Bypassing IKE firewall for cloud-managed IPSec keys in SDWAN fabric
Systems and methods are provided for effectuating overlay tunnels between software-defined wide area network (SD-WAN) end-point devices despite the use of IPSec passthrough in one or more network devices, such as modems or routers that exist between the end-point devices. In particular, the Internet Key Exchange (IKE) protocol can be allowed to progress until a modem/router is able to establish an IKE tunnel, after which overlay packets using cloud-managed keys can be allowed to pass through the modem/router. An overlay tunnel may then be established between the end-point devices, and the IKE tunnel can be taken down.
1 . A method comprising:
detecting, at a first network device between a second network device and a third network device, a key negotiation between the second network device and the third network device;
based on detecting the key negotiation between the second network device and the third network device, creating a firewall session in the first network device between the second and third network devices, wherein a first tunnel is established through the first network device between the second and third network devices using keys from the key negotiation, the first tunnel being compliant with the firewall session;
determining, by the first network device, to allow passage of Internet Protocol Security (IPSec) data packets in the firewall session through the first network device between the second and third network devices;
passing, through the first network device based on the establishment of the first tunnel, the IPSec data packets exchanged between the second and third network devices as part of a hand-shake operation using cloud-managed keys from a cloud-based orchestrator;
passing, through the first network device, a second tunnel established based on the hand-shake operation between the second and third network devices; and
after the establishment of the second tunnel and the cloud-managed keys become active, discarding the keys obtained from the key negotiation and taking down the first tunnel without disrupting encrypted communications between the second and third network devices.
2 . The method of claim 1 , comprising enabling an IPSec passthrough feature at the first network device.
3 . The method of claim 1 , wherein the key negotiation comprises an IPSec key negotiation.
4 . The method of claim 3 , wherein the keys from the key negotiation include IPSec keys, and wherein the first tunnel is established in accordance with the IPSec keys.
5 . The method of claim 4 , wherein the cloud-managed keys from the cloud-based orchestrator are cloud-managed IPSec keys, and wherein the second tunnel is established in accordance with the cloud-managed IPSec keys.
6 . The method of claim 1 , wherein the second tunnel is an overlay tunnel on an underlay network.
7 . The method of claim 1 , wherein the first network device comprises a router, the second network device comprises one of a branch gateway or a virtual private network concentrator operative in a software-defined wide area network (SD-WAN), and the cloud-based orchestrator is a SD-WAN orchestrator.
8 . A first network device comprising:
a hardware processor; and
a non-transitory storage medium storing instructions executable on the hardware processor to:
perform, with a second network device, a key negotiation comprising an exchange of messages that pass through a third network device between the first network device and the second network device;
establish, between the first network device and the second network device, a first tunnel using keys from the key negotiation, the first tunnel passing through the third network device;
receive, at the first network device, cloud-managed keys from a cloud-based orchestrator;
perform a hand-shake operation using the cloud-managed keys between the first network device and the second network device in which Internet Protocol Security (IPSec) data packets are passed in the first tunnel through the third network device, the IPSec data packets for establishing a second tunnel;
establish, between the first network device and the second network device, the second tunnel based on the hand-shake operation; and
after the establishment of the second tunnel and the cloud-managed keys become active, discard the keys obtained from the key negotiation and take down the first tunnel without disrupting encrypted communications between the first and second network devices.
9 . The first network device of claim 8 , wherein the key negotiation comprises an IPSec key negotiation.
10 . The first network device of claim 8 , wherein the first network device comprises a branch gateway or a virtual private network concentrator, and the third network device comprises a router.
11 . The first network device of claim 8 , wherein the IPSec data packets are allowed to pass through the third network device pursuant to an IPSec passthrough feature enabled on the third network device.
12 . The first network device of claim 8 , wherein the keys from the key negotiation are IPSec keys, and wherein the first tunnel is established using the IPSec keys.
13 . The first network device of claim 8 , wherein the second tunnel is an overlay tunnel on an underlay network.
14 . The first network device of claim 8 , wherein the first tunnel established through the third network device between the first and second network devices using keys from the key negotiation is compliant with a firewall session created in the third network device between the first and second network devices.
15 . A non-transitory machine-readable storage medium comprising instructions that upon execution cause a first network device to:
detect, at the first network device between a second network device and a third network device, a key negotiation between the second network device and the third network device;
based on detecting the key negotiation between the second network device and the third network device, create a firewall session in the first network device between the second and third network devices, wherein a first tunnel is established through the first network device between the second and third network devices using keys from the key negotiation, the first tunnel being compliant with the firewall session;
determine to allow passage of Internet Protocol Security (IPSec) data packets in the firewall session through the first network device between the second and third network devices;
pass, through the first network device based on the establishment of the first tunnel, the IPSec data packets exchanged between the second and third network devices as part of a hand-shake operation using cloud-managed keys from a cloud-based orchestrator;
pass, through the first network device, a second tunnel established based on the hand-shake operation between the second and third network devices; and
after the establishment of the second tunnel and the cloud-managed keys become active, discard the keys obtained from the key negotiation and take down the first tunnel without disrupting encrypted communications between the second and third network devices.
16 . The non-transitory machine-readable storage medium of claim 15 , wherein the keys from the key negotiation include IPSec keys, and wherein the first tunnel is established in accordance with the IPSec keys.
17 . The non-transitory machine-readable storage medium of claim 15 , wherein the cloud-managed keys from the cloud-based orchestrator are cloud-managed IPSec keys, and wherein the second tunnel is established in accordance with the cloud-managed IPSec keys.
18 . The non-transitory machine-readable storage medium of claim 15 , wherein the instructions upon execution cause the first network device to make a determination to allow the passage of the IPSec data packets through the first network device in response to the firewall session being created.