[Day 12] 5. IP Sec (IP Security)

IPsec (Internet Protocol Security)

IPsec is a protocol suite designed to secure IP communications by authenticating and encrypting each IP packet in a data stream. It ensures the confidentiality, integrity, and authenticity of the data being transmitted.

IPsec is often seen as an improvement or next step beyond protocols like GRE because, while GRE allows for encapsulation of packets, IPsec adds encryption and security features to the encapsulated traffic, providing more robust protection.

---

IPsec Modes

There are two primary modes in IPsec: Tunnel Mode and Transport Mode.

1. Tunnel Mode

• Entire IP packet is encrypted: In this mode, IPsec encapsulates and encrypts the entire original IP packet (including its headers and payload) inside a new packet with a new IP header.

• Common Use Case: Tunnel mode is typically used when VPNs (Virtual Private Networks) are created between two gateways (such as routers or firewalls) to secure communication between different networks.

  Example: If you're connecting two remote sites over the internet, IPsec in tunnel mode will hide the internal network addresses and encrypt the entire communication between the sites.

  Process:

  • The original IP packet (e.g., source and destination IPs) is encapsulated and encrypted.
  • A new outer IP header is added, which has the public-facing IP addresses of the two endpoints.
  • The encapsulated packet travels through the internet, and at the destination, it's decrypted and the original packet is extracted.

2. Transport Mode

• Only the payload (data) is encrypted: In this mode, IPsec only encrypts the payload of the IP packet, leaving the original IP headers intact. The header is visible to network devices, but the data (payload) remains protected.

• Common Use Case: Transport mode is often used for end-to-end communication between two devices (e.g., between two computers) where IPsec is applied directly between the hosts.

  Example: When securing communication between a client and a server in an internal network, IPsec in transport mode can ensure data confidentiality without hiding the IP addresses.

  Process:

  • The original IP header stays visible, while only the payload (the data being transmitted) is encrypted.
  • This means network devices can still route the packet using the original IP header, but they cannot read the data inside.

---

IPsec Components

1. ESP (Encapsulating Security Payload):

   • ESP provides confidentiality (encryption), data integrity, and authentication.
   • Encryption: ESP ensures that the payload is encrypted, making it unreadable by unauthorized parties.
   • Data integrity: Ensures that the data has not been altered during transmission.
   • Authentication: Verifies the identity of the parties exchanging data.

   ESP can be used in both Tunnel Mode and Transport Mode.

2. AH (Authentication Header)

   • AH provides data integrity and authentication but does not provide encryption. It is primarily used to ensure that the data has not been modified in transit and to authenticate the source of the data.
   • Unlike ESP, AH does not encrypt the data, so the payload remains visible to anyone who intercepts the packet.

   AH can also be used in both Tunnel Mode and Transport Mode, but it's less common due to its lack of encryption.

---

IPsec vs. GRE

While both IPsec and GRE can encapsulate traffic, IPsec provides a higher level of security due to its encryption and authentication features. Here's a comparison:

• GRE (Generic Routing Encapsulation):
  • GRE allows you to encapsulate packets and create tunnels between two routers, but it does not encrypt or protect the contents of the packets.
  • GRE is mainly used to route private traffic over public networks without altering the payload but provides no confidentiality.
• IPsec:
  • IPsec adds encryption, data integrity, and authentication to the encapsulated traffic, making it more secure than GRE.
  • IPsec is commonly used for creating VPNs (Virtual Private Networks) where the privacy and security of the data being transmitted is critical.
  • In Tunnel Mode, IPsec encapsulates the entire packet (like GRE) but also encrypts it, providing confidentiality.

---

Summary of Key Concepts

1. IPsec encrypts traffic to ensure confidentiality, integrity, and authentication.
2. Tunnel Mode: The entire IP packet (header + data) is encapsulated and encrypted, commonly used for site-to-site VPNs.
3. Transport Mode: Only the payload (data) is encrypted, leaving the IP headers intact, used for end-to-end encryption between hosts.
4. ESP is the primary protocol used in IPsec for encryption, data integrity, and authentication.
5. IPsec offers a secure and robust alternative to GRE, as it adds encryption and other security features, making it the standard for secure communication over untrusted networks like the internet.

---

Example Use Case

• VPN between two sites: You have two remote offices with routers, and you want to securely connect them over the public internet. You would use IPsec in Tunnel Mode to encrypt the traffic between the two routers, so both offices can communicate securely.

  • IPsec Tunnel: Router A on one site encapsulates and encrypts the data, sending it through the internet to Router B. Router B decrypts the data and forwards it to the internal network.

---