Full-Mesh IPsec Network: 10 Dos and 500 Don'ts
summary
Deploys a full mesh IPsec network across hundreds of hosts using ipsec-tools and raccoon, achieves ~800 Mbps on a 1 Gbit link, and completes a three month staged migration after an initial multi‑day outage. Key specifics: uses esp in transport mode, excludes ICMP and SSH from IPsec, relies on preshared keys but recommends certificates and PFS, observes raccoon state corruption and DPD creating thousands of SAs, instruments kernel and raccoon metrics, and avoids flushing all SAs or restarting daemons.
AI-written summary · about
chapters (35)
- 0:00Introduction
- 2:30Graphite
- 3:24Requirements
- 4:25Alternatives
- 4:52IPsec
- 5:45Transfer Mode
- 6:12Security Policy
- 6:42Security Association
- 7:07Internet Exchange
- 7:52Policy Database
- 9:30Hybrid Clouds
- 10:20Multiday Incident
- 11:44Convert Security Policies
- 12:00Puppet Master
- 12:15Exceptions
- 13:06Lessons Learned
- 13:16Do Not Use Raccoon
- 14:45Do Not Force All Traffic
- 15:52Dead Period Detection
- 16:43Dont disable it
- 17:53Liveness check
- 18:16Metrics
- 19:44Kernel Metrics
- 20:04Association
- 21:34Custom demon
- 21:57Do not restart
- 22:58Do not add a ruby host
- 23:49Dont flash the association database
- 24:17Netfilter logging
- 24:40Udp
- 24:59Preshare keys
- 26:05Defaults
- 26:46Overhead
- 27:45FullMesh Hypothetic
- 28:45throughput
related talks
42mIPsec development for large scale deployments
21mHow to Use XDP and eBPF to Accelerate IPSec Throughput by 400%
26mThe Dangers of Key Reuse: Practical Attacks on IPsec IKE
54mOpportunistic Encryption Using IPsec
20mConnecting, Securing and Optimising Enterprise Networks with Free Software
28mPsycho Security - End to End Encryption
01h 00mCommSec D1 - An Isolated Data Center Security Policy Model Using SmartNICs
29mLessons Learned in the Move to IP Routing