3

I'm trying to debug a Cisco VPN setup as part of a Uni Lab (so please don't worry about posting of keys etc. it's just a toy setup with no internet facing connection).

I want to decrypt the IKEv1 traffic I'm capturing to work out what is going wrong. I've set up Wireshark as per the attached image with the SPIs for each peer. I think my issue may be with the PSK. It has been set to "SECRET-KEY" in the two endpoints but I'm not sure how to translate it to hex for entering in Wireshark. I've tried a direct translation using Cyber Chef "To Hex" but that doesnt seem to be right. Can anyone point me to where I am going wrong please?

Wireshark Settings

Improve this question
2
  • 1
    Do you y need to A) decrypt/debug the IKEv1 (Phase1) and/or IPsec (Phase 2) negotiations to understand what's going wrong when the tunnel is brought up? or B) to decrypt traffic flowing through the tunnel to figure out what is happening/going wrong with the application? For A) there's VERY detailed debug facilities in Cisco IOS. For B), you might consider changing your ipsec transform set to use ESP-NULL encryption instead of 3DES or AES. Wireshark will detect ESP-NULL and dissect accordingly. Please update your question to specify what you're actually after.
    – Marc 'netztier' Luethi
    Nov 8, 2021 at 23:19
  • I've since looked at some of the debug info in Cisco, and yeah it's pretty good. Given the answer from @ecdsa I'll probably stick with debug info and trying to get some support from the Lecturer. Thanks.
    – DavidM
    Nov 9, 2021 at 18:28

1 Answer 1

Reset to default
4

What you have to configure in Wireshark is not the PSK used for authentication, but the actual IKE encryption keys, which are derived from an ephemeral Diffie-Hellman exchange (i.e. they are different for every negotiated IKE_SA). If a PSK is used, that's also incorporated when deriving the keys (note that that's only the case with IKEv1, not with IKEv2 where the PSK is solely used for authentication).

How you get the IKE encryption keys (if you are even able to do so), depends on the IKE implementation you are using. Maybe it provides a high enough log level that includes the IKE keys, maybe it has a config option that exports the key material somewhere.

Improve this answer
1
  • I've marked this as the answrer thanks. Sounds like it's beyond my capabilities/will to dig into this deeper. I'll try to work from debug info in the router/ASA device. Thanks.
    – DavidM
    Nov 9, 2021 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.