1. IPSec in a Multi-OS Environment

2. What is IPSec? IPSec stands for Internet Protocol Security It is at a most basic level a way of adding security to your network traffic without having to modify the applications that are using IP

3. Why is IPSec needed? IPSec is needed to make sure that no one is reading your private data. It makes sure that the sender of the information is really who they say they are. To protect us from the bad guys (l33t h4X0r5 and 5cr1pt K1d135).

4. Where is IPSec Used? Wireless nets Virtual Private Networks (VPNs) Non-trusted Local Area Networks (LANs)

5. IP Overview How IP Works –Basics –Parts of a Packet What is Insecure About it

6. IP Basics The IP protocol breaks down information that is to be sent out into small manageable pieces called packets Packets are reassembled at the receiving side

7. Parts of an IP Packet Two Major Parts –Header –Data Section

8. Parts of the Header Source Address Destination Address Protocol Fragment Flag Total Length Type of Service And more…

9. Data Section This portion holds all of the data that you are trying to transmit

10. What is insecure about IP Traffic in many cases is in plain text. No verification the the sender is who they say they are. No way of knowing if you packet was modified in the middle.

11. What IPSec does. Authentication Encryption With Two Major modes –Tunnel –Transport AH + ESP AH ESP

12. Authentication An Authentication Headers (AH) portion is added to the IP Packet The AH contains fields –Next Header –AH payload length –Security Parameters Index (SPI) –Anti-Replay Sequence number –Authentication Data field (Information dependent on the cipher used)

13. Encryption The encryption part of IPSec is know as Encapsulating Security Payload (ESP) The ESP portion of the packet contains –A SPI Number –Sequence Number –Payload Data field –Padding –Pad length –Next Header

14. Tunnel mode IP Header AH Header SPI and Sequence Number IP Header Upper Protocol Headers and Packet Data ESP Trailer ESP Authentication Data Note: Fields in Green are Encrypted

15. Transport mode IP Header AH Header SPI and Sequence Number Upper Protocol headers and Packet Data ESP Trailer ESP Authentication Data Note: Fields in Green are Encrypted

16. Keying The Encryption algorithms that IPSec uses rely on keys Methods for Getting Keys –Manual Keying –Internet Security Association and Key Management Protocol (ISAKMP) –Certificates

17. Why Doesn’t Everyone Use It? Implementations for different operating systems are not fully compatible Takes time and energy to setup Not needed in most environments

18. Multiple Operating Systems Solaris – Only supports Manual Keying –Does not ship with Enc. Algs. Linux – No native IPSec –FreeSWA/N – Manual, ISAKMP, and Certs OpenBSD – Manual, ISAKMP, and Certs Windows 2000 - ISAKMP, and Certs

19. IPSec Graph

20. Questions?