With the Dynamic IPSec feature, you can add IPSec encryption to Data Traffic and simulate a VPN configuration with the Network Host in a private network or establish a SIP session with an IMS. In some test cases, you can also use IPSec to encrypt control plane traffic between an emulated node and an SUT.
In general, adding IPSec to a test consists of the following steps:
Before you start, you will need the following information about the Security Gateway:
IP address
IKE version, authentication method (pre-shared key, RSA signature, or pre-provisioned), and the credentials required
Encryption algorithms used
If you will be using IKE authentication with RSA signatures, at a minimum you will need to generate or import private key and X.509 certificate files following the instructions in Using Digital Certificates. If you will be testing with IKEv2, you will also need to import a CA file with one or more root certificates.
To configure the IPSec parameters:
In most test cases, IPSec is optional. If possible, begin with a test that you have successfully executed without IPSec.
General options — Configure the options that control IPSec behavior. If IPSec is always used, an IPSec tab will be present in the test case. In some test cases, IPSec can be used more than once, with different tabs defining IPSec for MN Data Traffic and IPSec for control plane traffic between network nodes, for example. When IPSec is optional, you can enable it with a checkbox. See IPSec Test Options for more information about how IPSec can be enabled and used in each application or test case.
Open the test session and edit the test case.
Enable IPSec if necessary, and then select the IPSec tab.
Select the IKE Version... that is used by the peer.
Select the IKE... mode that controls whether and how IKE may be used to negotiate SAs. If you selected Pre-Provisioned, you can skip the IKE Settings section; otherwise, you can skip the IPSec Algorithms and Keys section.
If a NAT gateway is between the peers and a private address will not be obtained by the local peer (see step 4 in Tunnel Definition), check the NAT Traversal... box and define the source and destination ports.
IKE Phase I Settings — If IKE Phase I will be performed, the following parameters will be available in the upper pane for you to define the credentials and cipher suite used to negotiate IKE SAs.
If you selected V1, select an IKE Phase I Type... that is supported by the peer.
Select an Identification Type... acceptable to the remote peer. If you choose FQDN, you can provision unique values for every MN in either a host name (host.domain) or user name (user@domain) format. With MIPv6 IPSec, host and domain name are always required.
Select the Phase I algorithms:
Configure the proposed IKE SA lifetime...
Define the remaining authentication credentials depending on the IKE mode that you chose:
IKE With RSA Signature — Use the digital certificate settings to select the files that you prepared earlier and to set the number of entries in each file that will be used in the test.
IPSec Algorithms and Keys — In a Pre-Provisioned test, you configure the cipher suite and keys that would have been built-in to the local peer. Select an algorithm and enter the applicable key for each of the following:
Tunnel Definition — Complete the definition with the IPSec SA settings and a traffic selection filter if more than one tunnel is supported. If you will be using more than one tunnel, use the IPSec Tunnel checkboxes to enable additional tunnels and follow these instructions to configure each tunnel.
If IKE Phase II will be performed, you can select the cipher suite and configure a proposed lifetime for each IPSec SA. Authentication Type and Encryption Key Type have slightly different options for the IKE SA and the IPSec SA.
Enter a unique Source SPI... for each tunnel and if you are testing in Pre-Provisioned mode, enter the Peer SPI...
Select the ESP Data Mode... (see step 6 below if you are testing with MIPv6 IPSec).
If you selected V2, define the traffic selectors for each tunnel using the Advanced... button. When you use Tunnel mode with IKEv2, you can request that the gateway assign a private address with the Request Private Address... checkbox. In this case, NAT Traversal is not required.
If you are testing with Data IPSec, enter the remote peer's IP address in Security Gateway Address...
Finally, define the traffic filter for the tunnel. In most cases, Payload Destination ID... determines which packets will be routed through the tunnel. When multiple tunnels are supported, configure the filter parameters shown in the tables below for each tunnel's traffic type.
With Data IPSec, the combination of Protocol Type, Payload ID Destination, Payload Source Port, and Payload Destination Port determines the type of traffic the tunnel will bear (see Data Traffic Selection for definitions). You can route traffic generated by all DMFs through one tunnel, as long as all traffic is headed to the same destination, route separate DMFs through different tunnels, or segregate traffic by protocol as shown in the examples below. For more advanced data testing, you can trigger the start of IPSec from within the DMF.
Traffic |
Protocol Type |
Payload Source Port |
Payload Destination Port |
|---|---|---|---|
All Data Traffic |
Any |
0 |
0 |
HTTP Traffic |
TCP |
0 |
80 |
SMTP Traffic |
TCP |
0 |
25 |
All UDP Traffic |
UDP |
0 |
0 |
With MIPv6 IPSec, the combination of Protocol Type, Payload ID Destination, and ESP Data Mode determines what type of traffic the tunnel will carry (see MIPv6 Traffic Selection for definitions).
Traffic |
Protocol Type |
Payload ID Destination |
ESP Data Mode |
|---|---|---|---|
MN-HA Binding |
Mobility Header |
HA SUT address |
Transport |
Prefix Discovery |
ICMPv6 |
HA SUT address |
Transport |
Route Optimization |
ICMPv6 |
CN node address |
Tunnel |
Data Traffic |
Any |
::0 |
Tunnel |
OK the test case and Run the test session, and if the IPSec configuration is correct, you should see all sessions establish as they did without IPSec. You should also see MN IPSec Tunnel Attempts and MN IPSec Tunnel Successes on the Data Traffic measurement tab.
TROUBLESHOOT:
|