IPSec Design

Introduction

ICN SDEWAN solution leverages IPSec functionality in SD-EWAN CNF to setup security tunnel to enable communication between ONAP4K8S/APPX Manager with Edge cluster or Edge cluster with Edge cluster. There are several solutions in OpenWRT to implement IPSec, include: Openswan, Racoon, and StrongSwan. ICN will use StrongSwan solution.

OpenWRT StrongSwan Basic

Service Start Flow:

StrongSwan application is run by command: "/etc/init.d/ipsec start", this command will generate StrongSwan's configuration (e.g. /etc/ipsec/*) based on openwrt configuration (e.g. /etc/config/ipsec) then start ipsec application as daemon, below diagram shows its flow

Configuration: OpenWRT's IPSec Configuration is defined in /etc/config/ipsec, the detail configuration content and map to StrongSwan configuration are described in below table

IPSec CRD

IPSec CRD will be created by EWAN config Agent to configurate a remote configuration. it is defined as below, with filed map to ipsec configuration.

apiVersion: sdewan.akraino.org/v1alpha1 
kind: IpsecSite
metadata:
  name: ipsecsite-sample
spec:
  sites:
  - name: siteA
    gateway: 10.0.1.2
    pre_shared_key: test123
    authentication_method: psk
    local_identifier: C=CH, O=strongSwan, CN=peer
    remote_identifier: C=CH, O=strongSwan, CN=peerB
    crypto_proposal:
      - proposal1
    force_crypto_proposal: "0"
    connections:
    - name: connA
      type: tunnel/transport
      mode: start
      local_subnet: 192.168.1.1/24
      local_sourceip: 10.0.1.1
      remote_subnet: 192.168.0.1/24
      remote_sourceip: 10.0.1.2
      crypto_proposal:
        - proposal2
  proposals:
    - name: proposal1
      encryption_algorithm: aes128
      hash_algorithm: sha256
      dh_group: modp3072
    - name: proposal2
      encryption_algorithm: aes128
      hash_algorithm: sha128
      dh_group: modp3072

IPSec Rest API

SD-EWAN IPSec Restful API provides support to get/create/update/delete IPSec Site, Proposal.

IPSec Proposal

POST /cgi-bin/luci/sdewan/ipsec/v1/proposals

create a new proposal

Request:

• Request Parameters: same with PUT's response request

• Request Example: same with PUT's response example

Response

• Normal response codes: 201
• Error response codes: 400, 401

PUT /cgi-bin/luci/sdewan/ipsec/v1/proposals/{proposal-name}

update a proposal

Request:

• Request Parameters:

  Name	In	Type	Description
  proposal-name	path	string	proposal name
  encryption_algorithm	body	string	encryption algorithm
  hash_algorithm	body	string	hash algorithm
  dh_group	body	string	Diffie-Hellman group

• Request Example

  PUT /cgi-bin/luci/sdewan/ipsec/proposals/proposal1

  {       "encryption_algorithm": "aes256",       "hash_algorithm": "sha256",       "dh_group": "modp4096" }

Response

• Normal response codes: 204
• Error response codes: 400, 401, 404

GET /cgi-bin/luci/sdewan/ipsec/v1/proposals

Lists all defined proposals

Request: N/A

Response

• Normal response codes: 200

• Response Parameters

  Name	In	Type	Description
  proposals	body	array	a dict of defined proposals

• Response Example

  {     "proposals": [         {             "name": "proposal1",             "encryption_algorithm": "aes128",             "hash_algorithm": "sha256",             "dh_group": "modp3072"         }     ] }

GET /cgi-bin/luci/sdewan/ipsec/v1/proposals/{proposal-name}

Get a proposal

Request: N/A

• Request Parameters

  Name	In	Type	Description
  proposal-name	path	string	proposal name

Response

• Normal response codes: 200
• Error response code: 404

• Response Parameters

  Name	In	Type	Description
  name	body	string	proposal name
  encryption_algorithm	body	string	encryption algorithm
  hash_algorithm	body	string	hash algorithm
  dh_group	body	string	Diffie-Hellman group

• Response Example

  {       "name": "proposal1",       "encryption_algorithm": "aes128",       "hash_algorithm": "sha256",       "dh_group": "modp3072" }

DELETE /cgi-bin/luci/sdewan/ipsec/v1/proposals/{proposal-name}

delete a proposal

Request:

• Request Parameters

  Name	In	Type	Description
  proposal-name	path	string	proposal name

Response

• Normal response codes: 200
• Error response codes: 401, 404

IPSec Site

POST /cgi-bin/luci/sdewan/ipsec/v1/sites

create a new site

Request:

• Request Parameters: same with PUT's response request

Response

• Normal response codes: 201
• Error response codes: 400, 401

PUT /cgi-bin/luci/sdewan/ipsec/v1/sites/{site-name}

update a site

Request:

• Request Parameters:

  Name	In	Type	Description
  site-name	path	string	remote site name
  other params	body		Same with Get's response

• Request Example

  PUT /cgi-bin/luci/sdewan/ipsec/v1/sites/sites

  {      "gateway": "10.1.0.2",      "name": "site1",      "crypto_proposal": "proposal1"      "connections": [       {          "name": "site_to_site",          "type": "tunnel"          "local_subnet":          "remote_subnet":           "crypto_proposal": "proposal1"       } }

Response

• Normal response codes: 204
• Error response codes: 400, 401, 404

GET /cgi-bin/luci/sdewan/ipsec/v1/sites

Lists all defined sites

Request: N/A

Response

• Normal response codes: 200

• Response Parameters

  Name	In	Type	Description
  sites	body	array	a list of defined sites

• Response Example

  {     "sites": [        {    "name": "site1",             "gateway":"10.0.1.2",             "authentication_method": "psk",             "crypto_proposal": "proposal1",             "connections": [               {                 "name": "connA"                 "type": "tunnel"                 "local_subnet": "192.168.1.1/24",                 "remote_subnet": "192.168.0.1/24",                 "crypto_proposal": "proposal1"               }            ]        }     ] }

GET /cgi-bin/luci/sdewan/ipsec/v1/sites/{site-name}

Get a site

Request: N/A

• Request Parameters

  Name	In	Type	Description
  site-name	path	string	remote site name

Response

• Normal response codes: 200
• Error response code: 404

• Response Parameters

  Name	In	Type	Required	Description
  name	body	string	Y	Site name
  gateway	body	string	Y	The corresponding responder
  pre_shared_key	body	string	N	Optional, only if using the PSK authentication mode
  local_public_cert	body	string	N	Optional, only if using the public key authentication mode. Public key used for auth.
  local_private_cert	body	string	N	Optional, only if using the public key authentication mode. Private key used for auth.
  shared_ca	body	string	N	Optional, only if using the public key authentication mode. CA information
  authentication_method	body	string	Y	Either 'psk' or 'pubkey' as the authentication method.
  local_identifier	body	string	N	The identifier for localhost
  remote_identifier	body	string	N	The identifier for remote counter party
  crypto_proposal	body	list	Y	Proposal names used for ike process
  force_crypto_proposal	body	boolean	N	The flag on forcing the proposal or not
  connections	body	list	Y	List of connectionArray

  connectionArray:

  Name	In	Type	Required	Description
  name	body	string	Y	Connection name
  type	body	string	Y	Type of connection. Either "tunnel" or "transport"
  mode	body	string	Y	Mode used for connection. Either 'add', 'route' or 'start'
  local_subnet	body	string	N	Defines the local subnet.
  local_nat	body	string	N	Defines the local nat, if exists, replace the local_subnet
  local_sourceip	body	string	N	Defines the local source ip
  local_updown	body	string	N	Defines the local iptable rules.
  local_firewall	body	string	N	Flag used to determine whether to enable the local firewall rules or not
  remote_subnet	body	string	N	Defines the subnet of the counter party
  remote_sourceip	body	string	N	Defines the source ip of the counter party
  remote_updown	body	string	N	Defines the iptable rules applied for the counter party
  remote_firewall	body	string	N	Flag used to determine whether to enable the remote firewall rules or not
  crypto_proposal	body	string	N	Crypto proposal used for ESP

• Response Example

  {      "name": "site1",      "gateway":"10.1.0.2",      "crypto_proposal": "proposal1"      "connections": [       {          "name": "site_to_site",          "type": "tunnel",          "local_subnet":          "remote_subnet":           "crypto_proposal": "proposal2"       }     ] }

DELETE /cgi-bin/luci/sdewan/ipsec/v1/sites/{site-name}

delete a site

Request:

• Request Parameters

  Name	In	Type	Description
  site-name	path	string	remote site name

Response

• Normal response codes: 200
• Error response codes: 401, 404