SD-WAN Cloud-Managed IPSec Bypassing IKE Firewall
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-defined wide area networks (SD-WAN), the IPSec passthrough feature prevents the establishment of overlay tunnels due to the requirement for Internet Key Exchange (IKE) protocol exchanges, which are not necessary when using cloud-managed IPSec keys, leading to dropped IPSec packets and inability to transmit traffic.
Innovation Solution
The solution involves initiating an IKE negotiation process to make the router/modem aware of IKE exchanges between end-point devices, allowing them to be recognized as legitimate IKE/IPSec sessions, thereby enabling the establishment of a cloud-managed overlay tunnel without the need for IKE exchanges, and gracefully taking down the IKE/IPSec tunnel to maintain communication uptime.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If IPSec passthrough feature is enabled in routers/modems to allow IPSec tunnels to pass through, then NAT compatibility is improved, but IKE protocol exchanges are blocked preventing cloud-managed overlay tunnel establishment
Solution Approach 1:
The solution segments the tunnel establishment process into two independent parts: (1) IKE/IPSec tunnel for key distribution, and (2) overlay tunnel for actual data transmission. The IKE tunnel is established through the router modem with passthrough enabled, while the overlay tunnel is established directly between endpoint devices using cloud-managed keys, bypassing the router's IKE inspection requirement.
Solution Approach 2:
The cloud-based key management server acts as an intermediary that distributes pre-shared keys to endpoint devices. This intermediary enables the endpoint devices to establish overlay tunnels directly without needing to perform IKE exchanges through the router modem, thus resolving the conflict between passthrough mode and overlay tunnel establishment.
2Ease of operation
If cloud-managed IPSec keys are used to establish overlay tunnels, then key management is centralized and simplified, but IKE protocol exchanges are still required by router/modem firewalls causing packet drops
Solution Approach 1:
The solution separates key management functions from tunnel establishment verification. The cloud-based key management server handles key distribution independently, while the router modem's IKE inspection is bypassed by establishing the overlay tunnel directly between endpoint devices using the pre-distributed keys, eliminating packet drops.
Solution Approach 2:
The key management server performs preliminary key distribution to endpoint devices before overlay tunnel establishment. This preliminary action provides endpoint devices with the necessary cryptographic material to establish tunnels directly, avoiding the need for IKE exchanges that would trigger router firewall packet drops.
3Reliability
If IKE negotiation is initiated to satisfy router/modem firewall requirements, then legitimate IKE/IPSec sessions are recognized, but additional bandwidth is consumed for WAN communication
Solution Approach 1:
The solution segments communication into control plane traffic (IKE negotiations with key management server) and data plane traffic (overlay tunnel traffic). The IKE negotiations consume minimal bandwidth for establishing security associations, while the bulk data transmission occurs through the efficient overlay tunnel, optimizing overall bandwidth utilization.
Solution Approach 2:
IKE negotiations are performed preliminarily to establish security associations and obtain cryptographic keys from the key management server. Once these preliminary negotiations are complete, all subsequent data transmission occurs through the overlay tunnel without requiring additional IKE exchanges, minimizing WAN bandwidth consumption.
Data Source
AI summary
Systems and methods are provided for effectuating overlay tunnels between software-defined wide area network (SD-WAN) end-point devices despite the use of IPSec passthrough in one or more network devices, such as modems or routers that exist between the end-point devices. In particular, the Internet Key Exchange (IKE) protocol can be allowed to progress until a modem/router is able to establish an IKE tunnel, after which overlay packets using cloud-managed keys can be allowed to pass through the modem/router. An overlay tunnel may then be established between the end-point devices, and the IKE tunnel can be taken down.