Dead Peer Detection

Detection Dead Peer? Sudden failure of the VPN peer during communication. Since VPN gateway does not typically initiating traffic it does not notice if or when the VPN has failed.
Solution to Dear Peer? Configure DPD on Gateway DPD sends UDP messages at defined intervals, and if messages are not responded to, the peer is considered to be down.
Exception to DPD DPD is used when dynamic routing is not used(e.g., OSPF), because dynamic routing protocols can both detect a failure and default over to another path without the need for DPD.

Nonce

Nonce is a random number generated by each peer during IKE negotiation phase to prevent replay attacks
Each peer generates its own nonce and includes it in the IKE messages.

PFS / Perfact forward Secrecy

What? Renegotiating Phase-1 keys,encryption-algos,auth-algos AGAIN before proceeding to negotiate Phase-1
Why? keys exchanged in phase-1 are found at risk, particularly in Aggressive mode, because IKE identities are sent in the clear.
How? New DH-keys are formed in IKEv1-Phase-1. New keys are generated using new Nonces exchanged between the peers. If PFS is enabled in IKE Phase-2. Then New Key is generated in Phase-2.

SA(Security Association)

SA/Connection is identified by security attributes(Eg: encryption key, encryption algorithm) between IPSec peers.
Bidirectional communication requires at least two SAs, one for each direction.
Since there are 2 stages in establishing IPSec tunnel there are 2 types of SAs.
Cookie, SPI

IKE SA IPsec SA
Usage IKE SA is used for exchanging IPSec SA IPSec SA is used for encryption of user traffic
Content BRIEF:

  Authentication-method:           MD5
  Encryption method:               3DES
  DH group used:                   2
  Life of IKE SA:                  86400(sec)
  Shared secret key for encryption algo: Preshared

DETAILED:

IKE peer peer2-ip-address, Index 2719962, Gateway Name: SERVER-BOX
Role: Responder, State: UP
Initiator cookie: .., Responder cookie: ..
Exchange type: Main, Authentication method: Pre-shared-keys
Local: 1.1.1.1:500, Remote: 2.2.2.2:500
Lifetime: Expires in 86378 seconds
Algorithms:
    Authentication        : hmac-md5-96 
    Encryption            : 3des-cbc
    Pseudo random function: hmac-md5
    Diffie-Hellman group  : DH-group-2
Traffic statistics:
    Input  bytes  :                  584
    Output bytes  :                  696
    Input  packets:                    5
    Output packets:                    4
  Flags: IKE SA is created 
  IPSec security associations: 1 created, 0 deleted
  Phase 2 negotiations in progress: 0
BRIEF:

  Destination-address:        2.2.2.2
  SPI:                        7C123A9C
  Protocol:                   (ESP or AH)
  Authentication:             hmac-sha1-96
  Encryption:                 aes-cbc

DETAILED:


ID: 131073 Virtual-system: root, VPN Name: SERVER-BOX
Local Gateway: peer-1-ip, Remote Gateway: peer-2-ip
Version: IKEv1
DF-bit: clear
Bind-interface: st0.80
Port: 500, Nego#: 5, Fail#: 0, Def-Del#: 0 Flag: 0x600a29 
Direction: inbound, SPI: 5ef52687, AUX-SPI: 0
    Hard lifetime: Expires in 1175 seconds
    Lifesize Remaining:  Unlimited
    Soft lifetime: Expires in 972 seconds
    Mode: Tunnel(0 0), Type: dynamic, State: installed
    Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)
    Anti-replay service: counter-based enabled, Replay window size: 64
Direction: outbound, SPI: c786011d, AUX-SPI: 0, VPN Monitoring: -
    Hard lifetime: Expires in 1175 seconds
    Lifesize Remaining:  Unlimited
    Soft lifetime: Expires in 972 seconds
    Mode: Tunnel(0 0), Type: dynamic, State: installed
    Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)
    Anti-replay service: counter-based enabled, Replay window size: 64

SAD(Security Association DB)

Database which Stores SAs

SPI(SECURITY PARAMETER INDEX)

eg:7C123A9C
This tag helps the Peers to distinguish between two IPSec streams. For Example: if there were 2 different IPSEC flows between 2 peers, each using a different secret key, the SPI would allow each peer to determine which key to use on each packet.
Can SPI be same as cookie? Yes
Where is used? It should be present in IPSec SA. An SPI has only local significance, since it is defined by the creator of the SA.

SP / Security Policy


SP Format
Node    3    2
SA sa1    transport 192.168.2.2    ESP 1234
-E    DES_CBC    "Auth-Key"
-A    HMAC_MD5    "encrypt-key"
SP    NA-1.0//src    NA-5.0//dst    ANY    -P    OUT    IPSEC     sa1
SP    192.168.1.0    192.168.5.0    UDP    -P    IN    IPSEC    sa1