IPsec Remote Access and Site-to-Site VPNs

What it is

A virtual private network (VPN) protects traffic across a network you do not trust, and IPsec is the standard framework that does it.

Traffic is wrapped and encrypted, so it travels as though it were on a private line. Anyone who captures it on the way sees only scrambled data.

IPsec is a framework of open standards for protecting IP traffic. It provides four things:

• Confidentiality: the data is encrypted so it cannot be read.
• Integrity: the receiver can tell if the data was changed in transit.
• Authentication: each side proves who it is.
• Anti-replay: copies of old packets that an attacker replays are rejected.

How it works

Two peers agree on keys with IKE, then protect the data with ESP or AH in tunnel or transport mode.

Two types of VPN

Both types build an encrypted tunnel, but they serve different users.

Site-to-site VPN. Two gateways, such as routers or firewalls, build a tunnel between two networks. The users and servers behind each gateway do not run any VPN software.

Their traffic is encrypted by the gateway as it leaves and decrypted by the other gateway on arrival. The tunnel is usually permanent. It is the way to join a branch office to a head office without leasing a private line.

Remote access VPN. A single user connects to the network from outside, such as from home or a hotel. The user's computer runs a VPN client, and the tunnel is built between that computer and a gateway at the organisation.

It is created when needed and ended when finished. Remote access VPNs can use IPsec, or they can use SSL/TLS, which runs through a web browser or a client app and passes through most firewalls easily.

IPsec building blocks

IPsec has several components. They are easier to follow as a short story.

1. IKE sets up the keys. The Internet Key Exchange (IKE) protocol lets the two peers agree on how to protect traffic, and exchange keys safely.

It runs over UDP port 500 and happens in two stages:

• Phase 1 builds a secure management channel between the peers. They authenticate each other, using a pre-shared key or digital certificates, and use a Diffie-Hellman exchange to create a shared secret without ever sending it.
• Phase 2 builds the IPsec security associations, which are the agreed rules and keys for the actual data traffic.

This describes IKE version 1. IKE version 2 reaches the same result with different message exchanges.

2. ESP and AH protect the data. These are the two IPsec protocols:

• ESP (Encapsulating Security Payload) is IP protocol number 50. It provides encryption, integrity and authentication.
• AH (Authentication Header) is IP protocol number 51. It provides integrity and authentication, but no encryption.

ESP is the one used in nearly all VPNs, since it encrypts. AH authenticates the packet but does not hide the contents, so it is rarely used alone.

3. Two modes decide how the packet is wrapped.

• Tunnel mode encrypts the whole original IP packet and adds a new IP header. This is the normal mode for site-to-site VPNs, since the original private addresses stay hidden.
• Transport mode protects only the payload and keeps the original IP header. It is used between two hosts.

4. Algorithms do the work. Encryption uses a cipher, such as AES. Integrity uses a hash, such as SHA.

Both ends must be set to compatible choices. A stronger Diffie-Hellman group gives a stronger key exchange.

NAT and IPsec

When a peer sits behind NAT, IPsec has a problem, because NAT changes addresses and ports. NAT traversal solves this by wrapping IPsec packets in UDP, using UDP port 4500.

Configuration

A full IPsec configuration on Cisco devices has many parts and is beyond the scope of this objective, which asks you only to describe the technology. Know what each element does and where it fits.