ECE Prof. John A. Copeland fax Office: GCATT Bldg 579 or call for office visit, or call Kathy Cheek, Chapter 6a - IPsec (IP Secure) (note: 06b has PDF copies of slides from Chap. 6 of the text, “Network Security Essentials, Applications and Standards” by William Stallings)

2 Each LAN Connects to Internet via a Router

The Internet is a Router Network In an Router Network, circuits are defined by entries in the Routing Tables along the way. These may be Static (manually set up) or Dynamic (set up according to Algorithm in the Router). 4E 3 A 5 C D B Station ( on a LAN) A 1 Local Connection Trunk or Long-Haul Router A to D 3 E’net Token Ring IP

Optimal Paths From Router 1 (or To Router 1) Define Router 1'sSink Tree 4E 3 A 5 C D B Station A 1 Local Connection Trunk or Long-Haul Router 4

5 Application Layer (HTTP) Transport Layer (TCP,UDP) Network Layer (IP) E'net Data Link Layer Ethernet Phys. Layer Network Layer E'net Data Link Layer E'net Phys. Layer Network Layer Web Server Browser Router Buffers Packets that need to be forwarded (based on IP address). Application Layer (HTTP) Transport Layer (TCP,UDP) Network Layer (IP) Token Ring Data-Link Layer Token Ring Phys. Layer IP Address IP Address Port 80 Port Segment No. Token Ring Data Link Layer Token Ring Phys. Layer

6 Connecting Over the Internet to “ Discover the Ethernet address of the Domain Name Server ARP - “Who has ” Reply from Gateway Router “00 0E 36 A has ” * Use DNS (BIND) to convert “ to a 32-bit Internet address ( ). Send UDP DNS-Request Packet to : UDP 53 Reply = Discover the Ethernet address of host (or gateway router). ARP - “Who has ” Reply from Gateway Router “00 0E 36 A has ” * Start a TCP connection Send TCP Packet with SYN flag set to / 00 0E 36 A Reply is TCP Packet with SYN and ACK flag bits set. Send TCP packet with ACK flag set. * The gateway router “has” all IP addresses that are not local (on the LAN).

#1 Receive time: (0.000) packet length:80 received length:70 UDP Datagrams are exchanged to find the IP address Ethernet: ( b22f -> Sun 75f53a) type: IP(0x800) Internet: > hl: 5 ver: 4 tos: 0 len: 66 id 0x01 fragoff:0 flags: 00 ttl:60 prot:UDP(17) xsum: 0x68ce UDP: > domain(53) len: 46 xsum: 0x5315 Domain Name Service: ID: 2984 opcode: Query (0) Flags: (0100) Queries: 1, answers: 0, name servers: 0, Query 0: Name: #2 Receive time: (0.048) packet length:148 received length:70 Ethernet: ( Sun 75f53a -> b22f) type: IP(0x800) Internet: > hl: 5 ver: 4 tos: 0 len:134 id:xbc77 fragoff 0 flags:00 ttl:60 prot:UDP(17) xsum:0xac13 UDP: domain(53) -> 1042 len: 114 xsum: 0000 Domain Name Service: ID: 2984 opcode: Query (0) Response: No. err (0) Flags: (8580) Queries: 1, answers: 3, name servers: 0, Query 0: Name: 7

#3 Receive time: packet length:60 Ethernet: ( b22f -> Cisco ) type: IP(0x800) Internet: > hl: 5 ver: 4 tos: 0 len: 44 id: 0x02 fragoff: 0 flags: 00 ttl: 60 prot: TCP(6) xsum: 0x9be5 TCP Port: > http(80) seq: 28a61070 ack: ---- win: hl: 6 xsum: 0x5342 urg: 0 flags: mss: 536 #4 Receive time: packet length:60 Ethernet: (Cisco > b22f) type: IP(0x800) Internet: > hl: 5 ver: 4 tos: 0 len:44 id:0x7d1f fragoff 0 flags:00 ttl:57 prot:TCP(6) xsum:0x21c8 TCP Port: http(80) -> 1076 seq: 3a28ac00 ack: 28a61071 win: 4096 hl: 6 xsum: 0x816d urg: 0 flags: mss:1460 The first two packets of the IP, TCP & HTTP (port 80) Connection. The Ethernet address (Cisco...) is the local router port. The IP Address is used “end to end.” Ethernet addresses are local only. Address Resolution Protocol (ARP) E’net frames are not shown. 8

Internet Layer Security (IPsec) Rolf Oppliger, "Internet Security: Firewalls and Beyond," p92, Comm. ACM 40, May 1997 The Internet Engineering Task Force (IETF) Internet Security Protocol working group standardized an IP Security Protocol (IPsec) and an Internet Key Management Protocol (IKMP). objective of IPsec is to make available cryptographic security mechanisms to users who desire security. mechanisms should work for both the current version of IP (IPv4) and the new IP (IPv6). should be algorithm-independent, in that the cryptographic algorithms can be altered. should be useful in enforcing different security policies, but avoid adverse impacts on users who do not employ them. 9

IPsec Authentication Header (AH) 10 Transport Mode Transport Mode Tunnel Mode

Encapsulated Secure Payload (ESP) Transport Level Security (TLS) 11

12 IPsec ESP - Tunnel Mode Virtual Private Network (VPN)

Internet Layer Security (IPsec) 13 IPsec Authentication Header (AH) - Transport and Tunnel Modes Normal Internet Protocol (IP) IPsec Encapsulated Secure Payload (ESP) IPsec Encapsulated Secure Payload (ESP) with AH IP Header, A to B TCP Header Application Header Data IP Header, A to B AH TCP Header Application Header Data IP Header, A to R b ESP Header TCP Header Application Header Data Encrypted IP Header, A to R b AH ESP Header TCP Header Application Hdr Data Encrypted IP Hdr, A to R b AH IP Hdr A to B TCP Hdr Application Header Data

Security Associations