Packet Capture of a Post-Quantum Site-to-Site VPN

After using several post-quantum secure VPN tunnels (here and there), I was interested in how this key exchange with ML-KEM looks on the wire. Especially in direct comparison to a classical VPN setup with just ECDH (group 21). Spoiler: since it does not fit in a single packet, it has to use a new form of fragmentation. 😳 Here we go:

This is one of many VPN tutorials on my blog. –> Have a look at this full list. <–

Setup

This was my basic setup. A Palo Alto PA-440 with PAN-OS 12.1.6 on the left and a FortiGate FG-70F with FortiOS 7.6.7 on the right. I captured with a Network Multimeter “Allegro 500” from Allegro Packets.

I captured three runs while I changed the ciphers for both IKE and IPsec (phase 1 and phase 2) in the following way:

only classical elliptic curve Diffie-Hellman: group21
group21 + ML-KEM
group21 + ML-KEM + FrodoKEM + Bike (the paranoid way, just for fun)

Palo Alto IPsec (Phase 2) Crypto Profile

During the VPN sessions, I only did a ping from one side to the other. Hence: Not much traffic, but only very few packets. However, note that both firewalls implement some Dead Peer Detection (DPD; ISAKMP Informational packets) methods, while the Palo additionally monitors the VPN tunnel itself (tunnel monitor; ESP packets). Hence, there are continuous packets in the trace, even without real payload traffic.

Furthermore, both ends are trying to establish the VPN at the same time. This is why you will see the “Initiator Request” and the “Responder Response” from both sides at almost the same time. But never mind. ;)

Analysis

As always, please download those merged captures to analyse them by yourself. And/or use the Ultimate PCAP, since those captures are integrated there as well. Note the packet comments to find the Start/End of the appropriate sections. (Tip: Add a custom column to display the frame.comment.)

–> PQC VPN Palo-Forti 3x different cipher-sets.pcapng.gz <–

Here’s a basic Wireshark comparison. Note the new IKEv2 messages for IKEv2 fragmentation (RFC 7383), which are a must for using IKE_INTERMEDIATE (RFC 9242) and enabling multiple key exchanges (RFC 9370).