IPsec, and IPsec over GRE Tunnel

Intro

Most of enterprise today move to IPsec over GRE tunnel to save cost, but I'm not saying that this technology already rule out MPLS, lease line, etc. It depend on that site, how critical it is, how stable the internet connection is. Usually small office like sales that only have few workers use this to connect to corporate LAN.

IPsec and GRE Tunnel is 2 different thing, we'll go with IPsec first, then brief about GRE then I'll give you an example of IPsec over GRE tunnel

IPsec

The three main point of IPsec is

Authentication
Data Integrity
Confidentiality

Authentication
to make sure you communicating or talking to the right person

Data Integrity
to make sure what you sending is received at the destination with the same shape, mean no modification happen along the way

confidentiality
to make sure what send not able to be seen by third party

What build an IPsec ?

Basically, IPsec is a combo of a few protocol

Negotiation : IKE
Security : AH, ESP, ESP+AH
Encryption : DES. 3DES, AES
Authentication : MDS, SHA

Protection : DH, DH2, DH5, DH7

2 Mode of communication

Transport Mode
This mode is used when data need to be secure within the LAN, maybe super important and high confidentiality kind of data

from the picture above, the encryption/protection only apply to layer 4 and above, this is because this packet only travel within the LAN, so there's no point to protect the ip packet.

Secure communication happen between two point, other party can't read the packet from layer4 and above only, they still can read the IP layer.

Tunnel Mode
This mode is used when packet need to travel across a public network, where it's dangerous to let other to see the private/internal IP information

In this mode, encryption is done starting from IP header(layer3) and above to protect the internal IP information, new public IP header then will be added so this packet can be routed in public network.

The two type of encryption keys
Symmetric : each use same key to encrypt and decrypt data (shared key)
Asymmetric : public key to encrypt, private key to decrypt

Data Integrity

Data integrity is to make sure data is-untouched along the way to the destination. To make sure this, first data will be calculated using a formula to produce a value, then it'll be hashed and send ed. When received in the other site, it'll be re-calculated again, if the value is same as value that produced before, it's mean that the data is clean from any modification.


The 2 phase to make communication happen

IKE phase 1

From example above, R1 want to initiate a connection, so R1 gonna with sending message 1

Message 1 : negotiate a matching IKE SA policy between peer to protect IKE exchange

Message 2 : exchange DH key
Mesagge 3 : Make sure they are who they are (authentication)

Basically this phase is to setup a secure management channel for IKE phase 2

IKE phase 2

Negotiate and exchange IPSec Parameter protecting by existing existing IKE SA
Periodically renegotiate IPsec SAs to ensure security
Data transfer also happen in this stage

Example : Step by step how to configure a secure IPsec

1. Setup ISAKMP policy (IKE Phase 1), the management phase

png(config)#crypto isakmp policy 50 // give policy number, the lower the higher priority

png(config-isakmp)#authentication pre-share // pre-share, both site much share the same key

png(config-isakmp)#encryption des
png(config-isakmp)#group 2 // select group for DH key to use
png(config-isakmp)#hash sha
png(config)#crypto isakmp key cisco123 add 71.209.254.34 // define the pre-share key here, set address for the peer

2. Setup IPsec transform set (IKE Phase 2), basically this is where we define the set of encryption and hash for the data to use
png(config)#crypto ipsec transform-set CISCO_SET esp-des esp-sha-hmac

3. Define interesting traffic using access-list command, here is where where we define which subnet or address that need to be forwarded to the IPsec channel
png(config)#ip access-list extended INT_TRAFFIC
png(config-ext-nacl)#permit ip 172.3.0.0 0.0.255.255 192.168.1.0 0.0.255.255

4. Setup crypto map
png(config)#crypto map VPN_MAP 10 ipsec-isakmp // give a name to the map
png(config-crypto-map)#set peer 71.209.254.34 // set the it's peer
png(config-crypto-map)#match add INT_TRAFFIC //set interest traffic
png(config-crypto-map)#set transform-set CISCO_SET //set transform group

5. Apply to the interface
png(config)#int fa 0/1
png(config-if)#crypto map VPN_MAP

First Post

I work for a giant microprocessor company as a network engineer.

Our network infrastructure are very complex, but the problem is my knowledge and experience are not that complex (I'm a fresh grad). so i must do something about this, and i decided to start blogging about network technologies and set a target; to become a CCIE certified !! well, this is where i coming from, and see you on next post ;-)