topic Dangers of creating a permiscuous IPSec VPN ( responder only) VPN in General Topics

Dangers of creating a permiscuous IPSec VPN ( responder only) VPN

fmurray — Fri, 27 May 2016 18:07:11 GMT

We have a business partner that wants to create an IPSec VPN tunnel with our PA-5050 using pre-shared keys, but they don't want to provide a Public IP address for us to peer with. Their other clients configure the remote peer address of 0.0.0.0 basically allowing any remote IP as a peer.

My spidey sense is telling me this is a bad idea. There's a big diffence between cracking a complex encryption algorithm and guessing a pre-shared key- something that dictionary attack can do in a resonable amount of time.

Am I being paranoid? Or is this a terrible idea?

Thanks for any comments.

Frank

Re: Dangers of creating a permiscuous IPSec VPN ( responder only) VPN

Raido_Rattameister — Sat, 28 May 2016 06:26:54 GMT

Permitting incoming IPSec from any ip is used for example when branch office is behind DSL line and dynamic IP.

Then you configure aggressive mode and leave peer ip blank.

Yes it is slightly less secure as more data is sent over network before tunnel is established in clear text (Proxy ID's for example) but it is not unsecure either.

If you use good PSK then you can be pretty safe as if someone tries to connect to you and there is mismatch (crypto profile or PSK or Proxy ID etc) then responder sits silently and does not reveal what he did not like.

Palo supports up to 64 character PSK but double check what device is at other side.

I have seen limits like 29 etc in the past.

https://live.paloaltonetworks.com/t5/Management-Articles/What-is-the-Maximum-Number-of-Characters-for-an-IPSec-Pre-Shared/ta-p/62618

Re: Dangers of creating a permiscuous IPSec VPN ( responder only) VPN

Remo — Tue, 31 May 2016 06:00:13 GMT

As far as I know Palo supports IPSec PSK's up to 255 characters with ASCII support.

Here are also some limitations with other vendors which I have been experiencing in the past:

Juniper:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()-_=+[{]}\|;:'<,.>/
MAX LENGTH: 127 CHARACTERS

Fortinet Fortigate:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 80 CHARACTERS

Cisco Systems:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 127 CHARACTERS

Checkpoint:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 64 CHARACTERS

Watchguard:
ASCII
MAX LENGTH: 63 CHARACTERS

Microsoft:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 128 CHARACTERS

PFSense:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 255 CHARACTERS (maybe even more)