1

I'm trying to encrypt all the IP traffic in a small LAN network but the in that network all kind of devices are connected i.e. PCs, Laptops, IP Cameras, IP Sensors, etc (new and old devices).

I have looked into IPSec, MACSec and pfsense. But I'm confused if there will be compatibility issues in any device on the network.

I think installing ssl on router or switch level in the above software will solve the problem for PCs and Laptops because they have a interface (browsers) which can encrypt the data before sending. But I'm not sure about the IP Cameras and sensors. Will there data be also encrypted if I simple just connect them to the network.

3

Practically, the only method is to use encrypted transport protocols at all times. SSL/TLS is supported for most application protocols and on many devices.

Using IPsec, MACsec, or the various encrypted tunneling mechanisms inside a LAN would require that the end nodes speak that protocol - you can forget about 95% of your generic devices here. Those would need an additional "encryption box" that encrypts their traffic onto the rest of the LAN, depending on the protocol you're actually rolling out.

Another option to secure your LAN would be to segregate security zones using VLANs (@JFL). That way, you could separate less trusted nodes from more trusted and delicate ones. Traffic between VLANs is either denied completely or tightly controlled by firewall rules/ACLs on an intermediate router, making attacks (near) impossible.

| improve this answer | |
  • so installing ssl on router or switch level (on software like pfsense) will solve my problem with the IP Cameras and IP Sensors. – Vishu Rana Apr 29 at 9:37
  • 1
    No. You need to configure all protocols in your LAN to use SSL/TLS, on client and server sides. You cannot "install SSL on router or switch". You could e.g. enable HTTPS for the configuration front end, but that does nothing for the rest. – Zac67 Apr 29 at 9:40
1

Encryption secure traffic between two endpoints.

This require that the endpoint is able to encrypt the traffic. If you use some devices that don't have that capability, then, as alluded by Zac67 in his answer, you need to put them behind a device that perform this encryption. This is costly and and doesn't scale at all, this is why usually it is the router that perform encryption.

So you requirement to encrypt all traffic on the LAN with non-encryption capable device can simply not be met.

You can separate your devices in different classes, depending on their capabilities and put them in separate VLAN with appropriate security configuration for example

Windows, Linux and MacOs hosts are ipsec (and 802.1X) capable, so you can encrypt all traffic for those hosts in their dedicated VLAN

For all other hosts, the encryption can only occur at higher level (SSL/TLS, HTTPS...), once again if supported by the specific devices. So putting them in a specific VLAN with tough filtering is your best option.

But you need to write down your security requirement and your threat model to evaluate the effort you are willing to put in this. This can go a long way and be very costly.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.