Optimizing IKE traffic during IPsec

You are advised to modify several firewall settings in order to optimize the IKE traffic of the negotiation of IPsec tunnels and to secure authentication.

Requirements

For the purposes of the examples, the recommended optimizations and security measures assume that the IPsec policy used on the firewall for mobile users is the IPsec_01 policy (Configuration > VPN > VPN IPsec module).

Optimizing tunnel traffic by restricting IP datagrams

The maximum packet size allowed may vary widely depending on your ISP.

Stormshield advises limiting the size of the IP datagrams of IKE negotiations to 1280 bytes:

  1. Log in to the web administration interface of the firewall.
  2. Go to Configuration > System > CLI.
  3. Enable IKE fragmentation by typing:
    CONFIG IPSEC PEER UPDATE name=IPsec_Mobile_Profile_Name ike_frag=1
    where IPsec_Mobile_Profile_Name represents the name given to the IPsec peer profile. In this example: mobile_IKEv2_EAPTLS.
  4. Set the maximum size of IKE datagrams to 1280 bytes using the following command:
    CONFIG IPSEC UPDATE slot=xy FragmentSize=1280
    where xy represents the number of the mobile IPsec policy.
    In the example, this is the IPsec 01 policy: xy will therefore be equal to 01.
  5. Apply these changes by typing:
    CONFIG IPSEC ACTIVATE

Reloading the IPsec policy to apply changes made earlier

  1. Go to Configuration > System > CLI.
  2. Reload the IPsec policy by typing:
    CONFIG IPSEC RELOAD
    Caution: This command resets all existing mobile and site-to-site tunnels.

Optimizing tunnel traffic: restricting MSS

Traffic transported by IPsec is encapsulated in ESP, which adds a header of several dozen bytes to the packets transmitted inside the tunnel.

It is therefore necessary to activate automatic limitation of the size of the segments (MSS: Maximum Segment Size) exchanged between the client and the firewall.

With this option, packet fragmentation can be avoided or kept to a minimum. For packets exchanged between the client and the firewall, MSS imposes a packet size below the MTU (Maximum Transmission Unit) on the various network devices that intercept these packets.

Modifying a TCP-UDP inspection profile

In the Application protection > Protocols > IP protocols > TCP-UDP module:

  1. Select the TCP-UDP inspection profile in which you wish to apply this change. tcpudp_03 in this example. This inspection profile is automatically selected from the global profile with the same index (03 in this example), which is applied in the rule for Allow IPsec VPN access in the filtering policy.
  2. Select the Impose MSS limit checkbox.
    Enter the value 1300 (bytes) (recommended by Stormshield).
  3. Confirm the change by clicking on Apply.
  4. Confirm by clicking on Save.