Virtual Private Networks (IPsec, SSL, L2TP, GRE)
IPsec building blocks
IPsec protects traffic between gateways or hosts. IKE negotiates SAs in two phases: phase 1 builds the ISAKMP SA (proposal with encryption, hash, DH group, authentication method, lifetime); phase 2 builds the IPsec SA (protocol ESP or AH, encryption, hash, PFS, lifetime). ESP gives confidentiality and integrity; AH gives integrity only and does not survive NAT. Tunnel mode is normal for gateway-to-gateway; transport mode is host-to-host.
Operational details
- Interesting traffic is selected by an ACL referenced in the IPsec policy; this ACL does not permit or deny traffic.
- NAT traversal encapsulates ESP in UDP 4500; IKE uses UDP 500.
- DPD detects dead peers; PFS forces a new DH exchange for each phase 2.
- IKEv2 is simpler and more robust than IKEv1; both are supported.
SSL, L2TP, GRE
SSL VPN (virtual gateway) offers clientless web proxy, port forwarding, network extension and file sharing over TCP 443. L2TP is often run as L2TP over IPsec for remote access. GRE is a stateless tunnel that can carry multicast and routing protocols but provides no encryption.
Worked example
Two sites need 192.168.1.0/24 to 192.168.2.0/24 protected. Reasoning: configure matching IKE proposals and peers with a pre-shared key, matching IPsec proposals, an ACL permitting 192.168.1.0/24 to 192.168.2.0/24, bind the policy to the WAN interface, and add a security policy permitting the tunnel traffic. Verify phase 1 with display ike sa, then phase 2 with display ipsec sa.
Traps that cost marks
- Believing the IPsec ACL filters traffic.
- Mismatched proposals, pre-shared keys or lifetimes, which break phase 1.
- Forgetting PFS on one side only.
- Expecting GRE to encrypt payloads.