Linux Tag 2008 Berlin strong Swan VPNs scalable

Linux. Tag 2008 Berlin strong. Swan VPNs scalable and modularized! Prof. Dr. Andreas Steffen andreas. steffen@strongswan. org Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 1

Virtual Private Networks „Road Warrior“ VPN Client 10. 1. 0. 5 10. 3. 0. 2 10. 2. 0. 3 55. 66. x. x Internet VPN Tunnel Head Quarters 10. 1. 0. 0/16 Subsidiary VPN Tunnel VPN Gateway 11. 22. 33. 44 VPN Gateway 10. 2. 0. 0/16 55. 66. 77. 88 Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 2

strong. Swan User-Mode-Linux VPN Testbed Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 3

Linux. Tag 2008 Berlin strong. Swan Software Architecture Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 4

The Free. S/WAN Genealogy 1999 Free. S/WAN 1. x 2000 X. 509 1. x Patch Free. S/WAN 2. x 2004 Super Free. S/WAN 2003 X. 509 2. x Patch Openswan 1. x 2004 Openswan 2. x strong. Swan 2. x 2005 ITA IKEv 2 Project 2006 2007 Openswan 3. x strong. Swan 4. x IKEv 1 only IKEv 1 & IKEv 2 Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 5

The strong. Swan IKE Daemons IKEv 1 ipsec. conf IKEv 2 ipsec whack ipsec starter ipsec stroke whack socket • IKEv 1 - 6 messages for IKE SA Phase 1 Main Mode - 3 messages for IPsec SA stroke socket Phase 2 Quick Mode pluto Netlink XFRM socket charon • IKEv 2 - 4 messages for IKE SA and first IPsec SA IKE_SA_INIT/IKE_AUTH Linux 2. 6 kernel LSF - 2 messages for each additional IPsec SA CREATE_CHILD_SA UDP/500 socket native IPsec raw socket Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 6

IKEv 2 Daemon – Software Architecture credentials receiver scheduler socket sender processor bus file logger backends IKE SA M a n a g e r IKE SA CHILD SA kernel interface sys logger 16 concurrent worker threads IPsec stack charon Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 7

Linux. Tag 2008 Berlin Configuration and Control The Free. S/WAN way Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 8

IKEv 2 Mixed PSK/RSA Authentication #ipsec. secrets for roadwarrior carol #ipsec. secrets for gateway moon carol@strongswan. org : PSK "Fp. ZAZq. EN 6 Ti 9 sqt 4 ZP 5 EWcqx" : RSA moon. Key. pem #ipsec. conf for roadwarrior carol conn home keyexchange=ikev 2 authby=psk left=%defaultroute leftsourceip=%config leftid=carol@strongswan. org leftfirewall=yes right=192. 168. 0. 1 rightid=@moon. strongswan. org rightsubnet=10. 1. 0. 0/16 auto=start carol@strongswan. org : PSK "Fp. ZAZq. EN 6 Ti 9 sqt 4 ZP 5 EWcqx" dave@strongswan. org : PSK "j. Vz. ONCF 02 ncsgi. Slm. IXeqh. GN" #ipsec. conf for gateway moon conn rw keyexchange=ikev 2 authby=rsasig left=%defaultroute leftsubnet=10. 1. 0. 0/16 leftcert=moon. Cert. pem leftid=@moon. strongswan. org leftfirewall=yes right=%any rightsourceip=10. 3. 0. 0/16 auto=add Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 9

Default stroke plugin for charon controller credentials backends bus P l u g i n stroke L o a d e r Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 10

stroke: Control Interface I carol> ipsec start 05[AUD] 05[ENC] 05[NET] 06[ENC] 06[NET] 07[ENC] 07[IKE] 07[AUD] initiating IKE_SA 'home' to 192. 168. 0. 1 generating IKE_SA_INIT request 0 [SA KE No N N] sending packet: from 192. 168. 0. 100[500] to 192. 168. 0. 1[500] received packet: from 192. 168. 0. 1[500] to 192. 168. 0. 100[500] parsed IKE_SA_INIT response 0 [SA KE No N N] generating IKE_AUTH request 1 [IDi CERTREQ IDr AUTH CP SA TSi TSr] sending packet: from 192. 168. 0. 100[500] to 192. 168. 0. 1[500] received packet: from 192. 168. 0. 1[500] to 192. 168. 0. 100[500] parsed IKE_AUTH response 1 [IDr CERT AUTH CP SA TSi TSr N] IKE_SA 'home' established between 192. 168. 0. 100. . . 192. 168. 0. 1 installing new virtual IP 10. 3. 0. 1 CHILD_SA 'home' established successfully Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 11

stroke: Control Interface II carol> ipsec status Performance: uptime: 5 seconds, since Apr 28 18: 30: 36 2008 worker threads: 11 idle of 16, job queue load: 1, scheduled events: 5 Listening IP addresses: 192. 168. 0. 100 fec 0: : 10 Connections: home: 192. 168. 0. 100[carol@strongswan. org]. . . 192. 168. 0. 1[moon. strongswan. org] home: dynamic/32 === 10. 1. 0. 0/16 Security Associations: home[1]: ESTABLISHED, 192. 168. 0. 100[carol@strongswan. org]. . . 192. 168. 0. 1[moon. strongswan. org] home[1]: IKE SPIs: 15993 ec 81138 c 1 b 1_i* ce 054 ec 02 da 36 c 8 e_r, reauth in 51 minutes home{1}: INSTALLED, TUNNEL, ESP SPIs: c 51 cf 634_i cf 2 c 3 efd_o home{1}: AES_CBC-128/HMAC_SHA 1_96, rekeying in 14 minutes, last use: 2 s_i 2 s_o home{1}: 10. 3. 0. 1/32 === 10. 1. 0. 0/16 Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 12

Linux. Tag 2008 Berlin Configuration and Control The modular way Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 13

Plugins for charon controller credentials backends bus eap P l u g i n L o a d e r • smp • sql stroke smp sql med_db … XML-based control and management protocol. Uses a bi-directional UNIX socket. Implementation: strong. Swan Manager eap_aka Generic SQL interface for configurations, credentials & logging. eap_sim Implementations: SQLite & My. SQL eap_md 5 … • eap_x Any EAP protocol. Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 14

strong. Swan Manager take down IKE SA take down IPsec SA Fast. CGI written in C with Clear. Silver templates Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 15

strong. Swan Entity Relationship Diagram logs pools traffic_selectors private_keys leases child_configs shared_secrets identities peer_configs certificates ike_configs SQLite and My. SQL implementations Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 16

Linux. Tag 2008 Berlin Modular Crypto Plugins Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 17

Plugins for libstrongswan crypto Factories credentials database fetcher aes P l u g i n L o a d e r sha 2 random … x 509 … sqlite mysql … curl ldap Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 18

VIA EPIA-NX Pad. Lock Crypto-Processor Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 19

Linux. Tag 2008 Berlin IKEv 2 Mediation Extension Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 20

Peer-to-Peer NAT-Traversal for IPsec • • Client registration a. Z 9 ch 2@m. org Endpoint discovery 1. 2. 3. 4: 1025 Endpoint relaying Hole punching (ICE, etc. ) Mediation Client 7 vn. U 3 b@m. org IKEv 2 Mediation Server Mediation Connection NAT Router 1. 2. 3. 4: 1025 NAT Router 5. 6. 7. 8: 3001 IKEv 2 Mediated Connection 10. 10: 4500 Peer Alice 10. 10 Mediation Client 10. 2. 0. 10: 4500 Direct ESP Tunnel using NAT-Traversal 10. 2. 0. 10 Peer Bob Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 21

draft-brunner-ikev 2 -mediation released Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 22

Login at the strong. Swan Mediation Manager Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 23

Register a Peer with the Mediation Manager Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 24

List of Registered Peers Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 25

Linux. Tag 2008 Berlin Thank you for your attention! Questions? Andreas Steffen, 30. 05. 2008, Linux. Tag 2008. ppt 26