IPSec (IKEv2) - Hub and Spoke Design

This blog demonstrate a possible IPsec hub and spoke design with IKEv2 and VTI. The focus here is on an IPsec configuration that is identical on all sides to ensure a consistent configuration. The basic design is shown in the figure below.

Security considerations#

In general, this example uses AES (CBC) with at least 256 bits. On newer Cisco routers, it is possible to use AES in GCM mode. GCM is the newer mode compared to CBC. However, there are potential security concerns with GCM if the initial vector is reused. One advantage of GCM is that it combines encryption and integrity, eliminating the need for an additional algorithm for integrity (as is the case with CBC).

The german BSI states that both methods (GCM / CBC) are valid options through 2032 and beyond.

Hub - Configure IPsec/IKE Phase 1#

IKEv2 Proposal#

As the name implies, the proposal is a set of cryptographic parameters that can be used to establish the first phase (IKE SA) of an IPsec tunnel.

crypto ikev2 proposal MY-IKEv2-PROPOSAL-NAME
 encryption aes-cbc-256
 integrity sha256 sha384
 group 20

IKEv2 Policy#

The proposal must be added to a policy. The policy can then contain multiple proposals, for example, for legacy devices.

crypto ikev2 policy MY-IKEv2-POLICYNAME
 proposal MY-IKEv2-PROPOSAL-NAME

Keyring#

The keyring contains the pre-shared keys (PSKs) of the various peers. The peers are identified by their addresses. The PSK is used only for authentication. The peer address is the (public) address of the remote station’s physical interface.

crypto ikev2 keyring MY-IKEv2-KEYRING
 peer MY-PEER-1
  address 203.0.113.2
  pre-shared-key <HIGHSECUREPASSWORD>
 peer MY-PEER-2
  address 203.0.113.2.3
  pre-shared-key <HIGHSECUREPASSWORD>
 peer MY-PEER-3
  address 203.0.113.2.4
  pre-shared-key <HIGHSECUREPASSWORD>

IKEv2 Profile#

The IKEv2 profile describes how peers identify and authenticate themselves.

crypto ikev2 profile MY-IKEv2-Profile
 match identity remote address 203.0.113.2 255.255.255.255
 identity local address 203.0.113.1
 authentication remote pre-share
 authentication local pre-share
 keyring local MY-IKEv2-KEYRING

In principle, you could create just one profile in the hub to group all IKE connections under it. Alternatively, you would have to create a separate profile for each peer. All peers would still need to be entered in the keyring; otherwise, they would not be able to authenticate.

crypto ikev2 profile MY-IKEv2-Profile
 match identity remote address 0.0.0.0 0.0.0.0
 identity local address 203.0.113.1
 authentication remote pre-share
 authentication local pre-share
 keyring local MY-IKEv2-KEYRING

Hub - Configure IPsec/IKE Phase 2#

The following configuration describes IPsec Phase 2. In that phase the actual encryption of the payload happens.

Transform-Set#

The transform set is the configuration used for the actual encryption of the payload within the IPSec SA. This is also where it is defined whether IPSec is used in tunnel mode or transport mode.

crypto ipsec transform-set MY-IPSEC-TRANSFORMSET esp-aes 256 esp-sha512-hmac
 mode tunnel

IPSec Profile#

In the IPSec profile, the parameters for Phase 1 and the configuration for Phase 2 are now combined into a single profile. This profile can then be assigned to the tunnel interface.

crypto ipsec profile MY-IPSEC-PROFILE 
 set transform-set MY-IPSEC-TRANSFORMSET
 set ikev2-profile MY-IKEv2-Profile
 set pfs group20
 set security-association lifetime seconds 14400

The BSI currently recommends a maximum lifetime of 4 hours (14,400 seconds) for the IPSec-SA and a maximum duration of 24 hours for the IKE-SA.

Hub - Apply configuration#

The IPsec configuration can now be applied from this point on using traditional Crypto Maps or VTI. The following configuration uses VTI.

Tunnel Assignment#

interface Tunnel1
 tunnel source 203.0.113.1
 tunnel destination 203.0.113.2
 tunnel protection ipsec profile MY-IPSEC-PROFILE
 ip address 172.16.1.1 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
!
interface Tunnel2
 tunnel source 203.0.113.1
 tunnel destination 203.0.113.2
 tunnel protection ipsec profile MY-IPSEC-PROFILE
 ip address 172.16.2.1 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
!
interface Tunnel3
 tunnel source 203.0.113.1
 tunnel destination 203.0.113.2
 tunnel protection ipsec profile MY-IPSEC-PROFILE
 ip address 172.16.3.1 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360

As a result, all traffic sent over the tunnel interfaces (Tu1, Tu2, Tu3) is encrypted using the IPsec profile.

Spoke - Configuration#

In general, the configuration structure in the individual spokes is the same as in the hub. However, the keyring contains only the hub’s information. The IKEv2 profile can also be configured using either the wildcard address or the specific address of the hub.

The following example shows the configuration of a spoke (R2).

crypto ikev2 proposal MY-IKEv2-PROPOSAL-NAME
 encryption aes-cbc-256
 integrity sha256 sha384
 group 20
!
crypto ikev2 policy MY-IKEv2-POLICYNAME
 proposal MY-IKEv2-PROPOSAL-NAME
!
crypto ikev2 keyring MY-IKEv2-KEYRING
 peer MY-HHUB-1
  address 203.0.113.1
  pre-shared-key <HIGHSECUREPASSWORD>
!
crypto ikev2 profile MY-IKEv2-Profile
 match identity remote address 203.0.113.1 255.255.255.255
 identity local address 203.0.113.2
 authentication remote pre-share
 authentication local pre-share
 keyring local MY-IKEv2-KEYRING
!
crypto ipsec transform-set MY-IPSEC-TRANSFORMSET esp-aes 256 esp-sha512-hmac
 mode tunnel
!
crypto ipsec profile MY-IPSEC-PROFILE 
 set transform-set MY-IPSEC-TRANSFORMSET
 set ikev2-profile MY-IKEv2-Profile
 set pfs group20
 set security-association lifetime seconds 14400
!
interface Tunnel1
 tunnel source 203.0.113.2
 tunnel destination 203.0.113.1
 tunnel protection ipsec profile MY-IPSEC-PROFILE
 ip address 172.16.1.1 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
!