95
edits
Changes
no edit summary
In computing, '''Internet Protocol Security''' ('''IPsec''') is a secure network protocol suite of IPv4 that authenticates and encrypts the packets of data sent over an IPv4 network. IPsec includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to use during the session. IPsec can protect data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host). Internet Protocol security (IPsec) uses cryptographic security services to protect communications over Internet Protocol (IP) networks. IPsec supports network-level peer authentication, data-origin authentication, data integrity, data confidentiality (encryption), and replay protection.
In computing, '''Internet Protocol Security''' ('''IPsec''') is a secure network protocol suite of IPv4 that authenticates and encrypts the packets of data sent over an IPv4 network. IPsec includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to use during the session. IPsec can protect data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host). Internet Protocol security (IPsec) uses cryptographic security services to protect communications over Internet Protocol (IP) networks. IPsec supports network-level peer authentication, data-origin authentication, data integrity, data confidentiality (encryption), and replay protection.
This article provides an extensive configuration example with details on how to create a tunnel connection authenticating with CA Certs between two IPsec instances, both of which configured on RUTxxx routers.
This article provides an extensive configuration example with details on how to create a tunnel connection authenticating with X.509 Certs between two IPsec instances, both of which configured on RUTxxx routers.
==Configuration overview and prerequisites==
==Configuration overview and prerequisites==
The following are the settings used for this example, but values should be changed depending on your specific needs:
The following are the settings used for this example, but values should be changed depending on your specific needs:
- File Type: `CA`
- File Type: '''''CA'''''
- Key Size: `1024`
- Key Size: `1024`
- `Generate` Certificate
- `Generate` Certificate
<br>
[[File:IPSec CA Cert Generating.png|frame|none]]
[[File:IPSec CA Cert Generating.png|frame|none]]
<br>
<br>
After you hit Generate the CA cert you should see a confirmation notification pop-up near the top right, and if you select Certificates Manager you should see a CAIPSec.key.pem under *Keys* and a CAIPSec.req.pem under *Certificate requests*.
After you hit Generate the CA cert you should see a confirmation notification pop-up near the top right, and if you select Certificates Manager you should see a CAIPSec.key.pem under *Keys* and a CAIPSec.req.pem under *Certificate requests*.
<br>
[Screenshot Here]
[[File:IPSec CA Cert Generating Confirmation.png|frame|none]]
[Screenshot Here]
[[File:IPSec CA Cert Generating Manager Check.png|frame|none]]
<br>
Next we need to sign the CAIPSec CA. We will be Self-Signing our own CA.
Next we need to sign the CAIPSec CA. We will be Self-Signing our own CA.
Under the `Certificate signing` configure as follows:
Under the `Certificate signing` configure as follows:
- `Sign`
- `Sign`
<br>
[Screenshot Here]
[[File:IPSec CA Cert Signing.png|frame|none]]
<br>
After you hit *Sign* the CA cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a CAIPSec.cert.pem under *Certificates*.
After you hit *Sign* the CA cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a CAIPSec.cert.pem under *Certificates*.
<br>
[Screenshot Here]
[[File:IPSec CA Cert Generating Confirmation2.png|frame|none]]
<br>
====Generating Rut1 Client Cert====
====Generating Rut1 Client Cert====
- `Generate` Certificate
- `Generate` Certificate
<br>
[Screenshot Here]
[[File:IPSec RUT1 Cert Generating.png|frame|none]]
<br>
After you hit Generate the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT1.key.pem under *Keys* and a RUT1.req.pem under *Certificate requests*.
After you hit Generate the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT1.key.pem under *Keys* and a RUT1.req.pem under *Certificate requests*.
<br>
[[File:IPSec RUT1 Cert Generating Confirmation.png|frame|none]]
<br>
Next we need to sign the RUT1 cert.
Next we need to sign the RUT1 cert.
- `Sign`
- `Sign`
<br>
[Screenshot Here]
[[File:IPSec RUT1 Cert Signing.png|frame|none]]
<br>
After you hit *Sign* the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT1.cert.pem under *Certificates*.
After you hit *Sign* the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT1.cert.pem under *Certificates*.
<br>
[[File:IPSec RUT1 Cert Manager Check.png|frame|none]]
<br>
====Generating Rut2 Client Cert====
====Generating Rut2 Client Cert====
- `Generate` Certificate
- `Generate` Certificate
<br>
[Screenshot Here]
[[File:IPSec RUT2 Cert Generating.png|frame|none]]
<br>
After you hit Generate the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT2.key.pem under *Keys* and a RUT1.req.pem under *Certificate requests*.
After you hit Generate the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT2.key.pem under *Keys* and a RUT1.req.pem under *Certificate requests*.
<br>
[Screenshot Here]
[[File:IPSec RUT2 Cert Generating Confirmation.png|frame|none]]
<br>
Next we need to sign the RUT2 cert.
Next we need to sign the RUT2 cert.
Under the `Certificate signing` configure as follows:
Under the `Certificate signing` configure as follows:
- `Sign`
- `Sign`
<br>
[[File:IPSec RUT2 Cert Signing.png|frame|none]]
<br>
After you hit *Sign* the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT2.cert.pem under *Certificates*.
After you hit *Sign* the Client cert you should see a notification pop-up near the top right, and if you select Certificates Manager you should see a RUT2.cert.pem under *Certificates*.
<br>
[Screenshot Here]
[[File:IPSec RUT2 Cert Manager Check.png|frame|none]]
<br>
====Download/Import Certs====
====Download/Import Certs====
----
----
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
* Add a new instance called `CA_EX`
* Add a new instance called `CA_EX`
[Screenshot Here]
<br>
[[File:IPSec RUT1 Config Add CA EX.png|frame|none]]
<br>
* IPsec Instance General settings configuration as follows:
* IPsec Instance General settings configuration as follows:
- Remote identifier: `192.168.14.1` // We will use the LAN IP of RUT2 for the Identifier
- Remote identifier: `192.168.14.1` // We will use the LAN IP of RUT2 for the Identifier
<br>
[Screenshot Here]
[[File:RUT1 IPSec Instance General Settings Configuration.png|frame|none]]
<br>
* IPsec Instance Advanced settings configuration as follows:
* IPsec Instance Advanced settings configuration as follows:
- Remote certificate: `RUT2.cert.pem` // Upload RUT2 cert we created earlier.
- Remote certificate: `RUT2.cert.pem` // Upload RUT2 cert we created earlier.
[Screenshot Here]
<br>
[[File:RUT1 IPSec Instance Advanced Settings Configuration.png|frame|none]]
<br>
* Connection settings General settings configuration as follows:
* Connection settings General settings configuration as follows:
- Key exchange: `IKEv2`
- Key exchange: `IKEv2`
[Screenshot Here]
<br>
[[File:RUT1 IPSec Connection Settings General Settings Configuration.png|frame|none]]
<br>
* Connection settings Advanced settings configuration as follows:
* Connection settings Advanced settings configuration as follows:
- The rest of the configuration leave as default
- The rest of the configuration leave as default
<br>
[[File:RUT1 IPSec Connection Settings Advanced Settings Configuration.png|frame|none]]
<br>
* Connection settings Proposal settings configuration as follows:
* Connection settings Proposal settings configuration as follows:
- IKE lifetime: `3h`
- IKE lifetime: `3h`
[Screenshot Here]
<br>
[[File:RUT1 IPSec Proposal Settings Phase1.png|frame|none]]
<br>
* Phase 2
* Phase 2
- IKE lifetime: `3h`
- IKE lifetime: `3h`
[Screenshot Here]
<br>
[[File:RUT1 IPSec Proposal Settings Phase2.png|frame|none]]
<br>
* Hit 'Save & Apply'
* Hit 'Save & Apply'
* Toggle the CA_EX tunnel on and hit 'Save & Apply' once more
* Toggle the CA_EX tunnel on and hit 'Save & Apply' once more
[Screenshot Here]
<br>
[[File:RUT1 IPSec Toggle On Save And Apply.png|frame|none]]
<br>
* Reboot the device once you have finished.
* Reboot the device once you have finished.
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
* Login to the router's WebUI and go to '''System → Services → VPN -> IPsec'''
* Add a new instance called `CA_EX`
* Add a new instance called `CA_EX`
[Screenshot Here]
<br>
[[File:IPSec_RUT1_Config_Add_CA_EX.png|frame|none]]
<br>
* IPsec Instance General settings configuration as follows:
* IPsec Instance General settings configuration as follows:
- Remote identifier: `192.168.3.1` // We will use the LAN IP of RUT1 for the Identifier
- Remote identifier: `192.168.3.1` // We will use the LAN IP of RUT1 for the Identifier
<br>
[[File:RUT2 IPSec Instance General Settings Configuration.png|frame|none]]
<br>
* Connection settings Advanced settings configuration as follows:
* Connection settings Advanced settings configuration as follows:
- Remote certificate: `RUT1.cert.pem` // Upload RUT1 cert we created earlier.
- Remote certificate: `RUT1.cert.pem` // Upload RUT1 cert we created earlier.
[Screenshot Here]
<br>
[[File:RUT2 IPSec Instance Advanced Settings Configuration.png|frame|none]]
<br>
* Connection settings General settings configuration as follows:
* Connection settings General settings configuration as follows:
- Key exchange: `IKEv2`
- Key exchange: `IKEv2`
<br>
[[File:RUT2 IPSec Connection Settings General Settings Configuration.png|frame|none]]
<br>
* Connection settings Advanced settings configuration as follows:
* Connection settings Advanced settings configuration as follows:
- The rest of the configuration leave as default
- The rest of the configuration leave as default
[Screenshot Here]
<br>
[[File:RUT2 IPSec Connection Settings Advanced Settings Configuration.png|frame|none]]
<br>
* Connection settings Proposal settings configuration as follows:
* Connection settings Proposal settings configuration as follows:
- IKE lifetime: `3h`
- IKE lifetime: `3h`
[Screenshot Here]
<br>
[[File:RUT2 IPSec Proposal Settings Phase1.png|frame|none]]
<br>
* Phase 2
* Phase 2
- IKE lifetime: `3h`
- IKE lifetime: `3h`
[Screenshot Here]
<br>
[[File:RUT2 IPSec Proposal Settings Phase2.png|frame|none]]
<br>
* Hit 'Save & Apply'
* Hit 'Save & Apply'
* Toggle the CA_EX tunnel on and hit 'Save & Apply' once more
* Toggle the CA_EX tunnel on and hit 'Save & Apply' once more
[Screenshot Here]
<br>
[[File:RUT2 IPSec Toggle On Save And Apply.png|frame|none]]
<br>
* Reboot the device once you have finished.
* Reboot the device once you have finished.
* SSH into RUT1 device
* SSH into RUT1 device
* `ipsec statusall` // This should show 2 up with Security Associations and that the connection should be up for some minutes. You should also see the Cert info from the certs we created earlier.
* `ipsec statusall` // This should show 2 up with Security Associations and that the connection should be up for some minutes. You should also see the Cert info from the certs we created earlier.
<br>
[[File:RUT1 IPSec Status.png|frame|none]]
<br>
* `ping 192.168.14.1` // You should get a response if the tunnel has established properly
* `ping 192.168.14.1` // You should get a response if the tunnel has established properly
[Screenshot Here]
<br>
[[File:RUT1 Ping To RUT2 Check.png|frame|none]]
<br>
* SSH into RUT2 device
* SSH into RUT2 device
* `ipsec statusall` // This should show 2 up with Security Associations and that the connection should be up for some minutes. You should also see the Cert info from the certs we created earlier.
* `ipsec statusall` // This should show 2 up with Security Associations and that the connection should be up for some minutes. You should also see the Cert info from the certs we created earlier.
[Screenshot Here]
<br>
[[File:RUT2 IPSec Status.png|frame|none]]
<br>
* `ping 192.168.3.1` // You should get a response if the tunnel has established properly
* `ping 192.168.3.1` // You should get a response if the tunnel has established properly
[Screenshot Here]
<br>
[[File:RUT2 Ping To RUT1 Check.png|frame|none]]
<br>
* SSH into RUT1 device
* SSH into RUT1 device
* On RUT1 wait 10 seconds then CTRL+C to stop the program
* On RUT1 wait 10 seconds then CTRL+C to stop the program
* Then use a program like WinSCP to download `Checking_For_ESP_Packets.pcap` from RUT1
* Then use a program like WinSCP to download `Checking_For_ESP_Packets.pcap` from RUT1
* Open the file in a program called Wireshark and filter for encrypted ESP packets with this `_ws.col.protocol == "ESP"`. You should see ESP packets from both the WAN IPs. You shouldn't be able to see inside the packet because it is now encrypted, but if we decrypted the packets we would see the ICMP packets between the 2 RUT devices.
* Open the file in a program called Wireshark and filter for encrypted ESP packets with this '''_ws.col.protocol == "ESP"'''. You should see ESP packets from both the WAN IPs. You shouldn't be able to see inside the packet because it is now encrypted, but if we decrypted the packets we would see the ICMP packets between the 2 RUT devices.
[Screenshot Here]
<br>
[[File:Checking Pcap With Wireshark.png|frame|none]]
<br>
===RUT1 LAN device to RUT2 LAN device Test===
===RUT1 LAN device to RUT2 LAN device Test===
* Perform similar steps above for a 2nd device connected to RUT2 LAN
* Perform similar steps above for a 2nd device connected to RUT2 LAN
* Once both devices are connected to the LAN of RUT1 & RUT2 you should be able to ping the devices from each other.
* Once both devices are connected to the LAN of RUT1 & RUT2 you should be able to ping the devices from each other.
<br>
[[File:LAN To LAN Device Ping.png|frame|none]]
<br>
* Afterwards make sure to re-enable the firewall for both LAN devices
* Afterwards make sure to re-enable the firewall for both LAN devices