ilab 2 - IPSec with IKEv2 and Strongswan Lukas Grillmayer and Linus - - PowerPoint PPT Presentation

▶
ilab 2 ipsec with ikev2 and strongswan
SMART_READER_LITE
LIVE PREVIEW

ilab 2 - IPSec with IKEv2 and Strongswan Lukas Grillmayer and Linus - - PowerPoint PPT Presentation

Sep 05, 2022 862 likes •1.39k views

ilab 2 - IPSec with IKEv2 and Strongswan Lukas Grillmayer and Linus Lotz Chair for Network Architectures and Services Department for Computer Science Technische Universit at M unchen June 4, 2014 Lukas Grillmayer and Linus Lotz: ilab 2 -

slide-1
SLIDE 1

ilab2 - IPSec with IKEv2 and Strongswan

Lukas Grillmayer and Linus Lotz

Chair for Network Architectures and Services Department for Computer Science Technische Universit¨ at M¨ unchen

June 4, 2014

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 1

slide-2
SLIDE 2

Motivation

Imagine you are a huge search engine company you recently found out that some government agancy has the audacity to sniff in your network “F*** these guys.” - a engineer from a huge search engine company

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 2

slide-3
SLIDE 3

Motivation

Imagine you are a huge search engine company you recently found out that some government agancy has the audacity to sniff in your network “F*** these guys.” - a engineer from a huge search engine company

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 2

slide-4
SLIDE 4

Motivation

Imagine you are a huge search engine company you recently found out that some government agancy has the audacity to sniff in your network “F*** these guys.” - a engineer from a huge search engine company

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 2

slide-5
SLIDE 5

Situation

We have several locations that need to be connected We have some users who need to access our network from

  • utside

= ⇒ What we need is a VPN

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 3

slide-6
SLIDE 6

Situation

We have several locations that need to be connected We have some users who need to access our network from

  • utside

= ⇒ What we need is a VPN

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 3

slide-7
SLIDE 7

Situation

We have several locations that need to be connected We have some users who need to access our network from

  • utside

= ⇒ What we need is a VPN

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 3

slide-8
SLIDE 8

Outline

1

Motivation

2

Outline

3

IPSec AH ESP IKEv2

4

Summary

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 4

slide-9
SLIDE 9

Outline

1

Motivation

2

Outline

3

IPSec AH ESP IKEv2

4

Summary

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 4

slide-10
SLIDE 10

Outline

1

Motivation

2

Outline

3

IPSec AH ESP IKEv2

4

Summary

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 4

slide-11
SLIDE 11

Outline

1

Motivation

2

Outline

3

IPSec AH ESP IKEv2

4

Summary

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 4

slide-12
SLIDE 12

IPSec - What is it good for?

For encrypting data between two parties Consists of a number of different protocols

1 AH 2 ESP 3 ISAKMP 4 IKE(v2)

A lot of RFCs about IPSec: 2403,2404,2405,2410,2451,2857,3526,3686,3947,3948,4106,4301, 4302,4303,4304,4307,4308,4309,4543,4555,4806,4835,5945,5996

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 5

slide-13
SLIDE 13

IPSec - What is it good for?

For encrypting data between two parties Consists of a number of different protocols

1 AH 2 ESP 3 ISAKMP 4 IKE(v2)

A lot of RFCs about IPSec: 2403,2404,2405,2410,2451,2857,3526,3686,3947,3948,4106,4301, 4302,4303,4304,4307,4308,4309,4543,4555,4806,4835,5945,5996

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 5

slide-14
SLIDE 14

IPSec - What is it good for?

For encrypting data between two parties Consists of a number of different protocols

1 AH 2 ESP 3 ISAKMP 4 IKE(v2)

A lot of RFCs about IPSec: 2403,2404,2405,2410,2451,2857,3526,3686,3947,3948,4106,4301, 4302,4303,4304,4307,4308,4309,4543,4555,4806,4835,5945,5996

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 5

slide-15
SLIDE 15

IPSec - What is it good for?

For encrypting data between two parties Consists of a number of different protocols

1 AH 2 ESP 3 ISAKMP 4 IKE(v2)

A lot of RFCs about IPSec: 2403,2404,2405,2410,2451,2857,3526,3686,3947,3948,4106,4301, 4302,4303,4304,4307,4308,4309,4543,4555,4806,4835,5945,5996

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 5

slide-16
SLIDE 16

IPSec - What is it good for?

For encrypting data between two parties Consists of a number of different protocols

1 AH 2 ESP 3 ISAKMP 4 IKE(v2)

A lot of RFCs about IPSec: 2403,2404,2405,2410,2451,2857,3526,3686,3947,3948,4106,4301, 4302,4303,4304,4307,4308,4309,4543,4555,4806,4835,5945,5996

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 5

slide-17
SLIDE 17

Tunnel and Transport Mode

Tunnelmode: Transportmode:

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 6

slide-18
SLIDE 18

AH - Authentication Header - RFC 4302

Operates on top of IP Authentication and Integrity Protection Protects from replay attacks Protects the IP header and it’s payload No encryption!

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 7

slide-19
SLIDE 19

AH - Authentication Header - RFC 4302

Operates on top of IP Authentication and Integrity Protection Protects from replay attacks Protects the IP header and it’s payload No encryption!

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 7

slide-20
SLIDE 20

AH - Authentication Header - RFC 4302

Operates on top of IP Authentication and Integrity Protection Protects from replay attacks Protects the IP header and it’s payload No encryption!

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 7

slide-21
SLIDE 21

AH - Authentication Header - RFC 4302

Operates on top of IP Authentication and Integrity Protection Protects from replay attacks Protects the IP header and it’s payload No encryption!

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 7

slide-22
SLIDE 22

AH - Authentication Header - RFC 4302

Operates on top of IP Authentication and Integrity Protection Protects from replay attacks Protects the IP header and it’s payload No encryption!

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 7

slide-23
SLIDE 23

AH - Header Format

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 8

slide-24
SLIDE 24

ESP - Encapsulating Security Payload

RFC 4303 Operates on top of IP Encrypts the transported payload Integrity Check AH can be added to protect the outer IP header

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 9

slide-25
SLIDE 25

ESP - Encapsulating Security Payload

RFC 4303 Operates on top of IP Encrypts the transported payload Integrity Check AH can be added to protect the outer IP header

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 9

slide-26
SLIDE 26

ESP - Encapsulating Security Payload

RFC 4303 Operates on top of IP Encrypts the transported payload Integrity Check AH can be added to protect the outer IP header

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 9

slide-27
SLIDE 27

ESP - Encapsulating Security Payload

RFC 4303 Operates on top of IP Encrypts the transported payload Integrity Check AH can be added to protect the outer IP header

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 9

slide-28
SLIDE 28

ESP - Encapsulating Security Payload

RFC 4303 Operates on top of IP Encrypts the transported payload Integrity Check AH can be added to protect the outer IP header

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 9

slide-29
SLIDE 29

ESP - Header Format

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 10

slide-30
SLIDE 30

Internet Key Exchange Protocol v2

Current version specified in RFC 5996 Used to establish encryption and authentication keys Find the best mutually supported algorithms Authentication between the parties Selection of supported authentication methods: PSK X.509 certificates EAP

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 11

slide-31
SLIDE 31

Internet Key Exchange Protocol v2

Current version specified in RFC 5996 Used to establish encryption and authentication keys Find the best mutually supported algorithms Authentication between the parties Selection of supported authentication methods: PSK X.509 certificates EAP

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 11

slide-32
SLIDE 32

Internet Key Exchange Protocol v2

Current version specified in RFC 5996 Used to establish encryption and authentication keys Find the best mutually supported algorithms Authentication between the parties Selection of supported authentication methods: PSK X.509 certificates EAP

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 11

slide-33
SLIDE 33

Internet Key Exchange Protocol v2

Current version specified in RFC 5996 Used to establish encryption and authentication keys Find the best mutually supported algorithms Authentication between the parties Selection of supported authentication methods: PSK X.509 certificates EAP

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 11

slide-34
SLIDE 34

Internet Key Exchange Protocol v2

Current version specified in RFC 5996 Used to establish encryption and authentication keys Find the best mutually supported algorithms Authentication between the parties Selection of supported authentication methods: PSK X.509 certificates EAP

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 11

slide-35
SLIDE 35

Summary

We need a VPN We have IPSec We want to give a road warrior access

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 12

slide-36
SLIDE 36

Summary

We need a VPN We have IPSec We want to give a road warrior access

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 12

slide-37
SLIDE 37

Summary

We need a VPN We have IPSec We want to give a road warrior access

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 12

slide-38
SLIDE 38

Practical Part

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 13

slide-39
SLIDE 39

Image sources

http://en.wikipedia.org/wiki/IPSec Ilab 1 - Security I

Lukas Grillmayer and Linus Lotz: ilab2 - IPSec with IKEv2 and Strongswan 14

slide-40
SLIDE 40

SNMP – SIMPLE NETWORK MANAGEMENT PROTOCOL

Denis Huber and Daniel Metz

1

slide-41
SLIDE 41

Motivation

Networks:

– various device classes

  • different operating systems
  • different instruction syntax
  • functionality

– tasks:

  • configuration
  • monitoring of devices

2

slide-42
SLIDE 42

Motivation

Achievable via:

– Ping, SSH, Telnet

So could we ease network management by a standard/protocol? SNMP!

3

slide-43
SLIDE 43

Motivation

SNMP

  • powerful, widespread standard
  • standardized

– simple network-object management – resource monitoring

  • lightweight device software
  • “One Framework to rule them all”

4

slide-44
SLIDE 44

Lecture Overview

  • MIB
  • SNMP
  • Summary

5

slide-45
SLIDE 45

MIB

  • NOT “Men in Black”
  • Management Information Base
  • Used for specifying network objects (network

relevant objects on network devices)

  • “Address” of network object
  • Unique scope on device scope

6

slide-46
SLIDE 46

MIB

  • Tree structure
  • Leaves hold information
  • Many predefined nodes by standard

Notation (MIB-OID):

  • .1.3.6.[…]
  • iso.organization.DoD
  • .1.3.6.1.2.1.2.2.1.6.7 ≙ MAC-Adr. interface 7

7

1 3 6

slide-47
SLIDE 47

SNMP

  • Application Layer Protocol uses mostly UDP

(but also TCP)

  • Protocol entities

– Manager monitors/configures Agents – Agent is a network device processing the requests

  • f a Manager
  • MIB acts as an interface between manager

and agent

8

slide-48
SLIDE 48

SNMP

  • Communication

– manager uses various requests:

  • GetRequest
  • GetNextRequest
  • SetRequest

– agent responses with a GetResponse – “trap messages” are used for asychonous notification from agent to manager

9

slide-49
SLIDE 49

Teaser Practical Part

10

Management Network Agent Manager

slide-50
SLIDE 50

Summary

  • SNMP: Standard for network management
  • MIB: Database for network objects
  • Manager: Controls the network devices
  • Agent: Network device to be managed

11

slide-51
SLIDE 51

12

Questions