I can't even

[scottalanmiller]

Network drive loaded onto a Cisco router. Um... https://community.spiceworks.com/topic/2084210-need-help-with-network-storage-encryption

[scottalanmiller]

This guy doesn't seem to know what a NAS is, a router, BitLocker or encryption.

[Reid Cooper]

@scottalanmiller said in I can't even:

Network drive loaded onto a Cisco router. Um... https://community.spiceworks.com/topic/2084210-need-help-with-network-storage-encryption

So he encrypted a drive and is surprised that it is encrypted?

[DustinB3403]

@jaredbusch said in I can't even:

@DustinB3403 here is my home ERL.

The part that is going over with Unencrypted PAP is testuser/Testing!123.
But it is going over the Existing IPSEC tunnel that was set up with the PSK.

jbusch@jared:~$ show configuration commands vpn | grep l2tp
set vpn l2tp remote-access authentication local-users username testuser password 'Testing!123'
set vpn l2tp remote-access authentication mode local
set vpn l2tp remote-access client-ip-pool start 10.254.203.2
set vpn l2tp remote-access client-ip-pool stop 10.254.203.10
set vpn l2tp remote-access dhcp-interface eth0
set vpn l2tp remote-access dns-servers server-1 8.8.8.8
set vpn l2tp remote-access dns-servers server-2 8.8.4.4
set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret NOTGONNATELLYOU
set vpn l2tp remote-access ipsec-settings ike-lifetime 3600
set vpn l2tp remote-access mtu 1492

So without the "Require encryption" the preshared key is sent in plain text?

[JaredBusch]

@dustinb3403 said in I can't even:

@jaredbusch said in I can't even:

@DustinB3403 here is my home ERL.

The part that is going over with Unencrypted PAP is testuser/Testing!123.
But it is going over the Existing IPSEC tunnel that was set up with the PSK.

jbusch@jared:~$ show configuration commands vpn | grep l2tp
set vpn l2tp remote-access authentication local-users username testuser password 'Testing!123'
set vpn l2tp remote-access authentication mode local
set vpn l2tp remote-access client-ip-pool start 10.254.203.2
set vpn l2tp remote-access client-ip-pool stop 10.254.203.10
set vpn l2tp remote-access dhcp-interface eth0
set vpn l2tp remote-access dns-servers server-1 8.8.8.8
set vpn l2tp remote-access dns-servers server-2 8.8.4.4
set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret NOTGONNATELLYOU
set vpn l2tp remote-access ipsec-settings ike-lifetime 3600
set vpn l2tp remote-access mtu 1492

So without the "Require encryption" the preshared key is sent in plain text?

I do not know enough about the protocols to definitively answer that, but the entire IPSEC protocol does not use the PSK until phase 2. Phase 2 is encrypted with the exchanges sent in phase 1.

The preshared key used in your example and mine is an IPSEC bit, not an L2TP bit.

[DustinB3403]

@jaredbusch said in I can't even:

@dustinb3403 said in I can't even:

@jaredbusch said in I can't even:

@DustinB3403 here is my home ERL.

The part that is going over with Unencrypted PAP is testuser/Testing!123.
But it is going over the Existing IPSEC tunnel that was set up with the PSK.

jbusch@jared:~$ show configuration commands vpn | grep l2tp
set vpn l2tp remote-access authentication local-users username testuser password 'Testing!123'
set vpn l2tp remote-access authentication mode local
set vpn l2tp remote-access client-ip-pool start 10.254.203.2
set vpn l2tp remote-access client-ip-pool stop 10.254.203.10
set vpn l2tp remote-access dhcp-interface eth0
set vpn l2tp remote-access dns-servers server-1 8.8.8.8
set vpn l2tp remote-access dns-servers server-2 8.8.4.4
set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret NOTGONNATELLYOU
set vpn l2tp remote-access ipsec-settings ike-lifetime 3600
set vpn l2tp remote-access mtu 1492

So without the "Require encryption" the preshared key is sent in plain text?

I do not know enough about the protocols to definitively answer that, but the entire IPSEC protocol does not use the PSK until phase 2. Phase 2 is encrypted with the exchanges sent in phase 1.

The preshared key used in your example and mine is an IPSEC bit, not an L2TP bit.

So then it shouldn't matter, "Require encryption" or Optional or Minimal should do nothing to add / improve the encryption since IPSEC is doing all of it.

Does anyone know the protocols well enough to explain this? Why is "Require encryption" recommended, when it doesn't follow/appear to follow the standard and actively reports an error if you attempt set this up via powershell.

[JaredBusch]

In Fedora 25 + Cinnamon, it looks like this by default.

[DustinB3403]

@jaredbusch said in I can't even:

In Fedora 25 + Cinnamon, it looks like this by default.

And as expected nothing there for PAP is offering "Require encryption". I wonder if it's just weirdness or if there is some bug that without "encryption" information is passed in plain text. . . (some how. . . )

[Obsolesce]

@jaredbusch said in I can't even:

In Fedora 25 + Cinnamon, it looks like this by default.

I wouldn't use any of those authentication protocols except MSCHAPv2... uncheck the rest of them.

[DustinB3403]

@tim_g said in I can't even:

I wouldn't use any of those authentication protocols except MSCHAPv2... uncheck the rest of them.

He is just showing the options on Fedora, as I'm trying to figure out a weird setting recommendation by Cisco to "require encryption" when using PAP and IPSEC.

It's several posts above this. . . might be worth its own topic.

[DustinB3403]

@jaredbusch said in I can't even:

@DustinB3403 here is my home ERL.

The part that is going over with Unencrypted PAP is testuser/Testing!123.
But it is going over the Existing IPSEC tunnel that was set up with the PSK.

jbusch@jared:~$ show configuration commands vpn | grep l2tp
set vpn l2tp remote-access authentication local-users username testuser password 'Testing!123'
set vpn l2tp remote-access authentication mode local
set vpn l2tp remote-access client-ip-pool start 10.254.203.2
set vpn l2tp remote-access client-ip-pool stop 10.254.203.10
set vpn l2tp remote-access dhcp-interface eth0
set vpn l2tp remote-access dns-servers server-1 8.8.8.8
set vpn l2tp remote-access dns-servers server-2 8.8.4.4
set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret NOTGONNATELLYOU
set vpn l2tp remote-access ipsec-settings ike-lifetime 3600
set vpn l2tp remote-access mtu 1492

So with regards to this bit The part that is going over with Unencrypted PAP is testuser/Testing!123. I wonder if requiring encryption is actually encrypting the username and password.

But how, how does it work?

[Obsolesce]

@dustinb3403 said in I can't even:

I wonder if requiring encryption is actually encrypting the username and password.

The username/password being encrypted depends on the authentication method. If using PAP, they are sent in clear text, for example.

[DustinB3403]

@tim_g said in I can't even:

@dustinb3403 said in I can't even:

I wonder if requiring encryption is actually encrypting the username and password.

The username/password being encrypted depends on the authentication method. If using PAP, they are sent in clear text, for example.

That is my point of contention, cisco recommends "requiring encryption" when using PAP, yet it doesn't matter.

So why bother with a recommendation that clearly doesn't work? Is it just to provide the warm and fuzzies?

[scottalanmiller]

@dustinb3403 said in I can't even:

So why bother with a recommendation that clearly doesn't work? Is it just to provide the warm and fuzzies?

Reasonably likely.

[DustinB3403]

@scottalanmiller said in I can't even:

@dustinb3403 said in I can't even:

So why bother with a recommendation that clearly doesn't work? Is it just to provide the warm and fuzzies?

Reasonably likely.

Is that in any way reasonable to you as a professional?

[scottalanmiller]

@dustinb3403 said in I can't even:

@scottalanmiller said in I can't even:

@dustinb3403 said in I can't even:

So why bother with a recommendation that clearly doesn't work? Is it just to provide the warm and fuzzies?

Reasonably likely.

Is that in any way reasonable to you as a professional?

No, but neither is choosing Cisco

[DustinB3403]

@scottalanmiller said in I can't even:

@dustinb3403 said in I can't even:

@scottalanmiller said in I can't even:

@dustinb3403 said in I can't even:

So why bother with a recommendation that clearly doesn't work? Is it just to provide the warm and fuzzies?

Reasonably likely.

Is that in any way reasonable to you as a professional?

No, but neither is choosing Cisco

touche.

[scottalanmiller]

That's mostly tongue in cheek, but only mostly.

[bigbear]

@scottalanmiller said in I can't even:

That's mostly tongue in cheek, but only mostly.

Cisco wasn't his choice, nor Meraki...

I gotta get back to my desktop and read closer. I did see your point though originally. And is it only recommends to use PAP?

[bigbear]

@tim_g said in I can't even:

@dustinb3403 said in I can't even:

I wonder if requiring encryption is actually encrypting the username and password.

The username/password being encrypted depends on the authentication method. If using PAP, they are sent in clear text, for example.

Yeah he's got that. When you click on his link search the page for PAP and read the boxes comment. That's what we are mulling over.