Network Layer Security Update 10/23/2016 CHARLES SHEEHE, CCSDS GRC POC

Discussions with Area Director Area director would like another round of build and test because of the minimal set of successfully completed test.

Status IPsec compatibility testing for CCSDS Key deliverable Reported Last year IPsec compatibility testing for CCSDS Evaluate IPsec/CCSDS related standards Define CCSDS/IPsec approved parameters by CCSDS working group Develop Test Plan Approval of Test Plan Perform independent testing based on defined IPsec parameters Modify test plan test only IPV4 Connection between agencies end point devices. Started compatibility testing Completed compatibility tests Documentation of test results Document Lessons Learned Present results to CCSDS working group April 2016 Key deliverable Test report in CCSDS format for yellow book

CCSDS IPsec Compatibility Testing 05/4/2016 CHARLES SHEEHE, CCSDS GRC POC OKECHUKWU MEZU, Test Engineer

IPsec Project Overview Performing Encapsulating Security Payload (ESP) using pre-shared keys on a CCSDS Internet Protocol (IP) packet going from source node over a satellite in space to a destination node Why this is important? Network Layer Security Adaptation Profile, which is to adapt and standardize the IETF's Internet Protocol Security (IPsec) protocol for use by CCSDS on missions replacing SCPS-SP Two independent compatible developments are required prior to acceptance NASA GRC IPsec implementation will satisfy one independent development CNES IPsec implementation will satisfy the second independent development Compatibility tests to ensure interoperability Compatibility test will be recorded in the CCSDS 356.1-Y-1 book as official documentation of testing CCSDS IPsec NASA development and testing started November 2013

IPsec Project Process IPsec compatibility testing for CCSDS Evaluate IPsec/CCSDS related standards Define CCSDS/IPsec approved parameters by CCSDS working group Develop Test Plan Approval of Test Plan Perform independent testing based on defined IPsec parameters Modify test plan test only IPV4 Connection between agencies end point devices. Started compatibility testing Completed compatibility tests Documentation of test results Document Lessons Learned Present results to CCSDS working group April 2016 Key deliverable Test report in CCSDS format for yellow book

NASA Internal IPV4 IPsec VPN Tunnel Tests Cisco 3825 Router Ground Station R1 CCSDS Satellite R2 GE 0/0 192.168.1.1 GE 0/1 192.168.2.1 GE 0/0 192.168.2.2 GE 0/1 192.168.3.1 GE 0/1 192.168.4.1 GE 0/2 192.168.3.2 192.168.1.2 192.168.4.2 IPsec VPN Legend GE – Gigabit Ethernet Receive Station R3 Internal IPsec IPv4 tests completed Linux Box Linux Box Tunnel represents a direct logical connection between R1 & R3 through R2. However, all communication between R1 & R3 go through R2 (representing a satellite/networked cloud)

CCSDS IPV4 IPsec VPN Tunnel Legend GE – Gigabit Ethernet Current CCSDS IPv4 IPsec VPN Tunnel setup and configuration

Modified* CCSDS Yellow Book IPsec Test Matrix # IPV4 ESP Tunnel Integrity IPcomp Authenticated Encryption Confidentiality Manual Key Auto Key No Rekey 1* 4 X   2 X* 3* 5 6 7 8 * firewall restrictions, No IP Compression allowed and Phase one tunnel requires HASH, Tests #1 & #3 were not completed due to compatibility issues between Cisco & Palo Alto routers on Manual keying of 10

CCSDS IPsec Compatibility issues Firewall restrictions Firewall will not allow compressed packets to pass through. Internet Protocol compression is being removed from future Internet Engineering Task Force Transport Layer Security. Firewall requires an null hash value for phase one tunnel Compatibility issues, Palo Alto devices would not allow manual keying options. of 10

Lessons Learned Configurations must be shared and tested in advance. Successful test configuration files should be maintained for future connection issue. IPcomp should be removed from IP security documentation compressed packets not allowed to pass through firewall because they can not be inspected. Internet Protocol compression is being removed from future Internet Engineering Task Force Transport Layer Security Firewalls, vendor equipment and software differences are major obstacle to connections with legacy / space systems

We at NASA Glenn would like to thank; Julien Airaud and the team from CNES, it has been a much valued partnership.

Backup

Questions