Connecting dissimilar IPsec implementations

Rendezvous

Article from ADMIN 04/2011

By Konstantin Agouros

Any implementation of the standard-based IPsec is supposed to work with any other implementation – but sometimes you need a little extra effort. This article tests some IPsec implementations to see how well they fit.

Most admins are well aware of IPsec, the powerful protocol used to encrypt network traffic over TCP/IP networks. IPsec is often used with VPN connections to join remote LANs through a private tunnel over the Internet.

The first RFCs on IPsec were drafted during the development of IPv6 and date back to 1995. The current version is described by RFC 4301 and later RFCs. The IPsec specification refers to a number of other supporting protocols. Another protocol known as the Internet Key Exchange Protocol (IKE) lets the user avoid having to set the key randomly with each session; the first RFC relating to IKE dates back to 1998, and the current version IKEv2 is detailed by RFC 5996. Various features were added to IKE through the years to support enhancements such as Challenge Response authentication.

Implementations of the IPsec and IKE are available in various firewall products, network components, and operating systems. Despite the long, standards-based history of IPsec, different vendors implement their IPsec tools in different ways, leading to occasional complications when the two ends of the tunnel are using dissimilar implementations. I decided to try connecting several IPsec alternatives to see which versions worked best (and worst) together. My tests included the following:

Kame/Racoon on Mac OS X and Linux
Solaris 10
Windows Server 2008
Cisco-Router with IOS 12
Juniper SRX
Checkpoint R70
Fortinet Fortigate

The good news is that VPN connections were successfully established between all the candidates. This article looks at the details of configuring the individual components and points out the pitfalls associated with the various pairings. Along the way, you'll get a glimpse at what it is like to configure each of these IPsec tools, in case you happen to be searching for your own IPsec solution.

...

Use Express-Checkout link below to read the full article (PDF).