Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Quantum Safe IPsec VPN

SUMMARY Learn how to use and configure the out-of-band key retrieval mechanisms in the IKED process to negotiate with quantum secured IKE and IPsec SAs.

Quantum Safe IPsec VPN Overview

Quantum Security

The IPsec communication channel relies on the Internet Key Exchange (IKE) protocol. The IKE maintains security parameters to protect the data traffic. The security parameters include encryption and authentication algorithms, and associated keys.

The security protocols rely on asymmetric cryptographic algorithms such as Diffie Hellman (DH) or Elliptic Curve Diffie Hellman (ECDH) to establish keys are vulnerable to attacks.

To avoid security attacks, the RFC8784 introduces a method out-of-band method. The out-of-band method adds a secret key at the initiator and the responder. The secret key is Post-quantum Pre-shared Key (PPK).

  • You can use the PPK in addition to the authentication method in IKEv2.

  • PPK provides quantum resistance to any child SAs in initial negotiated IPsec SAs and any subsequent reeked IPsec SAs.

  • With PPK and peer authentication key, initiator and responder can detect key mismatch.

Junos Key Manager Overview

You can use Junos Key Manager (JKM) to configure the static keys or dynamics keys to protect the data plane and control plane.

The JKM process acts as a key store and a proxy between the client or crypto application. The client or crypto application requires a key to establish an encrypted and authenticated quantum safe session with peer or application. The quantum safe uses the out-of-band key retrieval mechanism that lets two peers have the key. Different out-of-band mechanisms will have different protocols or methods to communicate. The JKM provides a common uniform interface for client or crypto applications to communicate.

Key Retrieval Mechanism

Two out-of-band key retrieval mechanisms in the IKED process to negotiate with quantum secured IKE and IPsec SAs.

  • Static Key—With static key profiles, you can configure a static key ID and a corresponding key. The same static key ID and key gets generated every time a request to JKM over a static key profile.

  • Quantum Key Manager—With quantum key manager key profiles, you can access the Quantum Key Distribution (QKD) devices and Quantum Network. The Quantum Network generates and exchange quantum keys between peers. Generates a different key ID and key every time on request to JKM over a quantum key manager key profile.

Use Key Profile for Quantum Safe IPsec VPN

With static key profiles, you can configure a static key ID and a corresponding key. To establish the quantum safe IPsec SAs, use the static key profile as Post-Quantum Pre-Shared Key (PPK) profile in the IPsec-VPN configuration. Uses the same key and key ID to re-authenticate existing IKE SA.

With quantum key manager key profile profiles, to access the Quantum Networks you need access to the QKD devices. The Quantum Network generates and exchanges quantum keys between peers. You can configure all the necessary parameters such as local SAE ID, URL to the QKD device, and so on. To establish IPsec SAs, use the quantum key manager key profile as Post-Quantum Pre-Shared Key (PPK) profile in the IPsec VPN configuration. Uses a different key and key ID to re-authenticate existing IKE SA.

Quantum Key Distribution

Quantum key distribution (QKD) is a secure key distribution method that uses quantum. Networks use quantum channels for generating the same key at both ends and monitor the quantum channel between the peers. These keys are dynamic, protects the data plane, and control plane.

Key Management Entity (KME) is the term we use to refer to the QKD devices on the management or control layer. QKD devices connect to each other through their quantum or QKD network. The KMEs connects over the public network through the secure channels for exchanging any control messages. The applications, Secure Application Entity (SAEs), and devices interact with KMEs through the secure channels as per ETSI specification. HTTPS combines with mutual TLS authentication and enables secure operations over the QKD network.

Figure 1: Two Devices Interacting with Their Corresponding QKD Devices to Establish a Quantum Secured Session Two Devices Interacting with Their Corresponding QKD Devices to Establish a Quantum Secured Session

In the Figure 1, describes how the two devices interacting with their corresponding QKD devices to establish a quantum secured session

  • SAE A role is primary. SAE A acts as the initiator to establish a quantum secured session with SAE B.

  • The SAE B role is secondary. SAE B acts as the responder.

  • The SAE A request the KME A through the Get key API to generate and share a new quantum key with SAE B with target SAE ID.

  • The KME A performs the operation and responds to SAE A with the generated key ID and key material.

  • KME B receives the key material and the generated ID key over the QKD network.

  • The SAE A initiates secured session with SAE B directly using the same key and key ID.

  • An exchange of messages establishes a secure session with SAE B.

  • SAE A sends the key ID in plaintext or encrypted for the corresponding quantum key that is used to secure the session with SAE B.

  • Once SAE B receives the key ID, the SAE B contacts KME B through the Get key with IDs API to get the corresponding quantum-key for the given key ID and target SAE ID or SAE A.

  • After SAE B gets the key, a fully quantum secured session establishes between SAE A and SAE B.

Example: Configure Quantum-Secured IPsec AutoVPN Topology Using Quantum Key Manager Key Profile

SUMMARY Learn how to configure IPsec AutoVPN topology using quantum key manager key profile.

Use this example to configure quantum-secured IPsec AutoVPN using quantum key manager key profile. The quantum key manager key profile includes parameters that are required to communicate with a Key Management Entity (KME) or Quantum Key Distribution (QKD) device. These parameters are as per ETSI GS QKD 014 specification.

In this example, we use the following devices:

  • Hub as an IPsec VPN aggregator.

  • Spoke 1 and Spoke 2 as remote sites.

The Hub, Spoke 1, and Spoke 2 use quantum key manager key profiles to communicate with KME Hub, KME Spoke 1, and KME Spoke 2 to fetch the QKD keys and establish then IPsec VPN tunnels.

Tip:
Table 1: Estimated Timers

Reading Time

Less than an hour.

Configuration Time

Less than an hour.

Example Prerequisites

Table 2: Requirements

Hardware requirements

Juniper Networks® SRX1500 Firewall or higher-numbered device models or Juniper Networks® vSRX Virtual Firewall (vSRX3.0).

Software requirements

Junos OS Release 22.4R1 or later with JUNOS ike and JUNOS Key Manager packages.

Before You Begin

Table 3: Let's Get Started

Benefits

With quantum-secured IPsec AutoVPN , you can:

  • Establish quantum-secured IKE or IPsec security associations (SAs) between a Hub and one or more Spokes with the help of a QKD device.

  • Extend the already standardized RFC 8784 procedure.

Know more

IPsec VPN

AutoVPN on Hub-and-Spoke Devices

Learn more

RFC 8784 - Mixing Preshared Keys in the Internet Key Exchange Protocol Version 2 (IKEv2) for Post-quantum Security

ETSI QKD Rest API

Functional Overview

This section provides summary of the configuration components in this example.

Table 4: Detailed Configuration and Verification Procedures

Technologies used

To establish the quantum-safe IPsec tunnel, you must configure the following:

  • Key profile—Configure the following quantum key manager key profiles on the Hub.

    • HUB_KM_PROFILE_1

    • SPOKE_1_KM_PROFILE_1

    • SPOKE_2_KM_PROFILE_1

    Configure SPOKE-1 and SPOKE-2 for applications and services to retrieve QKD keys from external server.

  • IKE proposal—Configure the following IKE proposals on the Hub.

    • HUB_IKE_PROP

    • SPOKE_1_IKE_PROP

    • SPOKE_2_IKE_PROP

    Configure SPOKE-1 and SPOKE-2 with the required algorithms to establish an IKE SAs.

  • IKE policy—Configure the following IKE policies on the Hub.

    • HUB_IKE_POL

    • SPOKE_1_IKE_POL

    • SPOKE_3_IKE_POL

    Configure SPOKE-1 and SPOKE-2 to set the runtime negotiation and authentication attributes.

  • IKE gateway—Configure the following IKE gateways on the Hub.

    • HUB_IKE_GW

    • SPOKE_1_IKE_GW

    • SPOKE_2_IKE_GW

    Configure SPOKE-1 and SPOKE-2 to set the endpoints between the IPsec tunnels.

    A ppk-profile indicates which key-profile to use to establish quantum-safe IKE or IPsec SA.

  • IPsec proposal—Configure the following IPsec proposals on the Hub.

    • HUB_IPSEC_PROP

    • SPOKE_1_IPSEC_PROP

    • SPOKE_2_IPSEC_PROP

    Configure SPOKE-1 and SPOKE-2 with the required algorithms to establish an IPsec SA.

  • IPsec policy—Configure the following IPsec policies on the Hub.

    • HUB_IPSEC_POL

    • SPOKE_1_IPSEC_POL

    • SPOKE_2_IPSEC_POL

    Configure SPOKE-1 and SPOKE-2 to set the runtime IPsec negotiation attributes.

  • IPsec VPN—Configure the following IPsec VPNs on the Hub.

    • HUB_IPSEC_VPN

    • SPOKE_1_IPSEC_VPN

    • SPOKE_2_IPSEC_VPN

    Configure SPOKE-1 and SPOKE-2 to set the range of subnets that need to be secured.

  • Security zone—Configure three different security zones to segregate the traffic.

    • trust

    • untrust

    • vpn

  • Security policy—Configure the security policies trust to vpn and vpn to trust to select the type of data traffic that is secured through the IPsec SAs.

Primary verification tasks

Verify the IKE and IPsec SAs.

Verify the established IKE and IPsec SAs are Quantum safe.

Verify IPsec encryption and decryption statistics.

Verify key profile statistics.

Send data traffic from the host devices.
Table 5: Spoke 1: Interface, Security Zone, Security Policy, Key Profile, PKI, IKE and IPsec Configuration Parameters
Feature Name Configuration Parameters
Interfaces ge-0/0/2.0 172.18.10.1/24
Interfaces ge-0/0/1.0 192.168.80.1/24
Interfaces st0.1 (tunnel interface) family inet
Security zones trust

The ge-0/0/1.0 interface is bound to this zone.
Security zones untrust

The ge-0/0/2.0 interface is bound to this zone.
Security zones vpn

The st0.1 interface is bound to this zone.
Security policy from-zone trust to-zone vpn

Match criteria:

  • Source-address: any

  • Destination-address: any

  • Application: any

Action: permit
Security policy from-zone vpn to-zone trust

Match criteria:

  • Source-address: any

  • Destination-address: any

  • Application: any

Action: permit
CA profile Root-CA

CA-identity: Root-CA

URL: https://ca-server.juniper.net/certsrv/mscep/mscep.dll

Revocation-check: disable
Key profile SPOKE_1_KM_PROFILE_1

Key profile type: Quantum key manager

URL: https://www.kme_spoke_1-qkd-server.net

Local-sae-id: SAE_SPOKE_1

Local-certificate-id: SAE_SPOKE_1_CERT

Trusted-cas: Root-CA
IKE Proposal SPOKE_1_IKE_PROP

Authentication method: rsa-signatures

DH group: group14

Authentication algorithm: sha-256

Encryption algorithm: aes-256-cbc

Lifetime: 3600 seconds
IKE Policy SPOKE_1_IKE_POL

Proposal reference: SPOKE_1_IKE_PROP

Certificate reference: local-certificate SPOKE_1_CRT
IKE Gateway SPOKE_1_IKE_GW

IKE policy reference: SPOKE_1_IKE_POL

External interface: ge-0/0/2.0

Remote gateway address: 172.18.10.1

Local gateway address: 172.18.10.2

Version: v2-only

ppk-profile: SPOKE_1_KM_PROFILE_1

Local-identity: distinguished-name

Remote-identity: distinguished-name
IPsec Proposal SPOKE_1_IPSEC_PROP

Protocol:esp

Authentication-algorithm: hmac-sha-256-128

Encryption-algorithm: aes-256-cbc
IPsec Policy IPSEC-POL Proposal reference: SPOKE_1_IPSEC_PROP
IPsec VPN VPN-to-HOST-2

IKE gateway reference: SPOKE_1_IKE_GW

IPsec policy reference: SPOKE_1_IPSEC_POL

Bind to interface: st0.1

Traffic-selector: ts1 and local-ip 192.168.80.0/24 remote-ip 192.168.90.0/24
Table 6: Spoke 2: Interface, Security Zone, Security Policy, Key Profile, PKI, IKE and IPsec Configuration Parameters
Feature Name Configuration Parameters
Interfaces ge-0/0/2.0 172.18.10.3/24
Interfaces ge-0/0/1.0 192.168.70.1/24
Interfaces st0.1 (tunnel interface) family inet
Security zones trust

The ge-0/0/1.0 interface is bound to this zone.
Security zones untrust

The ge-0/0/2.0 interface is bound to this zone.
Security zones vpn

The st0.2 interface is bound to this zone.
Security policy from-zone trust to-zone vpn

Match criteria:

  • Source-address: any

  • Destination-address: any

  • Application: any

Action: permit
Security policy from-zone vpn to-zone trust

Match criteria:

  • Source-address: any

  • Destination-address: any

  • Application: any

Action: permit
CA profile Root-CA

CA-identity: Root-CA

URL: https://ca-server.juniper.net/certsrv/mscep/mscep.dll

Revocation-check: disable
Key profile SPOKE_2_KM_PROFILE_1

Key profile type: Quantum key manager

URL: https://www.kme_spoke_1-qkd-server.net

Local-sae-id: SAE_SPOKE_2

Local-certificate-id: SAE_SPOKE_2_CERT

Trusted-cas: Root-CA
IKE Proposal SPOKE_2_IKE_PROP

Authentication method: rsa-signatures

DH group: group14

Authentication algorithm: sha-256

Encryption algorithm: aes-256-cbc

Lifetime: 3600 seconds
IKE Policy SPOKE_2_IKE_POL

Proposal reference: SPOKE_2_IKE_PROP

Certificate reference: local-certificate SPOKE_2_CRT
IKE Gateway SPOKE_2_IKE_GW

IKE policy reference: SPOKE_2_IKE_POL

External interface: ge-0/0/2.0

Remote gateway address: 172.18.10.1

Local gateway address: 172.18.10.3

Version: v2-only

ppk-profile: SPOKE_2_KM_PROFILE_1

Local-identity: distinguished-name

Remote-identity: distinguished-name
IPsec Proposal SPOKE_2_IPSEC_PROP

Protocol:esp

Authentication-algorithm: hmac-sha-256-128

Encryption-algorithm: aes-256-cbc
IPsec Policy SPOKE_2_IPSEC_POL Proposal reference: SPOKE_2_IPSEC_PROP
IPsec VPN SPOKE_2_IPSEC_VPN

IKE gateway reference: SPOKE_2_IKE_GW

IPsec policy reference: SPOKE_2_IPSEC_POL

Bind to interface: st0.2

Traffic-selector: ts1 and local-ip 192.168.70.0/24 remote-ip 192.168.90.0/24
Table 7: Hub: Interface, Security Zone, Security Policy, Key Profile, PKI, IKE and IPsec Configuration Parameters
Feature Name Configuration Parameters
Interfaces ge-0/0/2.0 172.18.10.1/24
Interfaces ge-0/0/1.0 192.168.90.1/24
Interfaces st0.1 (tunnel interface) family inet
Security zones trust

The ge-0/0/1.0 interface is bound to this zone.
Security zones untrust

The ge-0/0/2.0 interface is bound to this zone.
Security zones vpn

The st0.1 interface is bound to this zone.
Security policy from-zone trust to-zone vpn

Match criteria:

  • Source-address: any

  • Destination-address: any

  • Application: any

Action: permit
Security policy From-zone vpn to-zone trust

Match criteria:

  • Source-address: any

  • Destination-address: any

  • Application: any

Action: permit
CA profile Root-CA

CA-identity: Root-CA

URL: https://ca-server.juniper.net/certsrv/mscep/mscep.dll

Revocation-check: disable
Key profile HUB_KM_PROFILE_1

Key profile type: Quantum key manager

URL: https://www.kme_spoke_1-qkd-server.net

Local-sae-id: SAE_HUB

Local-certificate-id: SAE_HUB_CERT

Trusted-cas: Root-CA
IKE Proposal HUB_IKE_PROP

Authentication method: rsa-signatures

DH group: group14

Authentication algorithm: sha-256

Encryption algorithm: aes-256-cbc

Lifetime: 3600 seconds
IKE Policy HUB_IKE_POL

Proposal reference: HUB_IKE_PROP

Certificate reference: local-certificate HUB_CRT
IKE Gateway HUB_IKE_GW

IKE policy reference: HUB_IKE_POL

External interface: ge-0/0/2.0

Local gateway address: 172.18.10.1

Version: v2-only

ppk-profile: HUB_KM_PROFILE_1

Local-identity: distinguished-name

Dynamic gateway:

  • Remote-identity: distinguished-name wildcard "C=us DC=juniper"

  • ike-user-type: group-ike-id
IPsec Proposal HUB_IPSEC__PROP

Protocol:esp

Authentication-algorithm: hmac-sha-256-128

Encryption-algorithm: aes-256-cbc
IPsec Policy HUB_IPSEC_POL Proposal reference: HUB_IPSEC_PROP
IPsec VPN HUB_IPSEC_VPN

IKE gateway reference: HUB_IKE_GW

IPsec policy reference: HUB_IPSEC_POL

Bind to interface: st0.1

Traffic-selector: ts1 and local-ip 192.168.90.0/24 remote-ip 0.0.0.0/0
Table 8: Security Policy Configuration Parameters
Purpose Name Configuration Parameters
The security policy permits traffic from the trust zone to the VPN zone. VPN-OUT Match criteria:

  • source-address HOST-1-Net

  • destination-address HOST-2-Net

  • application any

Action: permit
The security policy permits traffic from the VPN zone to the trust zone. VPN-IN Match criteria:

  • source-address HOST-2-Net

  • destination-address HOST-1-Net

  • application any

Action: permit

Topology Overview

In this example, Spoke 1 and Spoke 2 initiate the negotiation of Quantum-safe IPsec tunnels with the Hub using QKD keys from KME Spoke 1 and KME Spoke 2. The Hub responds to the requests by verifying Spoke 1 and Spoke 2 identities and keys from KME Hub to establish Quantum-safe IPsec VPN tunnels. After IPsec tunnels are established, the data traffic between Host 1 and Host 3, and that between Host 2 and Host 3 is Quantum secured.

Table 9: Devices, Role, and Functionalities Used in This Configuration

Hostname

Role

Function
HUB SRX Series Firewall capable of establishing IPsec tunnels Responds to IKE or IPsec SA negotiation and establishes Quantum-safe IPsec tunnels using QKD key from KME-HUB QKD device on SPOKE-1 and SPOKE-2.
SPOKE-1 SRX Series Firewall capable of establishing IPsec tunnels Initiates IKE or IPsec SA negotiation and establishes Quantum-safe IPsec tunnels with hub using QKD key from KME-SPOKE-1 QKD device
SPOKE-2 SRX Series Firewall capable of establishing IPsec tunnels Initiates IKE or IPsec SA negotiation and establishes Quantum-safe IPsec tunnels with hub using QKD key from KME-SPOKE-2 QKD device
HOST-1 Host inside the trusted zone or LAN side of SPOKE 1 Initiates client-side traffic towards HOST-3
HOST-2 Host inside the trusted zone or LAN side of SPOKE 2 Initiates client-side traffic towards HOST-3
HOST- 3 Host inside the trusted zone or LAN side of hub Responds to client-side traffic from HOST-1 and HOST-2
KME-HUB Third-party QKD device Provides QKD keys in response to key requests from HUB
KME-SPOKE-1 Third-party QKD device Provides QKD keys in response to key requests from SPOKE-1
KME-SPOKE-2 Third-party QKD device Provides QKD keys in response to key requests from SPOKE-2

Topology Illustration

Figure 2: Quantum Key Manager with AutoVPN Quantum Key Manager with AutoVPN

Step-By-Step Configuration on Device-Under-Test (DUT)

Note:

For complete sample configurations on the DUT, see:

Configure Hub

  1. Configure interfaces.

  2. Configure security zones.

  3. Configure security policies.

  4. Configure the CA profile and the CA certificate.

  5. Bind the CA certificate to the CA profile.

  6. Configure local certificates.

  7. Configure the quantum key manager key profile.

  8. Configure the IKE proposal.

  9. Configure the IKE policy.

  10. Configure the IKE gateway.

  11. Bind the quantum key manager key profile as the IKE gateway ppk-profile.

  12. Configure the IPsec proposal.

  13. Configure the IPsec policy.

  14. Configure the IPsec VPN.

If you are done configuring the device, enter commit from configuration mode.

Configure Spoke 1

  1. Configure interfaces.

  2. Configure security zones.

  3. Configure security policies.

  4. Configure the CA profile and the CA certificate.

  5. Bind the CA certificate to the CA profile.

  6. Configure local certificates.

  7. Configure the quantum key manager key profile.

  8. Configure the IKE proposal.

  9. Configure the IKE policy.

  10. Configure the IKE gateway.

  11. Bind the quantum key manager key profile as the IKE gateway ppk-profile.

  12. Configure the IPsec proposal.

  13. Configure the IPsec policy.

  14. Configure the IPsec VPN.

If you are done configuring the device, enter commit from configuration mode.

Configure Spoke 2

  1. Configure interfaces.

  2. Configure security zones.

  3. Configure security policies.

  4. Configure the CA profile and the CA certificate.

  5. Bind the CA certificate to the CA profile.

  6. Configure the local certificates.

  7. Configure the quantum key manager key profile.

  8. Configure the IKE proposal.

  9. Configure the IKE policy.

  10. Configure the IKE gateway.

  11. Bind the quantum key manager key profile as the IKE gateway ppk-profile.

  12. Configure the IPsec proposal.

  13. Configure the IPsec policy.

  14. Configure the IPsec VPN.

If you are done configuring the device, enter commit from configuration mode.

Verification

This section provides a list of show commands that you can use to verify the feature in this example.

Table 10: Verification Tasks
Command Verification Task
ping 192.168.90.20 source 192.168.80.20 count 4 Ping from Host-1 to Host 3.
ping 192.168.90.20 source 192.168.70.20 count 4 Ping from Host 2 to Host 3.
show security ike security-associations detail Verify the IKE SAs.
show security ipsec security-associations detail Verify the IPsec SAs.
show security ipsec statistics Verify IPsec encryption and decryption statistics.
show security key-manager profiles detail Verify key profile statistics.

Ping from Host 1 to Host 3

Purpose

Verify the connectivity from Host 1 to Host 3.

Action

From operational mode, enter the ping 192.168.90.20 source 192.168.80.20 count 5 to view the connectivity from Host 1 to Host 3.

Meaning

The sample output confirms the connectivity from Host 1 to Host 3.

Ping from Host 2 to Host 3

Purpose

Verify the connectivity from Host 2 to Host 3.

Action

From operational mode, enter the ping 192.168.90.20 source 192.168.80.20 count 5 command to view the connectivity from Host 2 to Host 3.

Meaning

The sample output confirms the connectivity from Host 2 to Host 3.

Verify IKE SAs

Purpose

Verify the IKE SAs.

Action

From operational mode, enter the show security ike security-associations detail command to view the IKE SAs.

Meaning

The sample output confirms the IKE SAs.

Verify IPsec SAs

Purpose

Verify the IPsec SAs.

Action

From operational mode, enter the show security ipsec security-associations detail command to view the IPsec SAs.

Meaning

The sample output confirms the IPsec SAs.

Verify IPsec Statistics

Purpose

Verify the IPsec statistics.

Action

From operational mode, enter the show security ipsec statistics command to view the IPsec statistics.

Meaning

The sample output confirms the IPsec statistics.

Verify Key Manager Profile

Purpose

Verify the key manager profile.

Action

From operational mode, enter the show security key-manager profiles detail command to view the quantum key manager profile.

Meaning

The sample output confirms the quantum key manager profile.

Appendix 1: Set Commands on all Devices

Set command output on all devices.

Set Commands on Hub
Set Commands on Spoke 1
Set Commands on Spoke 2