Subject: [nvo3] VxLAN Security Consideration

From: Liuyuanjiao <[email-masked]>
Date: Tue, 2 Jun 2015 15:03:03 +0000

Dear fellows:

         Now, in the VxLAN environment, there is no specific Security method to protect the VxLAN packet in the middle network.

    The middle network is not controlled by customer and the service provider, it's provided by 3nd company, so the environment is not trusted, we need to encrypt the VxLAN packets or VxLAN payload for our user data.
    Currently, no such specific method, I think we need to provide one way to resolve it.

Best Regards
         Liu Yuanjiao

---

From: David Mozes <[email-masked]>
Date: Tue, 2 Jun 2015 15:33:06 +0000

Agree

From: nvo3 [mailto:[email-masked]] On Behalf Of Liuyuanjiao
Sent: Tuesday, June 02, 2015 6:03 PM
To: [email-masked]
Cc: Xuxiaohu; Liuyuanjiao
Subject: [nvo3] VxLAN Security Consideration

Dear fellows:

Best Regards
         Liu Yuanjiao

---

From: Michael Shieh <[email-masked]>
Date: Tue, 2 Jun 2015 11:51:30 -0700

How about using IPsec with transparent mode?  the security model has been
proven in the field.

- Michael

On Tue, Jun 2, 2015 at 8:33 AM, David Mozes <[email-masked]> wrote:

>  Agree
>
>
>
> *From:* nvo3 [mailto:[email-masked]] *On Behalf Of *Liuyuanjiao
> *Sent:* Tuesday, June 02, 2015 6:03 PM
> *To:* [email-masked]
> *Cc:* Xuxiaohu; Liuyuanjiao
> *Subject:* [nvo3] VxLAN Security Consideration
>
>
>
> Dear fellows:
>
>
>
>
>
>          Now, in the VxLAN environment, there is no specific Security
> method to protect the VxLAN packet in the middle network.
>
>
>
>     The middle network is not controlled by customer and the service
> provider, it’s provided by 3nd company, so the environment is not trusted,
> we need to encrypt the VxLAN packets or VxLAN payload for our user data.
>
> _______________________________________________
> nvo3 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nvo3
>
>

-- 
This message is for the designated and authorized recipient only and may 
contain privileged, proprietary, confidential or otherwise private 
information relating to vArmour Networks, Inc. and is the sole property of 
vArmour Networks, Inc.  Any views or opinions expressed are solely those of 
the author and do not necessarily represent those of vArmour Networks, Inc. 
If you have received this message in error, or if you are not authorized to 
receive it, please notify the sender immediately and delete the original 
message and any attachments from your system immediately. If you are not a 
designated or authorized recipient, any other use or retention of this 
message or its contents is prohibited.

---

From: Tom Herbert <[email-masked]>
Date: Tue, 2 Jun 2015 15:57:44 -0700

> How about using IPsec with transparent mode?  the security model has been
Do you mean transport mode?

---

From: Michael Shieh <[email-masked]>
Date: Tue, 2 Jun 2015 15:59:10 -0700

sorry for the typo.  yes transport mode, to save another tunneled IP header.

- Michael

On Tue, Jun 2, 2015 at 3:57 PM, Tom Herbert <[email-masked]> wrote:

> >>     Currently, no such specific method, I think we need to provide one
> way
> >> to resolve it.
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >> Best Regards
> >>
> >>          Liu Yuanjiao
> >>
> >>

---

From: "Dacheng Zhang" <[email-masked]>
Date: Wed, 03 Jun 2015 09:57:26 +0800

I think both ipsec and dtls would work.

    The middle network is not controlled by customer and the service
provider, it’s provided by 3nd company, so the environment is not trusted,
we need to encrypt the VxLAN packets or VxLAN payload for our user data.
    Currently, no such specific method, I think we need to provide one way
to resolve it.
A question for Yuanjian, are there any cases in which we need to only
encrypt the vxlan payloads while transporting the headers in plain text? If
so, the condition could be a little more complex.

Cheers

Dacheng

_______________________________________________ nvo3 mailing list
[email-masked] https://www.ietf.org/mailman/listinfo/nvo3

---

From: "Dacheng Zhang" <[email-masked]>
Date: Wed, 03 Jun 2015 10:48:42 +0800

By the way, I think the tunneled IP header could be used to for an ipsec
gateway to forward the packets to the associated  VTEP, if we need to
consider the scenarios where the ipsec gateway and the VTEP are not
co-located. 

Cheers

Dacheng

发件人:  Michael Shieh <[email-masked]>
日期:  2015年6月3日 星期三 上午6:59
至:  Tom Herbert <[email-masked]>
抄送:  David Mozes <[email-masked]>, Xuxiaohu <[email-masked]>,
"[email-masked]" <[email-masked]>, Liuyuanjiao <[email-masked]>
主题:  Re: [nvo3] VxLAN Security Consideration

- Michael

---

From: Tom Herbert <[email-masked]>
Date: Tue, 2 Jun 2015 19:59:29 -0700

> so, the condition could be a little more complex.
We have a payload encryption option in GUE using DTLS
(https://tools.ietf.org/html/draft-hy-gue-4-secure-transport-02). This
allows the GUE headers to be sent in plaintext for inspection by
middleboxes. One nice feature is that this is done as an extension to
the protocol so that we don't need another port like just doing DTLS
over UPD payload would require. We do though need to consider security
of the header itself in this case though.

Tom

---

From: Liuyuanjiao <[email-masked]>
Date: Wed, 3 Jun 2015 09:15:17 +0000

Dear Zhang Dacheng:

         Now, in the middle network, we need to monitor the traffic basing on the VNI. But if we use IPSec, we could not see VNI anymore.
         So the users could monitor the traffic in the way of VNI, only can monitor the vxlan tunnel overall traffic.

         Another scenario is: we want to adjust the users traffic basing on VNI into different underlay paths. But if VNI do not see, we could not do it. Because in one vxlan tunnel, we may have server VNIs.

Best Regards
         Liu Yuanjiao

发件人: Dacheng Zhang [mailto:[email-masked]]
发送时间: 2015年6月3日 9:57
收件人: Michael Shieh; David Mozes
抄送: Xuxiaohu; [email-masked]; Liuyuanjiao
主题: Re: [nvo3] VxLAN Security Consideration

    The middle network is not controlled by customer and the service provider, it’s provided by 3nd company, so the environment is not trusted, we need to encrypt the VxLAN packets or VxLAN payload for our user data.Dear
    Currently, no such specific method, I think we need to provide one way to resolve it.
A question for Yuanjian, are there any cases in which we need to only encrypt the vxlan payloads while transporting the headers in plain text? If so, the condition could be a little more complex.

Cheers

Dacheng

Best Regards
         Liu Yuanjiao

_______________________________________________
nvo3 mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/nvo3

This message is for the designated and authorized recipient only and may contain privileged, proprietary, confidential or otherwise private information relating to vArmour Networks, Inc. and is the sole property of vArmour Networks, Inc.  Any views or opinions expressed are solely those of the author and do not necessarily represent those of vArmour Networks, Inc. If you have received this message in error, or if you are not authorized to receive it, please notify the sender immediately and delete the original message and any attachments from your system immediately. If you are not a designated or authorized recipient, any other use or retention of this message or its contents is prohibited.
_______________________________________________ nvo3 mailing list [email-masked]<mailto:[email-masked]> https://www.ietf.org/mailman/listinfo/nvo3

---

From: Liuyuanjiao <[email-masked]>
Date: Wed, 3 Jun 2015 09:20:04 +0000

Dear Tom:

	The GUE can resolve the VNI to be shown, but GUE means another module, not vxlan module. So the vxlan packet or vxlan payload should be encrypted into the GUE payload.
    I feel this is a little heavy for the device and network. But I am not sure for it.

Best Regards
	Liu Yuanjiao

-----邮件原件-----
发件人: Tom Herbert [mailto:[email-masked]] 
发送时间: 2015年6月3日 10:59
收件人: Dacheng Zhang
抄送: Michael Shieh; David Mozes; Xuxiaohu; [email-masked]; Liuyuanjiao
主题: Re: [nvo3] VxLAN Security Consideration

On Tue, Jun 2, 2015 at 6:57 PM, Dacheng Zhang <[email-masked]> wrote:
> provider, it’s provided by 3nd company, so the environment is not 
> trusted, we need to encrypt the VxLAN packets or VxLAN payload for our user data.
>
> way to resolve it.
> encrypt the vxlan payloads while transporting the headers in plain 
> text? If so, the condition could be a little more complex.
>
We have a payload encryption option in GUE using DTLS (https://tools.ietf.org/html/draft-hy-gue-4-secure-transport-02). This allows the GUE headers to be sent in plaintext for inspection by middleboxes. One nice feature is that this is done as an extension to the protocol so that we don't need another port like just doing DTLS over UPD payload would require. We do though need to consider security of the header itself in this case though.

Tom

> This message is for the designated and authorized recipient only and 
> may contain privileged, proprietary, confidential or otherwise private 
> information relating to vArmour Networks, Inc. and is the sole 
> property of vArmour Networks, Inc.  Any views or opinions expressed 
> are solely those of the author and do not necessarily represent those of vArmour Networks, Inc.
> If you have received this message in error, or if you are not 
> authorized to receive it, please notify the sender immediately and 
> delete the original message and any attachments from your system 
> immediately. If you are not a designated or authorized recipient, any 
> other use or retention of this message or its contents is prohibited.

---

From: Stephen Suryaputra <[email-masked]>
Date: Wed, 3 Jun 2015 09:20:28 -0400

I think it is also important to keep the UDP header unencrypted since the
source port is the entropy.

Regards,

Stephen.

On Wed, Jun 3, 2015 at 5:15 AM, Liuyuanjiao <[email-masked]> wrote:

>  Dear Zhang Dacheng:
>
>
>
>          Now, in the middle network, we need to monitor the traffic basing
> on the VNI. But if we use IPSec, we could not see VNI anymore.
>
>          So the users could monitor the traffic in the way of VNI, only
> can monitor the vxlan tunnel overall traffic.
>
>
>
>          Another scenario is: we want to adjust the users traffic basing
> on VNI into different underlay paths. But if VNI do not see, we could not
> do it. Because in one vxlan tunnel, we may have server VNIs.
>
>
>
>
>
> Best Regards
>
>          Liu Yuanjiao
>
>
>
>
>
>
>
> *发件人:* Dacheng Zhang [mailto:[email-masked]]
> *发送时间:* 2015年6月3日 9:57
> *收件人:* Michael Shieh; David Mozes
> *抄送:* Xuxiaohu; [email-masked]; Liuyuanjiao
> *主题:* Re: [nvo3] VxLAN Security Consideration
>
>
>
> trusted, we need to encrypt the VxLAN packets or VxLAN payload for our user
> data.Dear
>

---

From: Liuyuanjiao <[email-masked]>
Date: Wed, 3 Jun 2015 13:31:24 +0000

Dear Stephen:

       If we want to keep the UDP to be un-encrypted, then we need to encrypt the vxlan parts(body and header) or vxlan payload(body only).

       Do we have some scenario that we need to show the UDP ports in the middle network?
       Because if we need the UDP ports to be shown for special usage, then we could not use IPSec or Transport layer security method to do do encryption.

Best Regards
       Liu Yuanjiao

发件人: Stephen Suryaputra [mailto:[email-masked]]
发送时间: 2015年6月3日 21:20
收件人: Liuyuanjiao
抄送: Dacheng Zhang; Michael Shieh; David Mozes; Xuxiaohu; [email-masked]
主题: Re: [nvo3] 答复: VxLAN Security Consideration

I think it is also important to keep the UDP header unencrypted since the source port is the entropy.
Regards,
Stephen.

On Wed, Jun 3, 2015 at 5:15 AM, Liuyuanjiao <[email-masked]<mailto:[email-masked]>> wrote:
Dear Zhang Dacheng:

Best Regards
         Liu Yuanjiao

发件人: Dacheng Zhang [mailto:[email-masked]<mailto:[email-masked]>]
发送时间: 2015年6月3日 9:57
收件人: Michael Shieh; David Mozes
抄送: Xuxiaohu; [email-masked]<mailto:[email-masked]>; Liuyuanjiao
主题: Re: [nvo3] VxLAN Security Consideration

Cheers

Dacheng

Best Regards
         Liu Yuanjiao

---

From: Tom Herbert <[email-masked]>
Date: Wed, 3 Jun 2015 07:56:18 -0700

>     I feel this is a little heavy for the device and network. But I am not sure for it.
I don't believe it's possible to add payload encryption to VXLAN
without breaking forward compatibility since the protocol is not
extensible (we already saw this with the attempt to add a next header
protocol number, and this is also is the problem with the security
option proposal). So this would mean a new port number which
essentially implies a new protocol anyway.

Maybe it's possible to do this in VXLAN-GPE with some NSH header?

Tom

---

From: Stephen Suryaputra <[email-masked]>
Date: Wed, 3 Jun 2015 11:27:58 -0400

I see a value of being able to see the UDP ports in the middle of the
network. But, it's even more so that the entropy is still can be used for
link aggregation group and/or ECMP hashing by transit routers.

Stephen.

On Wed, Jun 3, 2015 at 9:31 AM, Liuyuanjiao <[email-masked]> wrote:

>  Dear Stephen:
>
>
>
>        If we want to keep the UDP to be un-encrypted, then we need to
> encrypt the vxlan parts(body and header) or vxlan payload(body only).
>
>
>
>        Because if we need the UDP ports to be shown for special usage,
> then we could not use IPSec or Transport layer security method to do do
> encryption.
>
>
>
>
>
> Best Regards
>
>        Liu Yuanjiao
>
>
>
> *发件人:* Stephen Suryaputra [mailto:[email-masked]]
> *发送时间:* 2015年6月3日 21:20
> *收件人:* Liuyuanjiao
> *抄送:* Dacheng Zhang; Michael Shieh; David Mozes; Xuxiaohu; [email-masked]
> *主题:* Re: [nvo3] 答复: VxLAN Security Consideration
>
>
>
> we need to encrypt the VxLAN packets or VxLAN payload for our user data.Dear
>
>

---

From: Jeff Tantsura <[email-masked]>
Date: Wed, 3 Jun 2015 15:36:40 +0000

Agree!
One of the most significant reasons to deploy VxLAN is hashed source UDP port used to enrich entropy on transit.

Cheers,
Jeff

From: Stephen Suryaputra <[email-masked]<mailto:[email-masked]>>
Reply-To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, June 3, 2015 at 8:27 AM
To: Liuyuanjiao <[email-masked]<mailto:[email-masked]>>
Cc: David Mozes <[email-masked]<mailto:[email-masked]>>, Xuxiaohu <[email-masked]<mailto:[email-masked]>>, Michael Shieh <[email-masked]<mailto:[email-masked]>>, Dacheng Zhang <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [nvo3] 答复: 答复: VxLAN Security Consideration

I see a value of being able to see the UDP ports in the middle of the network. But, it's even more so that the entropy is still can be used for link aggregation group and/or ECMP hashing by transit routers.

Stephen.

On Wed, Jun 3, 2015 at 9:31 AM, Liuyuanjiao <[email-masked]<mailto:[email-masked]>> wrote:
Dear Stephen:

Best Regards
       Liu Yuanjiao

发件人: Stephen Suryaputra [mailto:[email-masked]<mailto:[email-masked]>]
发送时间: 2015年6月3日 21:20
收件人: Liuyuanjiao
抄送: Dacheng Zhang; Michael Shieh; David Mozes; Xuxiaohu; [email-masked]<mailto:[email-masked]>
主题: Re: [nvo3] 答复: VxLAN Security Consideration

Best Regards
         Liu Yuanjiao

Cheers

Dacheng

Best Regards
         Liu Yuanjiao

This message is for the designated and authorized recipient only and may contain privileged, proprietary, confidential or otherwise private information relating to vArmour Networks, Inc. and is the sole property of vArmour Networks, Inc.  Any views or opinions expressed are solely those of the author and do not necessarily represent those of vArmour Networks, Inc. If you have received this message in error, or if you are not authorized to receive it, please notify the sender immediately and delete the original message and any attachments from your system immediately. If you are not a designated or authorized recipient, any other use or retention of this message or its contents is prohibited.
_______________________________________________ nvo3 mailing list [email-masked]<mailto:[email-masked]>https://www.ietf.org/mailman/listinfo/nvo3