What is IPSec?

Internet Protocol Security, commonly abbreviated as IPSec, comprises a collection of standardized protocols designed to establish encrypted and authenticated connections across networks. The Internet Protocol (IP) serves as the foundational standard governing how data packets move through the Internet and other IP-based networks. IPSec functions as a protective layer that incorporates encryption and authentication mechanisms to strengthen the underlying protocol. In practical terms, it encodes information at the sending endpoint and decodes it upon arrival at the destination, while simultaneously verifying the data's origin.

Why is IPSec important?

The Internet Engineering Task Force (IETF) established the IP Security Working Group during the 1990s with the goal of guaranteeing data confidentiality, integrity, and authenticity across public networks. Without protective measures, network transmissions remain inherently vulnerable. IPSec delivers encryption capabilities that restrict decryption access to authorized recipients only. For instance, personnel can establish secure connections through an IPSec virtual private network (VPN) to retrieve confidential organizational documents from remote locations. The protocol safeguards confidential data against unauthorized surveillance and enables servers to confirm that received packets originate from legitimate sources.

What are the uses of IPSec?

  • Safeguard routing infrastructure during data transmission across the public internet
  • Apply encryption to IP packets at the network layer
  • Rapidly authenticate data packets when their source is verified as trustworthy
  • Defend network information through encrypted pathways, known as IPsec tunnels, that protect all communications between two connection points

Organizations deploy IPSec to defend against replay attacks, a category of man-in-the-middle assault where an attacker intercepts previously transmitted data and resends it to the destination. Such attacks can exhaust recipient system resources. IPSec mitigates this threat by assigning sequential identifiers to each packet and implementing verification mechanisms to identify duplicate transmissions.

What is IPSec encryption?

IPSec encryption represents a computational process that converts readable data into an unreadable format, preventing unauthorized access to its substance. An encryption key transforms the original information, while a corresponding decryption key restores it to readable form. The IPSec framework accommodates multiple encryption approaches, including AES and legacy methods such as 3DES.

IPSec employs both asymmetric and symmetric encryption methodologies to balance performance with security during information exchange. Asymmetric encryption maintains a publicly available encryption key alongside a privately held decryption key. Symmetric encryption utilizes an identical shared key for both encryption and decryption operations in IP network communications. IPSec initiates connections using asymmetric encryption, then transitions to symmetric encryption to accelerate subsequent data transfers.

How does IPSec work?

IPSec facilitates secure data interchange between computing systems through a collection of protocols, mathematical algorithms, and cryptographic key administration techniques. The protocol operates at the network layer within the OSI model, incorporating multiple protocols and an initial negotiation phase preceding actual data transmission. The OSI model outlines the hierarchical framework through which networked computers communicate. Prior to information exchange, both communicating parties perform mathematical calculations to establish mutually agreed cryptographic keys.

When transmitting data, the network stack segments information into smaller packets. Subsequently, it attaches supplementary sections containing encryption and verification details to these payloads.

  • Encryption blocks unauthorized parties from accessing the underlying content
  • Authentication enables the recipient to accurately determine the packet's source and confirm no tampering has occurred

The following sequence describes how systems transmit data using IPSec:

  1. The originating system evaluates whether the transmission requires IPSec safeguards by consulting its security configuration. If protection is necessary, it initiates a secure IPSec session with the receiving system
  2. Both systems confer to establish connection parameters, including mutual agreement on encryption, authentication, and other security association (SA) specifications
  3. The systems exchange encrypted information while confirming its derivation from authorized sources and verifying the underlying payload's reliability
  4. Upon transmission completion or session expiration, the system terminates the IPSec connection

What are the IPSec protocols?

IPSec protocols facilitate the secure transmission of data packets. A data packet represents a standardized structure that organizes information for network delivery, consisting of three components:

  • A header is an introductory section containing routing instructions that direct the packet to its intended recipient
  • Payload denotes the substantive information contained within a data packet
  • The trailer is supplementary information positioned at the packet's conclusion to signal transmission termination

Several key IPSec protocols facilitate secure communications:

Authentication header (AH) protocol

The authentication header (AH) protocol incorporates a header section holding sender verification information and guards packet contents against unauthorized alteration. It notifies the recipient of potential tampering with the original packet. Upon receiving a packet, the system calculates a cryptographic hash from the payload and compares it against the authentication header value to confirm alignment. A cryptographic hash represents a mathematical computation that reduces data to a distinctive numerical representation.

Encapsulating Security Payload (ESP) protocol

The encapsulating security payload (ESP) protocol applies encryption to either the complete IP packet or solely its payload, depending on the operational mode selected. ESP introduces both header and trailer elements to the encrypted packet.

Internet Key Exchange (IKE) protocol

Internet Key Exchange (IKE) establishes encrypted network communication pathways between two Internet-connected systems. The systems create an IPSec security association (SA) through the Internet Security Association and Key Management Protocol (ISAKMP), a process encompassing negotiation of encryption keys and algorithms for subsequent packet transmission and reception. Contemporary IPSec implementations utilize IKEv2, which streamlines key exchange procedures and delivers enhanced compatibility with portable computing devices.

What are IPSec modes?

IPSec functions through two distinct operational modes, each providing varying levels of protective coverage.

Tunnel mode

IPSec tunnel mode delivers heightened protection suitable for transmitting confidential information across public networks. The system encrypts the entire packet, encompassing both the payload and the original IP header, then prepends a fresh header to the encrypted content.

Transport mode

IPSec transport mode restricts encryption to the packet's payload portion, preserving the IP header in its unmodified state. The unencrypted header permits routing infrastructure to determine each packet's destination. Consequently, IPSec transport finds widespread adoption in controlled environments, such as facilitating protected communications between individual systems.

What is IPSec VPN?

A virtual private network (VPN) represents networking infrastructure enabling users to retrieve distant resources with privacy and security across public networks. An IPSec VPN constitutes a VPN variant leveraging the IPSec protocol collection to construct encrypted pathways on the Internet. It furnishes comprehensive encryption spanning the entire communication path, with data becoming encoded at the source system and decoded at the receiving endpoint.

SSL VPN

Secure Sockets Layer (SSL) designates a security protocol that shields web communications. An SSL VPN typically operates as a web browser-compatible network protection service employing the integrated SSL protocol to encode and defend network interactions. Present-day SSL VPN implementations have substituted the SSL protocol with Transport Layer Security (TLS), its successor, though the SSL VPN designation persists.

What is the difference between IPSec VPN and SSL VPN?

IPSec and SSL VPN protocols operate at distinct positions within the Open Systems Interconnection (OSI) model. IPSec VPNs function at the network layer in the OSI model's middle section. Conversely, SSL VPNs apply encryption at the session and presentation layers.

SSL VPN protects HTTP web communications and additional traffic through TLS, whereas IPSec VPNs encrypt all IP-based traffic. Enterprises frequently implement IPSec VPNs for site-to-site connectivity, while SSL VPN may prove more appropriate for accessing particular applications. SSL VPN access requires only a web browser, but IPSec VPN deployment demands operating system configuration modifications or supplementary software installation.

What are the considerations when implementing IPSec?

IPSec safeguards network communications through IP-level encryption and verification mechanisms. Nevertheless, implementation teams encounter multiple obstacles during IPSec configuration and operational deployment. The following represent typical implementation considerations:

  • Packet fragmentation. IPSec introduces supplementary headers to payloads, potentially causing packets to surpass the network's maximum segment size (MSS) and maximum transmission unit (MTU) thresholds. Packets exceeding MSS undergo division into fragments, while those exceeding MTU face removal from transmission
  • Configuration complexity. Deploying IPSec demands experienced technical personnel to establish numerous parameters upon which the protocol depends. These encompass encryption methodologies, cryptographic key administration, and IPSec protocol selections
  • NAT traversal. Network address translation (NAT) constitutes a technique employed by contemporary routers to coordinate traffic between numerous private IP addresses and a singular public IP address. IPSec typically conveys information via ESP, which NAT infrastructure blocks. Enabling NAT traversal necessitates IT personnel to encapsulate the IPsec packet within UDP transmission on port 4500
  • Performance overhead. IPSec encryption of payloads or complete IP packets demands computational resources, potentially increasing transmission delays and diminishing network throughput. Organizations can leverage Amazon EC2 X1e instances, which incorporate contemporary processors featuring AES-NI support, to mitigate this performance impact

How does AWS support IPSec connections?

AWS Site-to-Site VPN represents a fully managed offering that establishes encrypted pathways between organizational data centers or branch locations and AWS infrastructure through IPSec tunnels. Utilizing Site-to-Site VPN permits connections to both Amazon Virtual Private Cloud (VPC) resources and on-premises AWS Transit Gateway infrastructure, with dual tunnels per connection providing redundancy assurance.

AWS Site-to-Site VPN delivers numerous advantages:

  • Transparency into on-site and distant network conditions via performance analytics
  • Protected and streamlined relocation of on-premises systems to AWS cloud environments
  • Enhanced system responsiveness through AWS Global Accelerator integration

Source: AWS News Blog