Using IPsec to protect data

This guidance is for the protection of data in transit within a single organisation, or within a group of organisations, across bearer networks such as the internet or a commercial WAN circuit. Other scenarios may benefit from some aspects of this guidance, such as the protection of information flows on dedicated links between organisations and cloud service providers, or in the inter-data centre connections in such providers' networks.

This guidance is aimed at system administrators who are responsible for configuration of network cryptographic devices and/or software. It defines two profiles for use with IPsec:

• the Recommended Profile is based upon modern cryptographic algorithms and protocols
• the Legacy Profile is to be used by only legacy devices for which transition to platforms supporting IKEv2 has not yet been possible

These profiles were last updated in 2022. There are no changes to the particulars of the profiles in this update to the guidance.

IPsec helps protect the confidentiality and integrity of your information as it travels across less-trusted networks. Network-based encryption is implemented using the IPsec protocols to establish virtual private networks (VPNs). This can be performed by a software client, by a dedicated hardware appliance (a VPN gateway), or as additional functionality in other networking infrastructure equipment (such as a router).

IPsec VPNs may be dedicated to a single purpose (such as two gateways which connect data centres together). Alternatively, a single gateway may be used by multiple clients as required (for example, for remote working connections).

Device principles

Establishing trustworthy encrypted network links is not just about technology. It is also important that the management of these networks links is carried out by skilled individuals, performing their assigned management activities in a competent and trusted fashion, within a management system that protects the overall integrity of the system.

Devices which implement cryptographic protection of information using IPsec should:

• be deployed and managed by a competent authority in a manner that does not undermine the protection they provide, from a suitable management platform
• be configured to provide effective cryptographic protection
• not be used beyond end of life, and be disposed of securely
• generate and protect private keys in an appropriate manner
• be patched promptly upon release of updated software or firmware (implementation issues can introduce vulnerabilities that can be exploited if devices are left unpatched)
• use certificates as a means of identifying and trusting other devices using a suitable PKI, possibly an in-house PKI (by exception Pre-Shared Keys (PSKs) may be used for authentication where certificates are not supported by both peers)

Additional guidance for the use of VPNs is available in the NCSC's Device Security Guidance.

Pre-Shared Keys (PSKs)

We strongly recommend using certificates for authenticating devices. The NCSC does not encourage using PSKs, nor any other approaches for establishing shared authentication keys across multiple devices. However, we recognise that PSKs are widely used in site-to-site VPNs, and in some situations, may be the only available option for authentication. In this case, we recommend that PSKs are:

• generated in a cryptographically secure manner, and have at least 128 bits of entropy
• unique to a group of devices that need to authenticate each other, and not shared across different groups
• handled securely and only by authorised personnel (from the point of creation, through distribution, to eventual destruction) to prevent compromise
• changed if you suspect they are compromised

Network design principles

Keeping the network design simple is one of the most effective ways to ensure the network provides the expected security and performance. With this in mind:

• Avoid the need for too much security functionality in any single product or network feature, as a failure in one will likely compromise all.
• VPN gateways should ideally have three interfaces; a LAN-side interface, a WAN-side interface with IPsec-encrypted data, and a management interface.
• The management interface should be connected to a dedicated management LAN (or secure dedicated management WAN with suitable encryption). Traffic on the management interface should be suitably encrypted, with strong authentication, authorisation, and auditing of management activity.
• Management functionality of the device should not be directly accessible on the WAN interface. We recommend using privileged access workstations for carrying out system management functions; they should follow NCSC’s PAWs principles.
• VPN gateways and the traffic they handle should be monitored to identify unexpected traffic patterns which may point to misconfiguration or compromise.

Some network designs may have increased complexity due to features such as:

• use of multiple LAN or WAN interfaces
• application of traffic routing rules that cause some traffic to pass in-clear depending on traffic characteristics

Care should be taken when increasing the complexity of a network, as adding additional complexity to the network design increases the risk that traffic will be mis-routed, or that devices will be configured incorrectly, allowing an attacker access to them (and the data they protect).

More information on secure network design is available in the Secure design principles and Security architecture anti-patterns. More information on management networks and management traffic protection can be found within the Acquiring, managing, and disposing of network devices guidance.

As a default policy, VPN gateways and clients should be configured:

• to offer and accept only the Recommended Profile
• to not allow negotiation of alternative cipher suites (unless explicitly permitted by an administrator)

The Legacy Profile is no longer suitable for the protection of information that attracts the OFFICIAL security classification in government and public sector networks. Such information should be protected using the Recommended Profile. It is included here solely to support the development of any remaining plans for transition to the Recommended Profile.

Post-quantum cryptography in IPsec

There is a threat to the cryptography securing IPsec from a cryptographically relevant quantum computer. The primary mitigation to this risk will be to migrate to post-quantum cryptography (PQC).

The standardisation of PQC within IPsec is well underway within the Internet Engineering Taskforce (IETF). We will update this guidance in due course to include IPsec PQC profile(s) when implementations of those final standards are widespread.