IPSEC data model

[DanPartelly]

Please look at this ipsec data model and see what else you would like to see in it (only isakmp v1 for now). Some lowest common denominator algorithms will be added if necessary for older devices.

---
attributes:
  isakmp_key:
    key:
      type: string
      _required: True
    peer:
      type: ipv4
      use: address
      _default: 0.0.0.0

  isakmp_policy:
    priority:
      type: int
      min_value: 1
      max_value: 10000
      _required: True
    encryption:
      type: str
      valid_values: [aes, 192-aes, 256-aes]
      _default: 256-aes
    hash:
      type: str
      valid_values: [sha, sha256, sha384, sha512]
      _default: sha256
    dh_group:
      type: int
      valid_values: [14, 15, 16, 19, 20, 21]
      _default: 14
    lifetime:
      type: int
      min_value: 60
      max_value: 86400
      _default: 86400
    auth:
      type: str
      valid_values: [pre-share, rsa-encr, rsa-sig]
      _default: pre-share

  transform_set:
    esp_encryption:
      type: str
      valid_values: [esp-192-aes, esp-256-aes, esp-aes, esp-gcm]
      _default: esp-gcm
    esp_authentication:
      type: str
      valid_values:
        [esp-sha-hmac, esp-sha256-hmac, esp-sha384-hmac, esp-sha512-hmac]
      _default: esp-sha256-hmac
    ah_enable:
      type: bool
      _default: False  
    ah:
      type: str
      valid_values:
        [ah-sha-hmac, ah-sha256-hmac, ah-sha384-hmac, ah-sha512-hmac]
    mode:
      type: str
      valid_values: [tunnel, transport]
      _default: tunnel

  ipsec_profile:
    transform:
      type: str
      _required: True
    pfs:
      type: str
      valid_values: [group14, group15, group16, group19, group20, group21]

  global:
    ipsec:
      psk:
        type: list
        _subtype: isakmp_key
      isakmp:
        type: list
        _subtype: isakmp_policy
      transform:
        type: dict
        _subtype: transform_set
      profile:
        type: dict
        _subtype: ipsec_profile

  node:
    psk:
      copy: global
    isakmp:
      copy: global
    transform:
      copy: global
    profile:
      copy: global

[jbemmel]

isakmp_key:
key:
type: string
_required: True
peer:
type: ipv4
use: address
_default: 0.0.0.0

This matches Cisco CLI, but conceptually in my mind the peer belongs to the ipsec connection - not the isakmp protocol below it.

Is 0.0.0.0 a dynamic peer?

[DanPartelly]

by default , cisco routers use IP address at a mean to identify themselves to the peer of ipsec/isakmp phase-1 negotiations (this can be changed to fqdn ) . So basically, the "peer" ip adress represents the identity of the remote peer for which this key is accepted. 0.0.0.0 means, accept this key for anyone.

Which brings me to the question: shuld we support fqdns as well ?

[jbemmel]

We could use “any” as default and then map that to 0.0.0.0 in the template

I like when the configuration is readable and clear about its intended result

[jbemmel]

isakmp_policy:

The underscoring suggests that this associated with isakmp - an alternative would be:
‘’’
isakmp:
key:
policy:
…
‘’’

but if isakmp-v1 is one of many supported protocols I would suggest
‘’’
key: …
protocol: isakmp-v1
policy: …
‘’’

[DanPartelly]

I plan to add isakmpv2 one day, which is anyway what should be used today. But i couldn't be bothered to doit today , it requires more data structures.

[ipspace]

And this is why I hate IPsec... can we find a way to specify the gazillion parameters in a simpler way? Ideally, we'd use some default to make things work¹, and then tell users how to use custom templates to tweak all the nerd knobs they want.

I'm definitely not going to run the integration tests to check whether all the various settings work, and if we don't thoroughly test this stuff, it's bound to be broken (unfortunately, I have tons of examples).

The only thing I'd go for initially is a preshared key, and ideally that one would be specified on the IPsec tunnel, potentially with a global/node-level fallback that could also be used for dynamic tunnels (should we decide to implement them).

Footnotes

1. Good luck finding the defaults that would work on Cisco IOS and still be accepted by other platforms, but that's a different story ↩

[DanPartelly]

Ill change to model anyway. Working with vti tunnels I found that on-demand copying from global to node on reference keeps transformed topology noise at a minimum. SO what I want to have is on demand recursive copy of the referenced ipsec policy, with full chain of referenced object validated.

[ipspace]

It would be ideal if you could somehow reuse what we're doing in the routing module, because it's doing exactly what you're describing for various routing-related objects. Maybe we could later move the common functionality into "utils/something" if you find it useful.