Collaborate Disseminate
I wanted to set up a Site-to-Site IPsec with Ikev2 between two ASAs and I want to use certificates issued by my MS CA for authentication. The Ikev2 Phase 1 aborts with an error message stating that the certificates are not su… Continue reading OIDs for certificate based Ikev2 IPsec Site-to-Site between two ASAs
I wanted to set up a Site-to-Site IPsec with Ikev2 between two ASAs and I want to use certificates issued by my MS CA for authentication. The Ikev2 Phase 1 aborts with an error message stating that the certificates are not su… Continue reading OIDs for certificate based Ikev2 IPsec Site-to-Site between two ASAs
RFC2407 outlines the Identification Payload in section 4.6.2, which appears in the fifth and sixth packets of the Main Mode’s SA negotiation when using IKEv1. What is this information used for?
From what I understand, when u… Continue reading What is the Identification Payload of RFC2407 used for in IPsec?
There is many articles that describe some exploitation techniques on a VPN with IPSec – IKE-PSK.
However, I can’t understand how the flaws may exist. Thus, I have some question relating to that:
1) Why, in Aggressive mode, … Continue reading How does IKE with PSK really work and how secure is it?
Today, I was diving deep into IPsec VPN and came across a multiple terms – Domain of Interpretation and Situation.
I referred to various articles and even RFC. But all are definitive answers.
DOI
Within ISAKMP, a Domain… Continue reading DOI and Situation in IPsec
I have problems understanding why you would negotiate crypto-algorithms in the Create_Child_SA request in a IKEv2.
During IKE_SA_INIT you negotiate cryptographic algorithms which I assume (correct me if I am wrong) are very … Continue reading What’s the point of the second SA exchange in the Create_Child_SA exchange in IPsec
This guy argues it is not: https://www.youtube.com/watch?v=DuowFgNKAIg
I really confused about this. According to him, the only purpose of main mode is to make the peers anonymous, but in order to use main mode you need to manually config… Continue reading Is IKE aggressive mode really less secure than main mode?
This is what a casual IKEv2 handshake looks like :
Initiator Responder
| |
1|——————-… Continue reading Key exchange during IKE_AUTH phase of IKEv2
Some articles and Websites (Wikipedia and Cisco for instance) claim that unlike IKEv1, IKEv2 provides a support for Dead Peer Detection. However, unlike NAT traversal or DoS attacks for example, the official RFC 4306 did not … Continue reading IKEv2 and Dead Peer Detection
IPsec uses ISAKMP + OAKLEY + SKEME right? This is strange but even after checking the RFC of OAKLEY, i couldnt find what it basically stands for? Can someone please point me to the right direction or answer me here?