Which is the best way to encrypt all the IP traffic in LAN?

Question

I'm trying to encrypt all the IP traffic in a small LAN network but the in that network all kind of devices are connected i.e. PCs, Laptops, IP Cameras, IP Sensors, etc (new and old devices).

I have looked into IPSec, MACSec and pfsense. But I'm confused if there will be compatibility issues in any device on the network.

I think installing ssl on router or switch level in the above software will solve the problem for PCs and Laptops because they have a interface (browsers) which can encrypt the data before sending. But I'm not sure about the IP Cameras and sensors. Will there data be also encrypted if I simple just connect them to the network.

Answer 1

Practically, the only method is to use encrypted transport protocols at all times. SSL/TLS is supported for most application protocols and on many devices.

Using IPsec, MACsec, or the various encrypted tunneling mechanisms inside a LAN would require that the end nodes speak that protocol - you can forget about 95% of your generic devices here. Those would need an additional "encryption box" that encrypts their traffic onto the rest of the LAN, depending on the protocol you're actually rolling out.

Another option to secure your LAN would be to segregate security zones using VLANs (@JFL). That way, you could separate less trusted nodes from more trusted and delicate ones. Traffic between VLANs is either denied completely or tightly controlled by firewall rules/ACLs on an intermediate router, making attacks (near) impossible.

Answer 2

Encryption secure traffic between two endpoints.

This require that the endpoint is able to encrypt the traffic. If you use some devices that don't have that capability, then, as alluded by Zac67 in his answer, you need to put them behind a device that perform this encryption. This is costly and and doesn't scale at all, this is why usually it is the router that perform encryption.

So you requirement to encrypt all traffic on the LAN with non-encryption capable device can simply not be met.

You can separate your devices in different classes, depending on their capabilities and put them in separate VLAN with appropriate security configuration for example

Windows, Linux and MacOs hosts are ipsec (and 802.1X) capable, so you can encrypt all traffic for those hosts in their dedicated VLAN

For all other hosts, the encryption can only occur at higher level (SSL/TLS, HTTPS...), once again if supported by the specific devices. So putting them in a specific VLAN with tough filtering is your best option.

But you need to write down your security requirement and your threat model to evaluate the effort you are willing to put in this. This can go a long way and be very costly.

Answer 3

Generally all the application traffic is encrypted and send through networks and decrypted after reaching destination using SSL and TLS versions etc . It's not mandatory to use external encryption and decryption devices .

IPsec is provided security purposes . IPsec is combination of two protocols , AH , ESP. confidential, intigrity , authentication of data is provided .. IPsec is used to protect data between site to site vpn tunnels mostly ..