Secure DataPlane Bringup

Secure DataPlane Bringup

Once all the Viptela device are available and are part of Overlay network , DTLS tunnels are created between all the Viptela Devices and over which Control plane information is shared. For data traffic separate One to one IPsec tunnel is formed between each vEdge device and data are sent via proper encryption method.

A overview of the DTLS and IPsec Tunnel are shown in below figure.

Centralized Encryption Key Distribution

In order to make the secure data plane, following Key distribution is done between vEdge router and vSmart Controller.

• Each vEdge advertises its own AES256 IPSec encryption key in control plane updates
• IPSec encryption keys are distributed by the vSmart Controllers
• IPSec encryption keys are frequently rotated (default 2h)

Traffic Encryption Data Privacy

Each site vEdge Router has another Site Remote IPsec Key listed, and as soon as IPsec Tunnel is created, data is encrypted by remote IPSec Key based on site and is sent over tunnel.

Following keys are used for encryption:

• Strong IPSec AES256 ESPv3 encryption
• Symmetric keys used asymmetrically
• HMAC SHA-1 hashing

Over tunnel, it send Bi-directionally echoes liveliness messages. Detects loss, latency, jitter and max-MTU for the IPSec tunnels between all vEdge routers. Helps make forwarding decisions based on actual underlying transport performance.

Tunnel Liveliness Detection

BFD packets are bi-directionally echoed between two vEdge’s