CCSDS IPsec Compatibility Testing 03/23/2015 OKECHUKWU MEZU CHARLES SHEEHE CCSDS GRC POC

IPsec Project Overview Performing Encapsulating Security Payload (ESP) using pre-shared keys on a CCSDS Internet Protocol (IP) packet going from source node over a satellite in space to a destination node Why this is important Two independent compatible developments are required prior to acceptance NASA GRC IPsec implementation will satisfy one independent development CNES IPsec implementation will satisfy the second independent development Compatibility tests to ensure interoperability Compatibility test will be recorded in the CCSDS 356.1-Y-1 book as official documentation of testing CCSDS IPsec NASA development and testing started November 2013

IPsec Project Process IPsec compatibility testing for CCSDS Evaluate IPsec/CCSDS related standards Define CCSDS/IPsec approved parameters by CCSDS working group Develop Test Plan Approval of Test Plan Perform independent testing based on defined IPsec parameters Modify test plan test only IPV4 Perform Compatibility Testing Documentation of test results Document Lessons Learned Present results to CCSDS working group Key deliverable Test report in CCSDS format for inclusion in yellow book

NASA Internal IPV4 IPsec VPN Tunnel Cisco 3825 Router Ground Station R1 CCSDS Satellite R2 GE 0/0 192.168.1.1 GE 0/1 192.168.2.1 GE 0/0 192.168.2.2 GE 0/1 192.168.3.1 GE 0/1 192.168.4.1 GE 0/2 192.168.3.2 192.168.1.2 192.168.4.2 IPsec VPN Legend GE – Gigabit Ethernet Receive Station R3 Internal IPsec IPv4 tests completed Linux Box Linux Box Tunnel represents a direct logical connection between R1 & R3 through R2. However, all communication between R1 & R3 go through R2 (representing a satellite/networked cloud)

NASA Internal IPV6 IPsec VPN Tunnel Cisco 3825 Router Ground Station R1 CCSDS Satellite R2 GE 0/0 2001:db8:1:1::1/64 GE 0/1 2001:db8:1:2::1/64 GE 0/0 2001:db8:1:2::2/64 GE 0/1 2001:db8:1:3::1/64 GE 0/1 2001:db8:1:4::1/64 GE 0/2 2001:db8:1:3::2/64 GE 0/0 2001:db8:1:X::X/64 GE 0/0 2001:db8:1:4::2/64 IPsec VPN Legend GE – Gigabit Ethernet Internal IPsec IPv4 tests completed Linux Box Linux Box Cisco 3825 Router Receive Station R3 Tunnel represents a direct logical connection between R1 & R3 through R2. However, all communication between R1 & R3 go through R2 (representing a satellite/networked cloud)

CCSDS IPV4 IPsec VPN Tunnel Legend GE – Gigabit Ethernet NASA CNES NASA VPN Gateway CNES VPN Gateway 10.X.X.X IPsec VPN 192.168.1.1 10.20.X.X 192.168.1.2 CNES host NASA host Cisco 3825 Router R1 CNES Router Current CCSDS IPv4 IPsec VPN Tunnel setup and configuration

Planned CCSDS Yellow Book IPsec Test Matrix # IPV4/6 ESP Tunnel Integrity IPcomp Authenticated Encryption Confidentiality Manual Key Auto Key No Rekey 1 4 X   2 3 5 6 7 8 9 10 11 12 13 14 15 16 of 10

Modified* CCSDS Yellow Book IPsec Test Matrix # IPV4 ESP Tunnel Integrity IPcomp Authenticated Encryption Confidentiality Manual Key Auto Key No Rekey 1 4 X   2 3 5 6 7 8 * Due to limited IPv6 support of 10

Lessons Learned Red Book should clearly define baseline parameters for future prototype testing.

Backup

Questions