Collaborate Disseminate
Can you explain what is Child SA? Is this exchange used only for rekey IKEv2 OR ESP or this exchange is used for rekey IKE SA AND Child SA at the same time?
What is IKE SA? Is it a set of params (keys, ciphersuites and etc) or smth else?… Continue reading I don’t understand ipsec
When one peer is trying to negotiate an ESP SA, it sends a security association (SA) payload to the other peer. This SA payload must contain at least one proposal, suggesting at least one encryption and one integrity transform to use. It m… Continue reading Do IKEv2 ESP proposals really require a unquie SPI per proposal?
What are the purposes of having the IKE SAs in IKEv2?
I see that the IKEv2 has IKE SA and IPsec SA. So I’m thinking that IKE SA is to secure the negotiation for IPsec. Is that alright and is there any other purposes?
Thank you very much!
… Continue reading What are the purposes of having the IKE SAs in IKEv2?
I am having troubles creating an IPsec tunnel between Azure and my Fortigate. I am looking over the documentation and I see a difference between the nomenclature. In Azure, I see "PFS" groups, and in Fortigate, I see "DH&quo… Continue reading VPN IPsec Azure to Fortinet [closed]
I setup an IKE VPN server for road warriors. I actually have this working (YAY!) but took some shortcuts that are leaving me with a working yet not-right/secure setup. My setup is as follows:
My server (DNS name vpn.mydomain.com) contains … Continue reading Where should private key(s) reside in IPsec VPN tunnel
I am trying to "enforce" IPSec (StrongSwan) traffic on openSUSE.
On OpenBSD, with the IKE daemon iked and the packet filter pf, I employ a ruleset like the following, to ensure only encapsulated traffic passes the interface, prac… Continue reading firewalld: Block non-ESP packets on interface in GNU/Linux similar to OpenBSD
I am trying to "enforce" IPSec (StrongSwan) traffic on openSUSE.
On OpenBSD, with the IKE daemon iked and the packet filter pf, I employ a ruleset like the following, to ensure only encapsulated traffic passes the interface, prac… Continue reading firewalld: Block non-ESP packets on interface in GNU/Linux similar to OpenBSD
I’m confused how the CA server helps with the digital signature and the PKI workflow. Here’s an example topology:
A and B are the 2 devices using PKI to authenticate each other for VPN, and then there is a CA server (will refer to it as CA… Continue reading What is the role of a CA server in a PKI?
I am currently writing a thesis about different cryptographic protocols like DH-Key exchange, TLS or IKE.
Most of them rely on a prime number earlier or later, so for security reasons I wondered if this prime number is supplied by the user… Continue reading Who provides prime numbers for cryptographic protocols? [migrated]
I have two gateways, I start IPSec in both via ipsec start –nofork in gw2 first (but the same problem happens if I start IPSec on gw1 first)
However, about 10 seconds after the ike SA is done, the reverse (from gw2 to gw1) ike happens and… Continue reading Why does ipsec create a new connection?