Draft-maino-gpe-vpn F. Maino, V. Ermagan, J. Evans, H. Miclea IETF 95 – April 2016.

Slides:

Advertisements

Similar presentations

Cryptography and Network Security

Advertisements

CS470, A.SelcukIPsec – AH & ESP1 CS 470 Introduction to Applied Cryptography Instructor: Ali Aydin Selcuk.

Internet Security CSCE 813 IPsec

IPSec: Authentication Header, Encapsulating Security Payload Protocols CSCI 5931 Web Security Edward Murphy.

Securing Remote PC Access to UNIX/Linux Hosts with VPN or SSH Charles T. Moetului WRQ, Inc. (206)

IP Security. n Have a range of application specific security mechanisms u eg. S/MIME, PGP, Kerberos, SSL/HTTPS n However there are security concerns that.

NAT TRAVERSAL FOR IPSEC Research Seminar on Datacommunications Software HIIT

Network Security Essentials Chapter 8 Fourth Edition by William Stallings Lecture slides by Lawrie Brown.

Chapter 13 IPsec. IPsec (IP Security)  A collection of protocols used to create VPNs  A network layer security protocol providing cryptographic security.

1 Lecture 15: IPsec AH and ESP IPsec introduction: uses and modes IPsec concepts –security association –security policy database IPsec headers –authentication.

IP Security IPSec 2 * Essential Network Security Book Slides. IT352 | Network Security |Najwa AlGhamdi 1.

OpenDaylight: Service Function Chaining.

Network Overlay Framework Draft-lasserre-nvo3-framework-01.

Gap Analysis of Simplified Use of Policy Abstractions (SUPA) Presenter: Jun Bi draft-bi-supa-gap-analysis-02 IETF 92 SUPA BoF Dallas, TX March 23, 2015.

1 IP Security Outline of the session –IP Security Overview –IP Security Architecture –Key Management Based on slides by Dr. Lawrie Brown of the Australian.

Configuration of a Site-to-Site IPsec Virtual Private Network Anuradha Kallury CS 580 Special Project August 23, 2005.

IP Security. IPSEC Objectives n Band-aid for IPv4 u Spoofing a problem u Not designed with security or authentication in mind n IP layer mechanism for.

VPN – Technologies and Solutions CS158B Network Management April 11, 2005 Alvin Tsang Eyob Solomon Wayne Tsui.

K. Salah1 Security Protocols in the Internet IPSec.

LISP, SDN, and OpenDaylight

MPLS networking at PSP Co Multi-Protocol Label Switching Presented by: Hamid Sheikhghanbari 1.

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 1 Lesson 23 Virtual Private Networks (VPNs)

RSIP Address Sharing with End-to-End Security Mike Borella, 3Com Corp. Gabriel Montenegro, Sun Microsystems March 2000.

What Is Needed to Build a VPN? An existing network with servers and workstations Connection to the Internet VPN gateways (i.e., routers, PIX, ASA, VPN.

ECE Prof. John A. Copeland fax Office: GCATT.

IPSec in a Multi-OS Environment. What is IPSec? IPSec stands for Internet Protocol Security It is at a most basic level a way of adding security to your.

1 Network Layer Security: Run over non-IP Protocol? Howie Weiss (NASA/JPL/Parsons) San Antonio, TX October 2013.

CSCE 715: Network Systems Security

Information management 1 Groep T Leuven – Information department 1/26 IPSec IP Security (IPSec)

IPSec IPSec provides the capability to secure communications across a LAN, across private and public wide area networks (WANs) and across the Internet.

Karlstad University IP security Ge Zhang

IPsec Introduction 18.2 Security associations 18.3 Internet Security Association and Key Management Protocol (ISAKMP) 18.4 Internet Key Exchange.

IPSec ● IP Security ● Layer 3 security architecture ● Enables VPN ● Delivers authentication, integrity and secrecy ● Implemented in Linux, Cisco, Windows.

LISP Generic Protocol Extension (LISP-GPE) draft-lewis-lisp-gpe-02 –P. Quinn, D. Lewis, L. Kreeger, F. Maino, M. Smith, N. Yadav, Cisco –P. Agarwal, Broadcom.

IP Security: Security Across the Protocol Stack. IP Security There are some application specific security mechanisms –eg. S/MIME, PGP, Kerberos, SSL/HTTPS.

Stateless Transport Tunneling draft-davie-stt-01.txt Bruce Davie, Jesse Gross, Igor Gashinsky et al.

IP security Ge Zhang Packet-switched network is not Secure! The protocols were designed in the late 70s to early 80s –Very small network.

Agenda CCSDS Network Layer Security IPSec+IKE Profile for CCSDS

L2TP-VP: Layer Two Tunneling Protocol - Virtualization Profile draft-fan-l2tp-vp-00 Duoliang Fan, Liang Xia, Zhen Cao, Namgon Kim November 2013 Vancouver.

Encapsulated Security Payload Header ● RFC 2406 ● Services – Confidentiality ● Plus – Connectionless integrity – Data origin authentication – Replay protection.

1 Lecture 13 IPsec Internet Protocol Security CIS CIS 5357 Network Security.

V IRTUAL P RIVATE N ETWORKS K ARTHIK M OHANASUNDARAM W RIGHT S TATE U NIVERSITY.

Internet Security CSCE 813 IPsec. CSCE813 - Farkas2 TCP/IP Protocol Stack Application Layer Transport Layer Network Layer Data Link Layer.

Authentication Header ● RFC 2402 ● Services – Connectionless integrity – Data origin authentication – Replay protection – As much header authentication.

Lucy Yong Tom Herbert Generic UDP Encapsulation (GUE) for Network Virtualization Overlay (NVO) draft-hy-nvo3-gue-4-nvo-00.

IPSec – IP Security Protocol By Archis Raje. What is IPSec IP Security – set of extensions developed by IETF to provide privacy and authentication to.

IPSec is a suite of protocols defined by the Internet Engineering Task Force (IETF) to provide security services at the network layer. standard protocol.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

Network Layer Security Network Systems Security Mort Anvari.

Understanding “Virtual” Networks J.J. Ekstrom Fall 2011.

K. Salah1 Security Protocols in the Internet IPSec.

Computer Science and Engineering Computer System Security CSE 5339/7339 Session 27 November 23, 2004.

XRBLOCK IETF 85 Atlanta Network Virtualization Architecture Design and Control Plane Requirements draft-fw-nvo3-server2vcenter-01 draft-wu-nvo3-nve2nve.

Multiprotocol Label Switching (MPLS) Routing algorithms provide support for performance goals – Distributed and dynamic React to congestion Load balance.

J. Halpern (Ericsson), C. Pignataro (Cisco)

Lecture 10 Page 1 CS 236 Online Encryption and Network Security Cryptography is widely used to protect networks Relies on encryption algorithms and protocols.

or call for office visit, or call Kathy Cheek,

Overlay Network Engine (ONE)

Draft-ermagan-lisp-nat-traversal-00 Vina Ermagan, Dino Farinacci, Darrel Lewis, Fabio Maino, Jesper Skriver, Chris White Presenter: Vina Ermagan IETF.

LISP Flow Mapping Service

Programmable Overlays with VPP

ODL SFC, Implementing IETF SFC November 14, 2016

Agenda CCSDS Network Layer Security IPSec+IKE Profile for CCSDS

IPSec IPSec is communication security provided at the network layer.

Network Security (contd.)

Summary of the InternetCAR testbeds

rte_security: A new crypto-offload framework in DPDK

Geneve applicability for service function chaining draft-boutros-nvo3-geneve-applicability-for-sfc-02 Sami Boutros Dharma Rajan Philip Kippen Pierluigi.

Presentation transcript:

draft-maino-gpe-vpn F. Maino, V. Ermagan, J. Evans, H. Miclea IETF 95 – April 2016

GPE-VPN LISP-based architecture for SD-WAN – programmable LISP control plane – VXLAN-GPE data plane with optional: ESP encryption NSH-based support for Service Function Chaining Mapping System is dynamically programmed via NorthBound API – Policy rendering via dynamic mapping manipualtion

IP (v4 or v6) or MPLS Router A Router B Router C Router E Key Management Server Mapping Server IP Tunnel Auto Configuration, Orchestration, and Policy Resolution Router D NB API Intent-Based Policy Policy Resolution Stateless Stateful Lookup Provisioning Overall Architecture Packet

Outer Ethernet Header Outer IP Header Outer UDP Header RRVIPROReservedNext Protocol Virtual Network Identifier (VNI) / Instance ID (IID)Reserved Payload (ethernet, IPv4, IPv6, ESP, NSH, …) Data Plane: GPE Encapsulated Frame GPE Header

Outer Ethernet Header Outer IP Header Outer UDP Header RRVIPROReservedNP = ESP Virtual Network Identifier (VNI) / Instance ID (IID)Reserved SPI (32) Sequence Number (32) Payload + Padding NP = IP/Eth ICV GPE ICV Scope Data Plane: GPE with AEAD (ESP-GCM) ESP AAD

Outer Ethernet Header Outer IP Header Outer UDP Header RRVIPROReservedNP = ESP Virtual Network Identifier (VNI) / Instance ID (IID)Reserved SPI (32) Sequence Number (32) NSH Base HeaderNP=IP/Eth NSH Service Path Header NSH Context Headers Payload + PaddingNP = NSH ICV AAD ICV Scope Data Plane: GPE+NSH with ESP+GCM ESP Hdr ESP Trailer NSH Hdr Pld Enc Scope

Mapping Types GPE-VPN uses various mapping types to provide finer-grain policy control, and to support different policies – Per-destination mapping EID -> RLOC – FlowMapping -> RLOC draft-rodrigueznatal-lisp-multi-tuple-eids – Generic Mapping e.g. -> RLOC draft-ermagan-lisp-nsh draft-rodrigueznatal-lisp-ms-smr

Dynamic Policy Rendering Dynamic mapping manipulation (via NB API) enables GPE-VPN generic policy rendering – Forwarding and In-bound load balancing – Overlay Re-encapsulation (via RTR) Virtual topologies Hierarchical VPNs – Group-based Access Control – Support for Service Function Chaining

Key Management Services SA provisioning is a trade-off between – time needed to set up the SA on demand – overall security afforded SA provisioning can be done with different mechanisms – Use IKEv2 to negotiate pairwise SAs – Use Group Domain of Interpretation (GDOI) for group key management – Leverage LISP map-request/reply to accelerate on demand provisioning of SA e.g. ietf-lisp-crypto SA Setup Time / Security

Q&A Thanks!