IP Security IPsec: How It Works, Importance, IPsec and IPv6

IP security (IPsec), importance, its works, key Management and Security Associations (SA), IPsec and VPN protocols, IPsec and IPv6, IPsec Configuration Elements, and its disadvantages were all covered in this blog.

What is IPS Security?

An essential architecture or framework known as IPsec (Internet Protocol Security) outlines a widely used set of guidelines and procedures for putting security features for Internet Protocol (IP) networks into practice. An IP-based network may transmit data securely to the industry-wide standard suite of protocols and algorithms known as IPsec. RFC 4301, “Security Architecture for the Internet Protocol,” defines it.

In the OSI model, IPsec operates at the Network layer, or Layer 3. The creation of Virtual Private Network (VPN) services is its main application.

Importance of IPsec (Internet Protocol Security)

In order to provide safe and dependable communication over IP networks, IPsec is essential. Its significance can be comprehended by the following points:

Data Privacy: Sensitive information is kept private and unreadable by unauthorised users during transmission to IPsec’s encryption of data packets.

Integrity of Data: It uses hashing methods and cryptographic checksums to ensure that data is not changed or tampered with while it is moving across the network.

Verification: By confirming the identity of communication parties, IPsec makes sure that only reliable sources communicate data.

Defence Against Attacks via Replay: In order to obstruct communication or obtain unauthorised access, IPsec stops attackers from intercepting and resending previous packets.

Safe Remote Access: It serves as the foundation for VPNs by allowing users or employees to safely access to company networks from distant locations.

Flexibility and Scalability: IPsec is versatile for a range of situations since it may protect communications between individual users (end-to-end) or large networks (site-to-site).

Conformance to Current Protocols: Because IPsec functions at the network layer, it can secure any traffic, regardless of the application, without necessitating modifications to the network’s architecture or software.

Data protection and compliance: To adhere to data protection laws and guarantee the safe processing of client information, numerous businesses and sectors rely on IPsec.

Also Read About Advantages And Disadvantages Of IPv6, IPv6 Address Types

How it works?

Data transmission over the Internet is protected by IPSec (Internet Protocol Security). By establishing secure connections between devices, IPSec ensures that the data being transferred is protected from unwanted access. Transport Mode and Tunnel Mode are the two main ways that IPSec functions.

The two primary protocols used by IPSec to offer security are ESP (Encapsulating Security Payload) and AH (Authentication Header). Both protocols are highly helpful because the ESP handles authentication and encrypts the data to make it hard to read, while the Authentication Header confirms that the data is from a reliable source and hasn’t been altered.

IPSec employs cryptographic keys for encryption. IKE (Internet Key Exchange) is a method for creating and sharing it that makes sure both devices have the right keys to form a secure connection.

When two devices use IPSec to communicate, they first send each other a request to establish the connection. They then decide together to use digital certificates or passwords to protect the data. They now create the safe communication tube. After the tunnel is established, data may be sent securely since IPSec encrypts the data and verifies its integrity to make sure it hasn’t been changed. The devices can terminate the encrypted connection after the communication is complete. The IPSec operates in this manner.

Also Read About CISCO IOS Architecture, Functions And Characteristics

Key Management and Security Associations (SA)

To create a secure, authenticated, and encrypted connection (commonly referred to as a VPN tunnel) between two endpoints, IPsec employs a two-step procedure. The Internet Key Exchange (IKE) protocol, which establishes the required Security Associations (SAs) for data transmission, controls this procedure.

IKE Phase 1: The Control Channel

Phase 1 aims to create the IKE Security Association (SA), a secure, authenticated, bi-directional “management” channel. Only the settings for the primary data tunnel (Phase 2) are negotiated over this channel.

Important Phase 1 Steps:

• Policy Negotiation: The two peers (such as VPN gateways) agree on the hashing algorithm (such as SHA), encryption algorithm (such as AES), and authentication technique (such as digital certificates or pre-shared keys) to be employed for the IKE SA.
• Authentication: Using the predetermined technique, the peers verify each other’s identities.
• Key Exchange: To safely create a shared, secret key that will be utilized to safeguard the Phase 2 negotiation communications, they employ the Diffie-Hellman (DH) key exchange method.

A secure tunnel (the IKE SA) that is prepared to safeguard the negotiation of the real data channels is the end result of Phase 1.

IKE Phase 2: The Data Channel

The actual one-way tunnels used to encrypt user data traffic, known as IPsec Security Associations (SAs), are negotiated and established during Phase 2.

Important Phase 2 Steps:

• IPsec Parameter Negotiation: The security protocols, encryption techniques, and authentication methods for the actual data transmission are decided upon by the peers.
  • Protocols: They select either Authentication Header (AH) for authentication simply or Encapsulating Security Payload (ESP) for encryption and authentication (ESP is much more popular).
  • Keys: They create fresh, distinct keys for data encryption and authentication that are generated from the Phase 1 master key.
• IPsec SA establishment: To create the bi-directional data tunnel, at least two one-way SAs are made: one for outgoing traffic and one for incoming traffic.

The IPsec tunnel is deemed “up” and user data can be safely transferred after Phase 2 is finished.

Also Read About What is SLAAC IPv6(Stateless IPv6 Address Autoconfiguration)

IPsec uses specific cryptographic algorithms for its functions

• Symmetric encryption techniques, such as Advanced Encryption. Triple DES (3DES) and standard (AES) (128-, 192-, or 256-bit keys) are frequently employed for encrypting large amounts of data.
• Key Exchange: Shared secret session keys are safely established using the Diffie-Hellman (DH) method.

IPsec and VPN Protocols

The industry standard for building Virtual Private Networks (VPNs) over insecure public networks, like the internet, is IPsec. For safe communication, these VPNs create encrypted circuits or tunnels.

Operating Modes

The two primary modes of operation that IPsec provides dictate how the IP packet is secured:

• When using IPsec Tunnel Mode, the entire original IP packet including the content and header is encapsulated and wrapped in a new IP packet with a new header.
  • Use: It is the primary mode for remote access VPNs (host-to-network) and site-to-site VPNs (using gateways to connect two geographically distant networks).
  • Benefit: More privacy is provided because the complete original packet is encrypted, hiding the internal network IP information from outside observers.
• IPsec Transport Mode: This mode preserves the original IP header while just securing the payload, or the actual data.
  • Usage: In a trusted network, it is usually employed for end-to-end communication between two hosts.
  • Benefit: The procedure is quicker and uses less data because an additional IP header is not required.

Other VPN Considerations for IPsec

• UDP ports 500 and 4500 are frequently used by IPsec for connection establishment and key exchange. IKEv2 encrypted tunnels use UDP port 500, and when Network Address Translation (NAT) Traversal (NAT-T) capabilities is added, UDP port 4500 is utilized.
• Non-IP communication: IPsec is frequently used over a Generic Routing Encapsulation (GRE) tunnel, also referred to as GRE over IPsec, to enable protocols like routing or multicast communication because it can only encrypt IP-based traffic on its own and does not handle IP broadcast or IP multicast.
• Layer of Operation: IPsec VPNs are perfect for high security network-to-network connections since they encrypt at the Network Layer (Layer 3). In contrast, SSL VPNs are typically browser-based and function at the Application Layer.
• Overhead: The Maximum Transmission Unit (MTU) and Maximum Segment Size (MSS) may be impacted by the overhead that the encapsulation process adds to packets. Because IPsec encapsulation can increase a packet’s size by 50–60 bytes or more, administrators may need to modify the MSS or MTU parameters to avoid fragmentation and subpar performance.

Also Read About Advantages and Disadvantages of Remote Access VPN & Types

IPsec and IPv6

Each and every IPv6 node has IPsec implemented. With IPsec offering end-to-end security, the necessity to incorporate security features as standard and required was one of the driving forces for the development of IPv6. The purpose of IPv6 header methods was to streamline and improve the efficiency of extension headers, such as those utilized by IPsec.

IPsec Configuration Elements

IPsec configuration on routers depends on traffic classifiers and linking policies:

• The primary configuration container that is applied straight to the interface that faces a public network, like the Internet, is called Crypto Map. It functions as a logical assertion: send the traffic to the assigned peer after applying the specified transform set if it meets a particular access list.
• Access Control List (ACL) for crypto: This standard or enhanced ACL finds “interesting traffic” (traffic that needs IPsec protection). Normal (unencrypted) forwarding occurs for traffic that does not meet the crypto ACL.
• Transform Set: This outlines the Phase 2 security measures (such as hashing algorithms and encryption) that are employed to safeguard the information.
• The source address on one router must be the destination address on the other, and vice versa, in order for the crypto ACLs on the two peers in a site-to-site VPN to be mirror images, or symmetrical.

Disadvantages of IPsec

The following are the main disadvantages of IPsec (Internet Protocol Security):

Complexity of Management and Configuration: IPsec is infamously hard to set up, requiring specific expertise to properly setup all of its components, including key exchange (IKE/IKEv2), cryptographic methods, and protocols (AH/ESP). Misconfiguration is more likely as a result of this complexity.

High Processing Overhead: Particularly on low-end devices or with high-speed traffic, the necessary encryption and decryption procedures for each IP packet use a substantial amount of CPU resources, resulting in high CPU utilisation and possible performance degradation (slower speeds and greater latency).

Problems with NAT Traversal and Compatibility:

• Devices from different suppliers that use somewhat different IPsec implementations may experience interoperability problems.
• Network Address Translation (NAT) can cause issues for IPsec, especially when utilising the Authentication Header (AH) protocol. This is because NAT alters the IP header, which compromises the integrity check of AH. Although it adds another level of complexity, encapsulating Security Payload (ESP) with NAT Traversal (NAT-T) helps to mitigate this.

Firewall Complications: Complex policy management or specialized IPsec-aware firewalls are frequently required due to the fact that IPsec encrypts traffic at the network layer, making it difficult for conventional firewalls to examine the packet’s higher-layer headers (such as TCP ports) for granular filtering.

Client Software Needed for Remote Access: In contrast to protocols such as SSL/TLS VPNs, IPsec VPNs for remote access usually require users to install and maintain particular client software on their devices.

Key administration Burden: Secure and methodical administration of encryption keys and security associations is essential to preserving communication security. This requires a significant administrative effort in big networks.

Limited Access Control Granularity: In contrast to application-layer security techniques, IPsec frequently gives the connected device secure access to the whole network, which poses a security risk in the event that the device is compromised.

Also Read About Disadvantages Of Web Application Firewall And WAF Functions