0

I have a couple of queries related to the IPSec VPN and I believe someone would clarify my doubts.

  1. Why IKE Lifetime and IPSec Lifetime is used? Can't we just run the VPN without re-negotiating?

  2. Why re-negotiation in VPN is happening? What is a necessity?

  3. What will happen in re-negotiation? Will it initialize the entire main mode and quick mode messages?

  4. Should IKE Phase 1 timer should match or the lowest will be chosen?

  5. Should IPSec Phase 2 timers should match or the lowest will be chosen?

3

Why IKE Lifetime and IPSec Lifetime is used? Can't we just run the VPN without re-negotiating? Why re-negotiation in VPN is happening? What is a necessity?

Every key is susceptible to Brute Force. This is unavoidable.

If all you ever use is one key, and an attacker manages to brute force your one key, then all your data that you have ever sent or received is compromised.

To limit the scope of potential compromise, IPsec performs "rekey" operations, so that if a brute force is successful, at best only 8 hours of your data is compromised.

Moreover, the keys used in each direction are different, so if a single key is compromised (which is not trivial), only 8 hours of one side of the conversation is compromised.

What will happen in re-negotiation? Will it initialize the entire main mode and quick mode messages?

When Phase 2 re-keys, Quick mode is performed again.

When Phase 1 re-keys, Main mode is performed again.

Some details of what goes on within Quick mode and Main mode are outlined here:

In IPsec VPN, how is the pre-shared key encrypted?

Should IKE Phase 1 timer should match or the lowest will be chosen? Should IPSec Phase 2 timers should match or the lowest will be chosen?

Between two peers, they agree to use the lowest configured timer. If one peer prefers a 86400 timeout for IKE/Isakmp, and the other prefers 43200, then they both agree to use 43200.

Same for Phase 2.

| improve this answer | |
3

Why IKE Lifetime and IPSec Lifetime is used? Can't we just run the VPN without re-negotiating?

Why re-negotiation in VPN is happening? What is a necessity?

Yes, in theory you can use the same keys forever. But just like your PC password, it's good practice to change the keys periodically. It keeps "bad guys" from discovering your keys and potentially having access to all your past messages as well as your future messages.

| improve this answer | |
0

Default ike lifetime is 28800 seconds. Default ipsec lifetime is 3600 seconds.

Keys are renegociated because they can be bruteforced, and then an attacker could decrypt all the captured traffic.

The PFS option allow you to renew the keys without using the old ones, which is more secure.

| improve this answer | |
  • Hi Amprxc, welcome to NESE. Just want to clarify, PFS doesn't avoid "re-using old keys", it prevents using any ISAKMP/Phase 1 derived keying material to derive IPsec/Phase 2 keys. More details here: networkengineering.stackexchange.com/questions/13468/… – Eddie Sep 18 '19 at 21:49
  • 1
    @Eddie yes, sorry. My explanation wasn't clear – amprxc Sep 18 '19 at 21:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.