Practical Overview of the IPsec Protocol

Of course, having an IP packet inside an IP packet can cause some other side-effects. Most importantly, the size of the inner packet may need to be reduced a little to prevent fragmentation. If the packet you are trying to encapsulate is at the Maximum Transmission Unit (MTU) size, then you need to break it in two, since the IPsec header takes up some additional space. You need to encapsulate that one packet in two packets, and the receiver needs to perform the reverse procedure. MTU issues become important when using NAT-T, often because networks using NATs involve tunneling in some form or other, and not all the MTU values of those networks and tunnels will be the same.

NAT-T is a nifty solution but remember to treat it as better than nothing. If you can avoid it, it is in your interest to do so.

NAT-T's Hard Limit

There is one important case when NAT-T cannot possibly work: when the remote network you are trying to connect to is using the same private IP-space as your own local NAT network. An IP address cannot be at both ends of the tunnel. To prevent these IP address clashes, it is wise to choose small networks for both subnets to reach through VPN, as well as choosing small networks behind the NAT router.

For example, choosing 10.0.0.0/8 as an office network is very bad practice, because it depletes the entire 10.*.*.* address space. If an IPsec client is trying to connect from behind a NAT, which is very likely to be either in the 10.0.0.0/8 address space or in the 192.168.0.0/16 address space, there is a large chance of conflicting IP addresses.

Therefore, when configuring your routers, you should avoid the obvious choices and default ranges used by many WiFi products and ADSL routers. These common ranges include 10.0.0.0/24, 10.0.1.0/24, 192.168.0.0/24, and 192.168.1.0/24. Instead, pick something semi-random, such as 10.54.10.0/24.

Summary

This chapter has provided a brief overview of the principles behind the IPsec protocol. You can find a list of applicable IPsec RFCs in the appendix of this book which can give you a deeper insight into the technological and cryptographic details surrounding IPsec. But if you understood the gist of this chapter, then you know enough to actually deploy IPsec. In the next chapter, we will discuss installing Openswan.

44