IPSec Design

Introduction

ICN SDEWAN solution leverages IPSec functionality in SD-EWAN CNF to setup security tunnel to enable communication between ONAP4K8S/APPX Manager with Edge cluster or Edge cluster with Edge cluster. There are several solutions in OpenWRT to implement IPSec, include: Openswan, Racoon, and StrongSwan. ICN will use StrongSwan solution.

OpenWRT StrongSwan Basic

Service Start Flow:

StrongSwan application is run by command: "/etc/init.d/ipsec start", this command will generate StrongSwan's configuration (e.g. /etc/ipsec/*) based on openwrt configuration (e.g. /etc/config/ipsec) then start ipsec application as daemon, below diagram shows its flow

Configuration: OpenWRT's IPSec Configuration is defined in /etc/config/ipsec, the detail configuration content and map to StrongSwan configuration are described in below table

IPSec CRD

IPSec CRD will be created by EWAN config Agent to configurate a remote configuration. it is defined as below, with filed map to ipsec configuration.

apiVersion: sdewan.akraino.org/v1alpha1 
kind: IPSecSite 
metadata: 
  name: site1 
spec:
  node: node1
  gateway:
  pre_shared_key:
  auth_method:
  local_identifier:
  remote_identifier:
  crypto_proposal: "proposal1"
  force_crypto_proposal: true
  connection:
  - type: tunnel/transport
    mode:
    local_subnet:
    local_nat:
    local_sourceip:
    local_updown:
    local_firewall:
    remote_subnet:
    remote_sourceip:
    remote_updown:
    remote_firewall:
    keyexchange: "ikev2"
    inactivity:
    crypto_proposal: "proposal1 proposal2"
  proposal:
  - encryption_algorithm:
    hash_algorithm:
    dh_group:

IPSec Rest API

SD-EWAN IPSec Restful API provides support to get/create/update/delete IPSec Site, Proposal.

IPSec Proposal

GET /cgi-bin/luci/sdewan/ipsec/v1/proposals

Lists all defined proposals

Request: N/A

Response

• Normal response codes: 200

• Response Parameters

  Name	In	Type	Description
  proposals	body	array	a list of defined proposals

• Response Example

  {     "proposals": [         {             "name":"proposal1",             "encryption_algorithm": "aes128",             "hash_algorithm": "sha256",             "dh_group": "modp3072"         }     ] }

GET /cgi-bin/luci/sdewan/ipsec/v1/proposal/{proposal}

Get a proposal

Request: N/A

• Request Parameters

  Name	In	Type	Description
  proposal	path	string	proposal name

Response

• Normal response codes: 200
• Error response code: 404

• Response Parameters

  Name	In	Type	Description
  name	body	string	proposal name
  encryption_algorithm	body	string	encryption algorithm
  hash_algorithm	body	string	hash algorithm
  dh_group	body	string	Diffie-Hellman group

• Response Example

  {       "name":"proposal1",       "encryption_algorithm": "aes128",       "hash_algorithm": "sha256",       "dh_group": "modp3072" }

POST /cgi-bin/luci/sdewan/ipsec/v1/proposal

create a new proposal

Request:

• Request Parameters: same with GET's response request

• Request Example: same with GET's response example

Response

• Normal response codes: 201
• Error response codes: 400, 401

PUT /cgi-bin/luci/sdewan/ipsec/v1/proposal/{proposal}

update a proposal

Request:

• Request Parameters:

  Name	In	Type	Description
  proposal	path	string	proposal name
  encryption_algorithm	body	string	encryption algorithm
  hash_algorithm	body	string	hash algorithm
  dh_group	body	string	Diffie-Hellman group

• Request Example

  {       "encryption_algorithm": "aes256",       "hash_algorithm": "sha256",       "dh_group": "modp4096" }

Response

• Normal response codes: 204
• Error response codes: 400, 401, 404

DELETE /cgi-bin/luci/sdewan/ipsec/v1/proposal/{proposal}

delete a proposal

Request:

• Request Parameters

  Name	In	Type	Description
  proposal	path	string	proposal name

Response

• Normal response codes: 200
• Error response codes: 401, 404

IPSec Site

GET /cgi-bin/luci/sdewan/ipsec/v1/sites

Lists all defined sites

Request: N/A

Response

• Normal response codes: 200

• Response Parameters

  Name	In	Type	Description
  sites	body	array	a list of defined sites

• Response Example

  {     "sites": [         {             "name": "site1"             "gateway":"10.10.10.10",             "crypto_proposal": "proposal1"             "connections": [               {                 "type": "tunnel"                 "local_subnet": "192.168.1.1/24"                 "remote_subnet": "192.168.0.1/24"                 "crypto_proposal": "proposal1"               }         }     ] }

GET /cgi-bin/luci/sdewan/ipsec/v1/site/{site}

Get a site

Request: N/A

• Request Parameters

  Name	In	Type	Description
  site	path	string	remote site name

Response

• Normal response codes: 200
• Error response code: 404

• Response Parameters

  Name	In	Type	Description
  name	body	string	site name
  gateway	body	string
  pre_shared_key	body	string
  auth_method	body	string
  local_identifier	body	string
  remote_identifier	body	string
  crypto_proposal	body	string
  force_crypto_proposal	body	boolean
  connection	body	array
  type	body	string	"tunnel" or "transport"
  mode	body	string
  local_subnet	body	string
  local_nat	body	string
  local_sourceip	body	string
  local_updown	body	string
  local_firewall	body	string	firewall rule?
  remote_subnet	body	string
  remote_sourceip	body	string
  remote_updown	body	string
  remote_firewall	body	string
  keyexchange	body	string	default: ikev2
  inactivity	body	boolean
  crypto_proposal	body	string

• Response Example

  {      "name": "site1"      "gateway":"10.10.10.10",      "crypto_proposal": "proposal1"      "connections": [       {          "type": "tunnel"          "local_subnet":          "remote_subnet":           "crypto_proposal": "proposal1"       } }

POST /cgi-bin/luci/sdewan/ipsec/v1/site

create a new proposal

Request:

• Request Parameters: same with GET's response request

• Request Example: same with GET's response example

Response

• Normal response codes: 201
• Error response codes: 400, 401

PUT /cgi-bin/luci/sdewan/ipsec/v1/site/{site}

update a site

Request:

• Request Parameters:

  Name	In	Type	Description
  site	path	string	remote site name
  other params	body		Same with Get's response

• Request Example

  {      "gateway":"10.10.10.10",      "crypto_proposal": "proposal1"      "connections": [       {          "type": "tunnel"          "local_subnet":          "remote_subnet":           "crypto_proposal": "proposal1"       } }

Response

• Normal response codes: 204
• Error response codes: 400, 401, 404

DELETE /cgi-bin/luci/sdewan/ipsec/v1/site/{site}

delete a site

Request:

• Request Parameters

  Name	In	Type	Description
  site	path	string	remote site name

Response

• Normal response codes: 200
• Error response codes: 401, 404