ilab 2 - IPSec with IKEv2 and Strongswan Lukas Grillmayer and Linus Lotz Chair for Network Architectures and Services Department for Computer Science Technische Universit¨ at M¨ unchen June 4, 2014 Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 1
Motivation Imagine you are a huge search engine company you recently found out that some government agancy has the audacity to sniff in your network “F*** these guys.” - a engineer from a huge search engine company Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 2
Motivation Imagine you are a huge search engine company you recently found out that some government agancy has the audacity to sniff in your network “F*** these guys.” - a engineer from a huge search engine company Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 2
Motivation Imagine you are a huge search engine company you recently found out that some government agancy has the audacity to sniff in your network “F*** these guys.” - a engineer from a huge search engine company Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 2
Situation We have several locations that need to be connected We have some users who need to access our network from outside ⇒ What we need is a VPN = Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 3
Situation We have several locations that need to be connected We have some users who need to access our network from outside ⇒ What we need is a VPN = Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 3
Situation We have several locations that need to be connected We have some users who need to access our network from outside ⇒ What we need is a VPN = Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 3
Outline Motivation 1 Outline 2 IPSec 3 AH ESP IKEv2 Summary 4 Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 4
Outline Motivation 1 Outline 2 IPSec 3 AH ESP IKEv2 Summary 4 Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 4
Outline Motivation 1 Outline 2 IPSec 3 AH ESP IKEv2 Summary 4 Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 4
Outline Motivation 1 Outline 2 IPSec 3 AH ESP IKEv2 Summary 4 Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 4
IPSec - What is it good for? For encrypting data between two parties Consists of a number of different protocols 1 AH 2 ESP 3 ISAKMP 4 IKE(v2) A lot of RFCs about IPSec: 2403,2404,2405,2410,2451,2857,3526,3686,3947,3948,4106,4301, 4302,4303,4304,4307,4308,4309,4543,4555,4806,4835,5945,5996 Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 5
IPSec - What is it good for? For encrypting data between two parties Consists of a number of different protocols 1 AH 2 ESP 3 ISAKMP 4 IKE(v2) A lot of RFCs about IPSec: 2403,2404,2405,2410,2451,2857,3526,3686,3947,3948,4106,4301, 4302,4303,4304,4307,4308,4309,4543,4555,4806,4835,5945,5996 Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 5
IPSec - What is it good for? For encrypting data between two parties Consists of a number of different protocols 1 AH 2 ESP 3 ISAKMP 4 IKE(v2) A lot of RFCs about IPSec: 2403,2404,2405,2410,2451,2857,3526,3686,3947,3948,4106,4301, 4302,4303,4304,4307,4308,4309,4543,4555,4806,4835,5945,5996 Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 5
IPSec - What is it good for? For encrypting data between two parties Consists of a number of different protocols 1 AH 2 ESP 3 ISAKMP 4 IKE(v2) A lot of RFCs about IPSec: 2403,2404,2405,2410,2451,2857,3526,3686,3947,3948,4106,4301, 4302,4303,4304,4307,4308,4309,4543,4555,4806,4835,5945,5996 Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 5
IPSec - What is it good for? For encrypting data between two parties Consists of a number of different protocols 1 AH 2 ESP 3 ISAKMP 4 IKE(v2) A lot of RFCs about IPSec: 2403,2404,2405,2410,2451,2857,3526,3686,3947,3948,4106,4301, 4302,4303,4304,4307,4308,4309,4543,4555,4806,4835,5945,5996 Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 5
Tunnel and Transport Mode Tunnelmode: Transportmode: Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 6
AH - Authentication Header - RFC 4302 Operates on top of IP Authentication and Integrity Protection Protects from replay attacks Protects the IP header and it’s payload No encryption! Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 7
AH - Authentication Header - RFC 4302 Operates on top of IP Authentication and Integrity Protection Protects from replay attacks Protects the IP header and it’s payload No encryption! Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 7
AH - Authentication Header - RFC 4302 Operates on top of IP Authentication and Integrity Protection Protects from replay attacks Protects the IP header and it’s payload No encryption! Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 7
AH - Authentication Header - RFC 4302 Operates on top of IP Authentication and Integrity Protection Protects from replay attacks Protects the IP header and it’s payload No encryption! Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 7
AH - Authentication Header - RFC 4302 Operates on top of IP Authentication and Integrity Protection Protects from replay attacks Protects the IP header and it’s payload No encryption! Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 7
AH - Header Format Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 8
ESP - Encapsulating Security Payload RFC 4303 Operates on top of IP Encrypts the transported payload Integrity Check AH can be added to protect the outer IP header Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 9
ESP - Encapsulating Security Payload RFC 4303 Operates on top of IP Encrypts the transported payload Integrity Check AH can be added to protect the outer IP header Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 9
ESP - Encapsulating Security Payload RFC 4303 Operates on top of IP Encrypts the transported payload Integrity Check AH can be added to protect the outer IP header Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 9
ESP - Encapsulating Security Payload RFC 4303 Operates on top of IP Encrypts the transported payload Integrity Check AH can be added to protect the outer IP header Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 9
ESP - Encapsulating Security Payload RFC 4303 Operates on top of IP Encrypts the transported payload Integrity Check AH can be added to protect the outer IP header Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 9
ESP - Header Format Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 10
Internet Key Exchange Protocol v2 Current version specified in RFC 5996 Used to establish encryption and authentication keys Find the best mutually supported algorithms Authentication between the parties Selection of supported authentication methods: PSK X.509 certificates EAP Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 11
Internet Key Exchange Protocol v2 Current version specified in RFC 5996 Used to establish encryption and authentication keys Find the best mutually supported algorithms Authentication between the parties Selection of supported authentication methods: PSK X.509 certificates EAP Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 11
Internet Key Exchange Protocol v2 Current version specified in RFC 5996 Used to establish encryption and authentication keys Find the best mutually supported algorithms Authentication between the parties Selection of supported authentication methods: PSK X.509 certificates EAP Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 11
Internet Key Exchange Protocol v2 Current version specified in RFC 5996 Used to establish encryption and authentication keys Find the best mutually supported algorithms Authentication between the parties Selection of supported authentication methods: PSK X.509 certificates EAP Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 11
Internet Key Exchange Protocol v2 Current version specified in RFC 5996 Used to establish encryption and authentication keys Find the best mutually supported algorithms Authentication between the parties Selection of supported authentication methods: PSK X.509 certificates EAP Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 11
Summary We need a VPN We have IPSec We want to give a road warrior access Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 12
Summary We need a VPN We have IPSec We want to give a road warrior access Lukas Grillmayer and Linus Lotz: ilab 2 - IPSec with IKEv2 and Strongswan 12
Recommend
More recommend
