IPSec
IPSec set up
The modes for parameters exchanging, Main mode and Aggressive mode, used for IKE Phase
1 negotiations
A FortiWAN unit exchange Phase 1 parameters with the remote unit in only Main mode. In Main mode, the Phase 1
parameters are exchanged in six messages with encrypted authentication information. As the previous introductions,
Main mode gives securer authentication by a encryption with the negotiated secret key. By comparison, Aggressive
mode is weak in authentication since the lack of encryption. However, with the simplified exchanging process,
Aggressive mode is faster than Main mode indeed. Security and efficiency are the considerations you need to evaluate
for IKE Phase 1 negotiations. Once it is determined, both the two endpoints must be configured with the same mode.
Enable Dead Peer Detection (DPD) or not
The connectivity between two endpoints communicating through IPSec may goes down unexpectedly due to routing
problems, hardware broken, host rebooting, etc. In the situation, however, the IPSec entities are not aware of the loss
of peer connectivity (availability of peer), and the security associations (SAs) of each peer remains. Packets of
communication will continue being sent to oblivion, and reestablishment goes to failure. Dead Peer Detection (DPD) is
such a method, by sending periodic HELLO/ACK messages, to confirm the availability of an IPSec endpoint, recognize
a disconnection, reclaim the lost resources (SAs) and reestablish IKE negotiations automatically. When a
disconnection is detected, the active ISAKMP SA and the correspondent IPSec SAs are removed and renegotiated
immediately whether the secret keys expire or not.FortiWAN's IPSec DPD is performed in the Always Send mode,
which the detection messages are sent at configured intervals regardless of traffic activity between the peers (some
products probe for a idle tunnel before sending DPD detection messages, but FortiWAN does not). Related SAs would
be removed once a disconnection is recognized by FortiWAN's IPSec DPD, but FortiWAN would not automatically
perform the reestablishment (new establishment of the SAs is triggered only if an outgoing packets of the IPSec
communication arrive at the FortiWAN unit).
The IKE Phase 1 proposals for negotiating security parameters
The main object of IKE Phase 1 is to negotiate the encryption and authentication algorithms, and the correspondent
keys between two FortiWAN units so that they can authenticate the identity to each other during the Phase 1 process,
and protect the subsequent IKE Phase 2 negotiations.
IKE Phase 1 negotiations determine:
l
Which encryption algorithms may be applied for converting messages into a form that only the intended recipient
can read
l
Which authentication hash may be used for creating a keyed hash from a pre-shared or private key
l
Which Diffie-Hellman group (DH Group) will be used to generate a secret session key
The initiator of IKE Phase 1 proposes a list of potential cryptographic parameters that are supported (this is what the
Proposal fields supposed to be configured on Web UI, algorithms and DH Group) to remote FortiWAN. The remote
FortiWAN compares the received proposals with its own list of Phase 1 Proposal and responds with the choice of
matching parameters to use for authenticating and encrypting packets. According the determined proposal, the two
peers handle the subsequent exchanges to generate encryption keys between them, and authenticate the exchanges
through a pre-shared key. The negotiated encryption algorithm, authentication algorithm and secret session key,
which are the outcome of successful IKE Phase 1, will be used to protect the subsequent IKE Phase 2 negotiations.
To guarantee a successful IKE proposal negotiation, the configurations of proposals on both endpoints must be
partially matched. However, FortiWAN's IKE Phase 1 does not support multiple proposals, which means the IKE Phase
1 proposal must contain only one encryption algorithm, one authentication algorithm and one DH group. Therefore,
186
FortiWAN Handbook
Fortinet Technologies Inc.
