IPsec configuration with VPP

Big picture

Enable IPsec encryption for the traffic flowing between the nodes.

Value

IPsec is the fastest option to encrypt the traffic between nodes. It enables blanket application traffic encryption with very little performance impact.

Before you begin…

To enable IPsec encryption, you will need a Kubernetes cluster with:

How to

Create the IKEv2 PSK

Create a Kubernetes secret that contains the PSK used for the IKEv2 exchange between the nodes. You can use the following command to create a random PSK. It will generate a unique random key. You may also replace the part after psk= with a key of your choice.

  1. kubectl -n calico-vpp-dataplane create secret generic calicovpp-ipsec-secret \
  2.    --from-literal=psk="$(dd if=/dev/urandom bs=1 count=36 2>/dev/null | base64)"

Configure the VPP dataplane

To enable IPsec, you first need to enable the ipsec feature in the calico-vpp-config ConfigMap.

You can do so with the following kubectl command:

  1. kubectl -n calico-vpp-dataplane patch configmap calico-vpp-config --patch "data:
  2.   CALICOVPP_FEATURE_GATES: |-
  3.     {
  4.       \"ipsecEnabled\": true
  5.     }
  6. "

You then need to configure the calico-vpp agent to pass it the key we previously created.

  1. kubectl -n calico-vpp-dataplane patch daemonset calico-vpp-node --patch "spec:
  2.   template:
  3.     spec:
  4.       containers:
  5.         - name: agent
  6.           env:
  7.             - name: CALICOVPP_IPSEC_IKEV2_PSK
  8.               valueFrom:
  9.                 secretKeyRef:
  10.                   name: calicovpp-ipsec-secret
  11.                   key: psk
  12. "

Once IPsec is enabled, all the traffic that uses IP-in-IP encapsulation in the cluster will be automatically encrypted.

Next steps

Verify encryption

To verify that the traffic is encrypted, open a VPP debug CLI session to check the configuration with calivppctl

  1. calivppctl vppctl my-k8s-node-1
  2. # Alternatively this translates to the following CLI
  3. kubectl -n calico-vpp-dataplane exec calico-vpp-node-XXXX  -c vpp -- vppctl

Then at the vpp# prompt, you can run the following commands:

  • show ikev2 profile will list the configured IKEv2 profiles, there should be one per other node in your cluster

As an example on a three-node cluster

  1. vpp# show ikev2 profile
  2. profile pr_172_19_0_5_to_172_19_0_3
  3.   auth-method shared-key-mic auth data somekeysomekeysomekeysomekey
  4.   local id-type ip4-addr data 172.19.0.5
  5.   remote id-type ip4-addr data 172.19.0.3
  6.   protected tunnel ipip0
  7.   responder host-eth0 172.19.0.3
  8.   ike-crypto-alg aes-cbc 256 ike-integ-alg sha1-96 ike-dh modp-2048
  9.   esp-crypto-alg aes-gcm-16 256 esp-integ-alg none
  10.   lifetime 0 jitter 0 handover 0 maxdata 0
  11. profile pr_172_19_0_5_to_172_19_0_6
  12.   auth-method shared-key-mic auth data somekeysomekeysomekeysomekey
  13.   local id-type ip4-addr data 172.19.0.5
  14.   remote id-type ip4-addr data 172.19.0.6
  15.   protected tunnel ipip1
  16.   lifetime 0 jitter 0 handover 0 maxdata 0
  17. profile pr_172_19_0_5_to_172_19_0_4
  18.   auth-method shared-key-mic auth data somekeysomekeysomekeysomekey
  19.   local id-type ip4-addr data 172.19.0.5
  20.   remote id-type ip4-addr data 172.19.0.4
  21.   protected tunnel ipip2
  22.   responder host-eth0 172.19.0.4
  23.   ike-crypto-alg aes-cbc 256 ike-integ-alg sha1-96 ike-dh modp-2048
  24.   esp-crypto-alg aes-gcm-16 256 esp-integ-alg none
  25.   lifetime 0 jitter 0 handover 0 maxdata 0
  • show ipip tunnel will list the interfaces configured in VPP.
  1. vpp# show ipip tunnel
  2. [0] instance 0 src 172.19.0.5 dst 172.19.0.3 table-ID 0 sw-if-idx 9 flags [none] dscp CS0
  3. [1] instance 1 src 172.19.0.5 dst 172.19.0.6 table-ID 0 sw-if-idx 10 flags [none] dscp CS0
  4. [2] instance 2 src 172.19.0.5 dst 172.19.0.4 table-ID 0 sw-if-idx 11 flags [none] dscp CS0
  • show interface will show all the interfaces present in VPP with their corresponding states. This includes the ipip interfaces (which correspond to the IPsec tunnels) which should be up.
  1. vpp# show interface
  2. ...
  3. ipip0                             9      up          9000/0/0/0
  4. ipip1                             10     up          9000/0/0/0     rx packets                  1496
  5.                                                                     rx bytes                  387772
  6.                                                                     tx packets                  1687
  7.                                                                     tx bytes                  662236
  8.                                                                     ip4                         1496
  9. ipip2                             11     up          9000/0/0/0
  • show ipsec protect shows the SAs being configured on each ipip tunnel. There should be two SAs by ipip tunnel.
  1. vpp# show ipsec protect
  2. ipip0 flags:[none]
  3.  output-sa:
  4.   [0] sa 2147483648 (0x80000000) spi 2056367583 (0x7a91addf) protocol:esp flags:[esn anti-replay aead ctr ]
  5.  input-sa:
  6.   [1] sa 3221225472 (0xc0000000) spi 1916941699 (0x72423583) protocol:esp flags:[esn anti-replay inbound aead ctr ]
  7. ipip2 flags:[none]
  8.  output-sa:
  9.   [2] sa 2147487744 (0x80001000) spi 1305186871 (0x4dcb9237) protocol:esp flags:[esn anti-replay aead ctr ]
  10.  input-sa:
  11.   [3] sa 3221229568 (0xc0001000) spi 1107274174 (0x41ffa9be) protocol:esp flags:[esn anti-replay inbound aead ctr ]
  12. ipip1 flags:[none]
  13.  output-sa:
  14.   [4] sa 2147491840 (0x80002000) spi 3581762498 (0xd57d5bc2) protocol:esp flags:[esn anti-replay aead ctr ]
  15.  input-sa:
  16.   [5] sa 3221233664 (0xc0002000) spi 3002607689 (0xb2f82849) protocol:esp flags:[esn anti-replay inbound aead ctr ]
  • You can see the full list of Security Associations (SAs) with show ipsec sa.
  1. vpp# show ipsec sa
  2. [0] sa 2147483648 (0x80000000) spi 2056367583 (0x7a91addf) protocol:esp flags:[esn anti-replay aead ctr ]
  3. [1] sa 3221225472 (0xc0000000) spi 1916941699 (0x72423583) protocol:esp flags:[esn anti-replay inbound aead ctr ]
  4. [2] sa 2147487744 (0x80001000) spi 1305186871 (0x4dcb9237) protocol:esp flags:[esn anti-replay aead ctr ]
  5. [3] sa 3221229568 (0xc0001000) spi 1107274174 (0x41ffa9be) protocol:esp flags:[esn anti-replay inbound aead ctr ]
  6. [4] sa 2147491840 (0x80002000) spi 3581762498 (0xd57d5bc2) protocol:esp flags:[esn anti-replay aead ctr ]
  7. [5] sa 3221233664 (0xc0002000) spi 3002607689 (0xb2f82849) protocol:esp flags:[esn anti-replay inbound aead ctr ]

You can also capture the traffic flowing between the nodes to verify that it is encrypted.