IPSec

Question 1

What is IPSec?

Answer 1

A set of communication rules or protocols for setting up secure connections over a network. Adds encryption and authentication to make the IP protocol more secure. Designed to secure data over public networks.

Question 2

Where might IPSec be implemented?

Answer 2

1) Virtual Private Networks (VPN)
2) Branch offices
3) Partner Extranet
4) Remote Access

Question 3

Explain the process of Security Associations.

Answer 3

o Phase 1 SA
 IKE Phase 1
 Main Mode
 Traffic Management
 No encrypted data being sent yet
* Negotiation
o What kind of key exchange
 Diffie-Hellman
 ECDHE
o Authentication
 Certificates
 PSK
o Encryption
o Session Duration
o Phase 2 SA
 IKE Phase 2
 Quick Mode
 Data Exchange
* Set up two one-way tunnels
* Two separate data exchanges
 Negotiation
* IP Sec Protocol
o AH
o ESP
* Encapsulation
* Authentication
* Session Duration
* (Optional) DH Exchange

Question 4

What is IPSec Authentication Header (AH)?

Answer 4

It provides data integrity by using an authentication algorithm. It does not encrypt the packet. Verifies integrity. Uses IP protocol 51.

Question 5

What is IPSec Encapsulating Security Payload (ESP)?

Answer 5

It provides origin authenticity through source authentication, data integrity through hash functions, and confidentially through encryption protection for IP packets. Uses IP protocol 50.

Question 6

What is IPSec Encapsulation?

Answer 6

Handled by ESP or AH or both for an IPSec tunnel. Includes encrypting the data portion of the header if ESP is being used, adding the appropriate header to provide the IPSec peer with information on how to decrypt the date (for ESP), and generating hashes to be used by the peer for verifying that the data (and the IP header in the case of AH) was not tampered with. Can be done in tunnel or transport mode.

Question 7

Show the difference between Transport and Tunnel Mode.

Answer 7

See the illustration on pg. 37 of the notes.

Question 8

What is the Security Parameter Index (SPI)?

Answer 8

An identifier used to uniquely identify both manually and dynamically established IPSec Security Associations.

Question 9

What is Internet Security Association and Key Management Protocol (ISAKMP)?

Answer 9

Used for negotiating, establishing, modification, and deletion of security associations and related parameters. It defines the procedures and packet formats for peer authentication creation and management of SAs and techniques for key generation.