VPN Protocols
The term "VPN" has taken on many different meanings in recent years. VPNC has a white paper about VPN technologies that describes many of the terms used in the VPN market today. In specific, it differentiates between secure VPNs and trusted VPNs, which are two very different technologies.
For secure VPNs, the technologies that VPNC supports are
- IPsec with encryption
- L2TP inside of IPsec
- SSL with encryption
- MPLS with constrained distribution of routing information through BGP ("layer 3 VPNs")
- Transport of layer 2 frames over MPLS ("layer 2 VPNs")
IPsec is the most dominant protocol for secure VPNs. SSL gateways for remote-access users are also popular for secure VPNs. L2TP running under IPsec has a much smaller but significant deployment. For trusted VPNs, the market is split on the two MPLS-based protocols. Companies want to do their own routing thend to use layer 2 VPNs; companies that want to outsource their routing tend to use layer 3 VPNs.
The various VPN protocols are defined by a large number of standards and recommendations that are codified by the Internet Engineering Task Force (IETF). There are many flavors of IETF standards, recommendations, statements of common practice, and so on. Some of the protocols used in IPsec are full IETF standards; however, the others are often useful and stable enough to be treated as standard by people writing IPsec software. Neither of the trusted VPN technologes are IETF standards yet, although there is a great deal of work being done on them to get them to become standards.
RFCs
The IETF codifies the decisions it comes to in documents called "Requests For Comments". These are almost universally called by their acronym "RFCs". Many RFCs are the standards on which the Internet is formed.
The level of standardization that an RFC reaches is determined not only by "how good" the RFC is, but by how widely it is implemented and tested. Some RFCs are not solid standards, but they nonetheless document technologies that are of great value to the Internet and thus should be used as guidelines for implementing VPNs.
For the purpose of defining VPNs, any protocol that has become an IETF Request For Comments (RFC) document can be treated as somewhat of a standard. Certainly, any IPsec-related RFC that has been deemed to be on the IETF "standards track" should certainly be considered a standard.
Internet Drafts
Before a document becomes an RFC, it starts out as an Internet Draft (often called "IDs" or "I-Ds"). IDs are rough drafts, and are sometimes created for no other benefit than to tell the Internet world what the author is thinking. On the other hand, there is often very good information in some IDs, particularly those that cover revisions to current standards.
Some Internet Drafts go along for years, but are then dropped or abandoned; others get on a fast track to becoming RFCs, although this is rare. Internet Drafts are given names when they first appear; if they become RFCs, the I-D name disappears and an RFC number is assigned.
It should be emphasized here that it is unwise to make any programming decisions based on information in Internet Drafts. Most IDs go through many rounds of revisions, and some rounds make wholesale changes in the protocols described in a draft. Further, many IDs are simply abandoned after discussion reveals major flaws in the reasoning that lead to the draft.
That being said, it is worthwhile to know which IDs pertain to areas of interest. The following is a list of the IDs that are related to Internet mail. Some of these drafts will likely become RFCs in the months or years to come, possibly with heavy revision; some will be merged with other drafts; others will be abandoned.
Protocol listings
The relevant IETF Working Groups for the protocols used by secure VPNs and trusted VPNs are:
- Profiling Use of PKI in IPsec Working Group
- Transport Layer Security Working Group
- Layer 2 Virtual Private Networks (l2vpn) Working Group
- Layer 3 Virtual Private Networks (l2vpn) Working Group
- Pseudo Wire Emulation Edge to Edge (pwe3) Working Group
The documents are arranged by the general categories they apply to. These categories are:
For secure VPNs:
- General IPsec
- ESP and AH (encryption and authentication headers)
- Key exchange (ISAKMP, IKE, and others)
- Cryptographic algorithms
- IPsec policy handling
- Remote access
- SSL and TLS
For trusted VPNs:
General IPsec
| RFC 4301 | Security Architecture for the Internet Protocol | Proposed standard |
| RFC 2401 | Security Architecture for the Internet Protocol | Obsoleted by RFC 4301 |
| RFC 2411 | IP Security Document Roadmap | Informational RFC |
| RFC 2521 | ICMP Security Failures Messages | Experimental RFC |
| RFC 2709 | Security Model with Tunnel-mode IPsec for NAT Domains | Informational RFC |
| RFC 2764 | Framework for IP Based Virtual Private Networks | Informational RFC |
| RFC 3102 | Realm Specific IP: Framework | Experimental RFC |
| RFC 3103 | Realm Specific IP: Protocol Specification | Experimental RFC |
| RFC 3104 | RSIP Support for End-to-end IPSEC | Experimental RFC |
| RFC 3554 | On the Use of SCTP with IPsec | Proposed standard |
| RFC 3884 | Use of IPsec Transport Mode for Dynamic Routing | Informational RFC |
| RFC 3723 | Securing Block Storage Protocols over IP | Proposed standard |
| RFC 3706 | Traffic-Based Method of Detecting Dead IKE Peers | Informational RFC |
| RFC 3776 | Using IPsec to Protect Mobile IPv6 Signaling Between Mobile Nodes and Home Agents | Proposed standard |
| RFC 3756 | IPv6 Neighbor Discovery trust models and threats | Informational RFC |
| RFC 4891 | Using IPsec to Secure IPv6-in-IPv4 Tunnels | Informational RFC |
| RFC 5265 | Mobile IPv4 Traversal across IPsec-Based VPN Gateways | Proposed standard |
| draft-ietf-pana-ipsec | Securing the first hop in PANA using IPsec | |
| draft-vidya-ipsec-failover-ps | IPsec Gateway Failover and Redundancy - Problem Statement and Goals | |
| draft-dondeti-ipsec-failover-sol | IPsec Gateway Failover and Redundancy Protocol | |
| draft-sheffer-ike-session-resumption | Stateless Session Resumption for the IKE Protocol | |
| draft-hoffman-esp-null-protocol | An Authentication-only Profile for ESP with an IP Protocol Identifier | |
| draft-grewal-ipsec-traffic-visibility | Traffic visibility using IPsec ESP NULL encryption | |
| draft-nir-qcr | A Quick Crash Recovery Method for IKE | |
| draft-nir-ike-qcd | A Quick Crash Detection Method for IKE | |
ESP and AH Headers
| RFC 4302 | IP Authentication Header | Proposed standard |
| RFC 4303 | Encapsulating Security Payload (ESP) | Proposed standard |
| RFC 4304 | Extended Sequence Number Addendum to IPsec DOI for ISAKMP | Proposed standard |
| RFC 4835 | Cryptographic Algorithm Implementation Requirements For ESP And AH | Proposed standard |
| draft-nikander-esp-beet-mode | Bound End-to-End Tunnel (BEET) mode for ESP | |
| draft-ietf-rohc-ikev2-extensions-hcoipsec | Extensions to IKEv2 to Support Header Compression over IPsec (HCoIPsec) | |
Key Exchange
| RFC 4306 | Internet Key Exchange (IKEv2) Protocol | Proposed standard |
| RFC 4718 | IKEv2 Clarifications and Implementation Guidelines | Informational RFC |
| draft-ietf-ipsecme-ikev2bis | Internet Key Exchange (IKEv2) Protocol | Replacement for RFC 4306 and RFC 4718 |
| RFC 4307 | Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2) | Proposed standard |
| RFC 4308 | Cryptographic Suites for IPsec | Proposed standard |
| RFC 2407 | Internet IP Security Domain of Interpretation for ISAKMP | Obsoleted by RFC 4306 (IKEv2) |
| RFC 2408 | Internet Security Association and Key Management Protocol (ISAKMP) | Obsoleted by RFC 4306 (IKEv2) |
| RFC 2409 | Internet Key Exchange (IKE) | Obsoleted by RFC 4306 (IKEv2) |
| RFC 4109 | Algorithms for IKEv1 | Proposed standard |
| RFC 3715 | IPsec-NAT Compatibility Requirements | Informational RFC |
| RFC 3948 | UDP Encapsulation of IPsec Packets | Proposed standard |
| RFC 3947 | Negotiation of NAT-Traversal in the IKE | Proposed standard |
| RFC 3766 | Determining Strengths For Public Keys Used For Exchanging Symmetric Keys | Best Current Practice (BCP 86) |
| RFC 2412 | OAKLEY Key Determination Protocol | Informational RFC |
| RFC 2367 | PF_KEY Key Management API, Version 2 | Informational RFC |
| RFC 2522 | Photuris: Session-Key Management Protocol | Experimental RFC |
| RFC 2523 | Photuris: Extended Schemes and Attributes | Experimental RFC |
| RFC 3129 | Requirements for Kerberized Internet Negotiation of Keys | Informational RFC |
| RFC 4025 | Method for storing IPsec keying material in DNS | Proposed standard |
| RFC 4595 | Use of IKEv2 in The Fibre Channel Security Association Management Protocol | Informational RFC |
| RFC 4806 | Online Certificate Status Protocol (OCSP) Extensions to IKEv2 | Proposed standard |
| RFC 5106 | EAP IKEv2 Method (EAP-IKEv2) | Experimental RFC |
| RFC 4739 | Multiple Authentication Exchanges in the IKEv2 Protocol | Experimental RFC |
| draft-nourse-scep | Cisco Simple Certificate Enrollment Protocol (SCEP) | |
| RFC 3547 | Group Domain of Interpretation | Proposed standard |
| RFC 4322 | Opportunistic Encryption using the Internet Key Exchange (IKE) | Informational RFC |
| RFC 4809 | Requirements for an IPsec Certificate Management Profile | Informational RFC |
| RFC 4945 | IPsec PKI Profile of IKEv1/ISAKMP, IKEv2, and PKIX | Proposed standard |
| RFC 4478 | Repeated Authentication in IKEv2 | Experimental RFC |
| RFC 4869 | Suite B Cryptographic Suites for IPsec | Informational RFC |
| draft-eronen-ipsec-ikev2-ipv6-config | IPv6 Configuration in IKEv2 | |
Cryptographic Algorithms
| RFC 2405 | ESP DES-CBC Cipher Algorithm With Explicit IV | Proposed standard |
| RFC 2451 | ESP CBC-Mode Cipher Algorithms | Proposed standard |
| RFC 2104 | HMAC: Keyed-Hashing for Message Authentication | Informational RFC |
| RFC 2202 | Test Cases for HMAC-MD5 and HMAC-SHA-1 | Informational RFC |
| RFC 2403 | Use of HMAC-MD5-96 within ESP and AH | Proposed standard |
| RFC 2404 | Use of HMAC-SHA-1-96 within ESP and AH | Proposed standard |
| RFC 2857 | Use of HMAC-RIPEMD-160-96 within ESP and AH | Proposed standard |
| RFC 2410 | NULL Encryption Algorithm and Its Use With IPsec | Proposed standard |
| RFC 1828 | IP Authentication using Keyed MD5 (may be moved to Historic) | Proposed standard |
| RFC 1829 | ESP DES-CBC Transform (may be moved to Historic) | Proposed standard |
| RFC 2085 | HMAC-MD5 IP Authentication with Replay Prevention | Proposed standard |
| RFC 3173 | IP Payload Compression Protocol (IPComp) | Proposed standard |
| RFC 2394 | IP Payload Compression Using DEFLATE | Informational RFC |
| RFC 2395 | IP Payload Compression Using LZS | Informational RFC |
| RFC 3051 | IP Payload Compression Using ITU-T V.44 Packet Method | Informational RFC |
| RFC 3526 | More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE) | Proposed standard |
| RFC 3566 | AES-XCBC-MAC-96 Algorithm and Its Use With IPsec | Proposed standard |
| RFC 3602 | AES-CBC Cipher Algorithm and Its Use With IPsec | Proposed standard |
| RFC 4434 | AES-XCBC-PRF-128 algorithm for IKE | Proposed standard |
| RFC 3686 | Using AES Counter Mode With IPsec ESP | Proposed standard |
| RFC 4309 | Using AES CCM Mode With IPsec ESP | Proposed standard |
| RFC 4196 | SEED Cipher Algorithm and Its Use With IPSec | Proposed standard |
| RFC 4894 | Use of Hash Algorithms in IKE and IPsec | Informational RFC |
| RFC 4270 | Attacks on Cryptographic Hashes in Internet Protocols | Informational RFC |
| RFC 4312 | The Camellia Cipher Algorithm and Its Use With IPsec | Proposed standard |
| RFC 4753 | ECP Groups For IKE | Informational RFC |
| RFC 4106 | Use of Galois Message Authentication Code (GMAC) in IPsec ESP | Proposed standard |
| RFC 4359 | Use of RSA/SHA-1 Signatures within ESP and AH | Proposed standard |
| RFC 4493 | AES-CMAC Algorithm | Informational RFC |
| RFC 4494 | AES-CMAC-96 Algorithm and its use with IPsec | Proposed standard |
| RFC 4615 | AES-CMAC-PRF-128 Algorithm for IKE | Proposed standard |
| RFC 4634 | US Secure Hash Algorithms (SHA and and HMAC-SHA) | Informational RFC |
| RFC 4231 | Identifiers and Test Vectors for HMAC-SHA-224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 | Proposed standard |
| RFC 4754 | IKE and IKEv2 Authentication Using ECDSA | Proposed standard |
| draft-ietf-ipsec-ike-ecc-groups | Additional ECC Groups For IKE and IKEv2 | In IETF Last Call |
| RFC 4868 | Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec | Proposed standard |
| RFC 5282 | Using Authenticated Encryption Algorithms with the Encrypted Payload of IKEv2 | Proposed standard |
IPsec policy handling
| RFC 3585 | IPsec Configuration Policy Information Model | Proposed standard |
| RFC 3586 | IP Security Policy Requirements | Proposed standard |
| draft-ietf-l3vpn-ce-based | Framework for Provider Provisioned CE-based Virtual Private Networks using IPsec | |
| RFC 4807 | IPsec Security Policy Database Configuration MIB | Proposed standard |
Remote access
| RFC 2661 | Layer Two Tunneling Protocol (L2TP) | Proposed standard |
| RFC 2888 | Secure Remote Access with L2TP | Informational RFC |
| RFC 3193 | Securing L2TP using IPsec | Proposed standard |
| RFC 3457 | Requirements for IPsec Remote Access Scenarios | Informational RFC |
| RFC 3456 | Dynamic Host Configuration Protocol (DHCPv4) Configuration of IPsec Tunnel Mode | Proposed standard |
| RFC 4621 | Design of the MOBIKE Protocol | Informational RFC |
| RFC 4555 | IKEv2 Mobility and Multihoming Protocol (MOBIKE) | Proposed standard |
SSL and TLS
| RFC 2246 | The TLS Protocol Version 1.0 | Proposed standard, being updated to version 1.1 by draft-ietf-tls-rfc2246-bis |
| RFC 2818 | HTTP Over TLS | Informational RFC |
| RFC 3546 | TLS Extensions | Proposed standard, being updated by draft-ietf-tls-rfc3546bis |
| RFC 4279 | Pre-Shared Key Ciphersuites for TLS | Proposed standard |
General MPLS
| RFC 3031 | Multiprotocol Label Switching Architecture | Full standard |
| RFC 3032 | MPLS Label Stack Encoding | Full standard |
| RFC 3036 | Label Distribution Protocol (LDP) Specification | Full standard |
| RFC 3037 | LDP Applicability | Informational RFC |
MPLS constrained by BGP routing
| RFC 4364 | BGP/MPLS IP VPNs | Proposed standard |
| RFC 4365 | Applicability Statement for BGP/MPLS IP VPNs | Informational RFC |
| RFC 4381 | Analysis of the Security of BGP/MPLS IP VPNs | Informational RFC |
| RFC 4026 | Provider Provisioned Virtual Private Network (VPN) Terminology | Informational RFC |
| RFC 4176 | Framework for PPVPN Operations and Management | Informational RFC |
| RFC 4265 | Definition of Textual Conventions for Virtual Private Network (VPN) Management | Proposed standard |
| draft-ietf-l3vpn-ipsec-2547 | Use of PE-PE IPsec in RFC2547 VPNs | |
| draft-ietf-l3vpn-gre-ip-2547 | Use of PE-PE GRE or IP in RFC2547 VPNs | |
| RFC 4031 | Service requirements for Layer 3 Provider Provisioned Virtual Private Networks | Informational RFC |
| RFC 3809 | Generic Requirements for Provider Provisioned VPNs (PPVNP) | Informational RFC |
| RFC 4110 | Framework for Layer 3 Provider Provisioned Virtual Private Networks | Informational RFC |
| draft-ietf-l3vpn-bgpvpn-auto | Using BGP as an Auto-Discovery Mechanism for Network-based VPNs | |
| RFC 4111 | Security Framework for Provider Provisioned Virtual Private Networks | Informational RFC |
| draft-ietf-l3vpn-rt-constrain | Constrained VPN route distribution | Approved as a Proposed Standard |
Transport of layer 2 frames over MPLS
| draft-ietf-l2vpn-requirements | Service Requirements for Layer 2 Provider Provisioned Virtual Private Networks | |
| draft-ietf-l2vpn-vpls-bgp | Virtual Private LAN Service | Approved as a Proposed Standard |
| draft-ietf-l2tpext-l2vpn | L2VPN Extensions for L2TP | Approved as a Proposed Standard |
| RFC 3916 | Requirements for Pseudo-Wire Emulation Edge-to-Edge (PWE3) | Informational RFC |
| RFC 3985 | PWE3 Architecture | Informational RFC |
| RFC 4447 | Transport of Layer 2 Frames Over MPLS | Proposed standard |
| RFC 4448 | Encapsulation Methods for Transport of Ethernet Over MPLS Networks | Proposed standard |
| draft-ietf-l2tpext-pwe3-ethernet | Transport of Ethernet Frames over L2TPv3 | Approved as a Proposed Standard |
| draft-ietf-pwe3-frame-relay | Frame Relay over Pseudo-Wires | |
Virtual Routers
| draft-ietf-l3vpn-as-vr | Applicability Statement for Virtual Router-based Layer 3 PPVPN approaches | |
| draft-ietf-l3vpn-vpn-vr | Network based IP VPN Architecture using Virtual Routers | |
| draft-ietf-l3vpn-vr-mib | Virtual Router Management Information Base Using SMIv2 | |
No comments:
Post a Comment