the message modifies the message and sends the following message to BOB who is the recipient “Hang him, not leave him”. To prevent such malformation of data on the internet, we need some hashing algorithms so that the recipient can do a checksum and find out if the message is malformed or not in between. Authentication :
This mechanism is to notify the peer, ensuring the message is delivered to the right person. Before moving to the troubleshooting part, Let us understand the process in brief IP SEC is moreover a security framework defined to protect Internet traffic, The framework includes three protocols majorly. Going forward, Those are discussed wherever required. Main mode: It consists of 6 Messages in Phase1 and 3 messages in Phase 2, Let us discuss one by one CKY i—-Initiator cookie (Security parameter index of initiator) CKY_r ——Responder cookie (security parameter index of responder) Identification of initiator, ID_r –Identification of responder Ni—Nonce, NR–Nonce, HASH—Hash that hashes entire payload As per IKE, There are two modes of operation Main mode and aggressive mode, we are basically discussing the Main mode here. There are two phases involved in IP SEC. Phase 1 where the SA’s are negotiated to form a secured channel for phase 2 negotiations to happen, Phase 2 where the IP SEC SA’s are negotiated to tunnel the traffic securely. What is SA means?
SA means a security association that is nothing but the parameters like encryption, Authentication, and MAC algorithms that are negotiated between the peers for forming the tunnel each peer consists of a Security Association Database which consists of the above-mentioned information negotiations are based on the remote gateway IPs and Each peer identifies the local security associations uniquely based on an index number called as security parameter index (SPI)
I hope we have covered some basics related to IP SEC, let's get into our scenario and then discuss each parameter in detail from packet capture. Lets Rock!
You must be logged in to post a comment.