IPsec Overview

IPsec introduces confidentiality and authentication services in the Ruckus routers. The IP crypto facilities supported today in FastIron are limited to authentication of control packets for OSPFv3 only. IPsec extends the crypto support to the data traffic and introduces data confidentiality along with the authentication services.

There are numerous applications for supporting IPsec for data traffic. The data confidentiality in federal deployments, VPN, and confidentiality in healthcare and campus are a few of the applications. The following figure explains the basic IPsec functionality.

Routers R1 and R3 want to securely transfer data over the public (unsecure) network. The administrator at R1 and R3 configures the IPsec tunnel parameters, the transform set, and the set of crypto algorithms to be used for encryption and authentication along with the filters for which these policies must be applied. Any packets matching this policy will be dropped until the tunnel is up. The tunnel establishment starts with the Internet Key Exchange (IKE) negotiations. In phase 1 of the IKE, a shared secret key is derived using Diffie-Hellman (DH) for encryption and decryption of the IKE packets. Subsequently, the IKE phase 2 derives the keys for data path encryption and decryption. The derived data path keys are programmed in the specialized hardware crypto engine, and the tunnel state is set to up. Once the tunnel is up, all the subsequent packets that match the filter or policy or the routes learned over the tunnel as the next hop will be encrypted and sent over the tunnel. A similar process is followed in the reverse direction to achieve the bidirectional data flow.