Dangers of creating a permiscuous IPSec VPN ( responder only) VPN

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Dangers of creating a permiscuous IPSec VPN ( responder only) VPN

L1 Bithead

We have a business partner that wants to create an IPSec VPN tunnel with our PA-5050 using pre-shared keys, but they don't want to provide a Public IP address for us to peer with.  Their other clients configure the remote peer address of 0.0.0.0 basically allowing any remote IP as a peer. 

 

My spidey sense is telling me this is a bad idea.  There's a big diffence between cracking a complex encryption algorithm and guessing a pre-shared key-  something that dictionary attack can do in a resonable amount of time.

 

Am I being paranoid?  Or is this a terrible idea?

 

Thanks for any comments.

 

 

Frank

2 REPLIES 2

Cyber Elite
Cyber Elite

Permitting incoming IPSec from any ip is used for example when branch office is behind DSL line and dynamic IP.

Then you configure aggressive mode and leave peer ip blank.

Yes it is slightly less secure as more data is sent over network before tunnel is established in clear text (Proxy ID's for example) but it is not unsecure either.

If you use good PSK then you can be pretty safe as if someone tries to connect to you and there is mismatch (crypto profile or PSK or Proxy ID etc) then responder sits silently and does not reveal what he did not like.

Palo supports up to 64 character PSK but double check what device is at other side.

I have seen limits like 29 etc in the past.

https://live.paloaltonetworks.com/t5/Management-Articles/What-is-the-Maximum-Number-of-Characters-fo...

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

As far as I know Palo supports IPSec PSK's up to 255 characters with ASCII support.

 

Here are also some limitations with other vendors which I have been experiencing in the past:

 

Juniper:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()-_=+[{]}\|;:'<,.>/
MAX LENGTH: 127 CHARACTERS

Fortinet Fortigate:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 80 CHARACTERS

Cisco Systems:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 127 CHARACTERS

Checkpoint:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 64 CHARACTERS

Watchguard:
ASCII
MAX LENGTH: 63 CHARACTERS

Microsoft:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 128 CHARACTERS

PFSense:
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
MAX LENGTH: 255 CHARACTERS (maybe even more)

 

  • 2373 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!