17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 Validation of Encryption Devices Over BGAN US Centric for Inmarsat Release (AOR Testing – Packet Switched Encryptors) Prepared by: Greg True Martin O’Briskie January 29, 2007 AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 1 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 Contents 1 2 3 4 5 6 7 8 9 10 Executive Summary Introduction Reference Documents Encryptors to be Tested Glossary – List of Abbreviations Packet Switch Type-1 Encryption Testing via BGAN I-4 6.1 Equipment required for PS Type-1 Configuration 6.2 Equipment Settings for PS Type-1 Configuration 6.3 Test Results for GD KG-175 Mini-Taclane 6.3.1 Test Results w/Thrane 500 and KG-175B 6.3.2 Test Results w/Hughes 9201 and KG-175B 6.4 Test Results for ViaSat KG-250 6.4.1 Test Results w/Thrane 500 and KG-250 6.4.2 Test Results w/Hughes 9201 and KG-250 6.5 Mobile-to-Mobile BGAN Operation and ViaSat KG-250 6.6 Test Results for the GD KG-235 6.6.1 Test Results w/Thrane 500 and KG-235 6.6.2 Test Results w/Hughes 9201 and KG-235 Thales DC2K IP Encryption and GRE Tunnel 7.1 Equipment required for DC2K via GRE Tunnel Configuration 7.2 Equipment Settings for DC2K PS non-Type-1 Configuration 7.3 Test Results for non-Type-1 Thales DC2K 7.3.1 Test Results w/Thrane 500 and DC2K 7.3.2 Test Results w/Hughes 9201 and DC2K Summary of Test Data 8.1 Summary of Thrane Explorer 500 Test Data 8.2 Summary of Hughes 9210 Test Data Encryptor Working Configurations Summary of Test Results 4 5 5 5 6 7 7 7 8 8 9 11 11 12 13 14 14 15 16 16 16 17 17 18 19 19 19 20 21 Figures Figure 1 Figure 2 Figure 3 Packet Switch Encryption Testing via BGAN I-4 Configuration BGAN Thrane 500 UT to Thrane 500 UT (Mobile-to-Mobile) GRE PS Testing via BGAN I-4 Configurations for DC2K AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary 7 13 16 Page 2 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 Tables Table 1 Table 2 Table 3 Table 4 Table 5 Table 6 Table 7 Table 8 Table 9 Table 10 Table 11 Table 12 Table 13 Table 14 Table 15 Table 16 Table 17 Table 18 Table 19 Table 20 Table 21 Table 22 Encryptors to be tested Thrane UT Baseline Data Test Card w/o KG-175 Thrane UT and KG-175B Test Card (MTU=800) Thrane UT and KG-175B Test Card (MTU=1184) Thrane UT and KG-175B Test Card (MTU=1424) Hughes UT Baseline Data Test Card w/o KG-175 Hughes UT and KG-175B Test Card Thrane UT Baseline Data Test Card w/o KG-250 Thrane UT and KG-250 Test Card Hughes UT Baseline Data Test Card w/o KG-250 Hughes UT and KG-250 Test Card Thrane 500 UT to Thrane 500 UT and KG-250 Test Card Thrane UT Baseline Data Test Card w/o KG-235 Thrane UT and KG-235 Test Card Hughes UT Baseline Data Test Card w/o KG-235 Hughes UT and KG-235 Test Card Thrane UT GRE Tunnel Baseline Data Test Card w/o DC2K Thrane UT and DC2K via GRE Tunnel Test Card Hughes UT GRE Tunnel Baseline Data Test Card w/o DC2K Hughes UT and DC2K via GRE Tunnel Test Card Summary of Thrane Explorer 500 Test Data Summary of Hughes 9201 Test Data 5 8 8 9 9 10 10 11 11 12 12 13 14 14 15 15 17 17 18 18 19 19 Appendix A B Cisco Configuration for GRE Tunnels for Thrane 500 UT Cisco Configuration for GRE Tunnels for Hughes 9201 UT 23 26 AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 3 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 Executive Summary This report is a continuation of the Interim Phase C “Validation of Encryption Devices over BGAN US Centric” report submitted on March 23, 2006. During this current phase of the project direct access to the BGAN network via the AOR I-4 satellite was possible. As before, the primary objective of this study was to verify that USG Type-1 encryption equipment functions properly over the Inmarsat BGAN satellite network. The four packet switched encryptors being evaluated were the General Dynamics KG175B Mini-Taclane, the General Dynamics KG-235, the ViaSat AltaSec KG-250 and the Thales DC2K. The L3 KG-240 Red Eagle IP encryptor and circuit switched encryptors will be detailed in a future report. From the extensive testing performed via the AOR I-4 Inmarat BGAN satellite network there appears to be no impediment for the proper use of these encryptors. This report documents the BGAN satellite testing that has been performed via the Thrane Explorer 500 and Hughes 9201 UT and the above IP encryptors. It should be noted that all BGAN testing was performed using background class IP. No streaming class IP tests are included in this report. No Performance Enhancing Proxy (PEP) software was used to accelerate data throughput speeds in this report. See Figure 1 for an overview of the BGAN with Type-1 encryption testing network. The KG-175B, KG-235 and KG-250 Type-1 IP encryptors were tested with direct connection to the BGAN terminal. However, the Thales DC2K non-Type-1 IP encryptors would not exchange encryption keys properly without running within a Cisco Generic Routing Encapsulation (GRE) tunnel. The GRE tunnel setup and associated DC2K testing with the GRE tunnel is discussed in section 7. It should be noted that although the Type 1 encryptors under test did not require an intermediary router to operate the user needs to check with their local network security personnel to verify Transec/COMSEC requirements. U.S. Government users may contact AOS for a restricted version of this report that details the configuration settings for all Type-1 encyptors used in this report. The BGAN data throughput rates were measured by using a DOS FTP script developed by Inmarsat’s engineering staff. The script provided an automated FTP program that downloaded and uploaded ten 1MB, 3MB and 5MB JPEG files. The 3MB test results have been recorded in this report. To minimize the size of this report all data throughput tests have been condensed to show minimum, maximum and average data rates. The standard deviation was provided for all data kilobit-per-second (Kbps) readings to give the reader a better idea of what data fluctuations took place during the specific data transfer. AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 4 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 2 Introduction AOS, Inc. was contracted to assess the interoperability between BGAN services and a range of existing and future cryptographic equipment typically used by the US Government. This contract specifically addresses encryption testing via Inmarsat’s AOR I-4 BGAN satellite. 3 Reference Documents See Inmarsat Contract No. INM/06-4198/JB 4 Encryptors to be tested Manufacturer Available Tested this Report Circuit Switched Data - ISDN UDI STE KIV7 OmniXi STUIII Model 1100 Sectera Wireline L3 SafeNet L3 AT&T General Dynamics Yes Yes Yes Yes Yes No No No No No Packet Switched Services DC2K IP Encryptor * KG-175B Mini-Taclane KG-235 Sectera INE KG-250 KG-240 Red Eagle Thales General Dynamics General Dynamics ViaSat L3 Yes Yes Yes Yes TBD Yes Yes Yes Yes No Encryption Equipment *Non type-1 variant to be tested Table 1 – Encryptors to be tested AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 5 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 5 Glossary – List of Abbreviations AES BGAN CEF CN COMSEC CS FNBDT FTP IOS HSD IP IPSec ISDN HAIPIS HTTP HTTPS Kbps MB MMI MTU PEP PIX PS POTS RTT STE SBU SDM SOW SP STU TCP UT USG VPN Advanced Encryption Standard Broadband Global Area Network Cisco Express Forwarding Core Network Communications Security Circuit Switched Future Narrow Band Digital Terminal File Transfer Protocol Internetwork Operating System (Cisco) High Speed Data Internet Protocol IP Security Protocols Integrated Services Digital Network High Assurance IP Interoperability Specifications Hyper Text Transfer Protocol HTTP Secure Kilo Bits Per Second Megabyte Man Machine Interface Maximum Transmission Unit Performance Enhancing Proxy Private Internet Exchange (Cisco) Packet Switched Plain Old Telephone Service Round Trip Time Secure Terminal Equipment Sensitive but Unclassified System Definition Manual Statement of Work Service Provider Secure Telephone Unit Transmission Control Protocol User Terminal United States Government Virtual Private Network AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 6 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 6 Packet Switched Encryption Equipment Testing via BGAN I-4 Single satellite hop (Ping RTT delay 950ms to 1300ms) The Packet Switched (PS) test arrangement is configured as in Figure 1 below: Figure 1 – Packet Switched Encryption Equipment Testing via BGAN I-4 Configuration 6.1 The equipment required for this Packet Switched configuration is: 2 each IP Encryptors (KG-175, KG-235 and KG-250) 1 each Computer with Windows XP Pro SP2 w/DOS FTP script (Client PC) 1 each Computer with Linux FC4 Samba ProFTPD (Server PC) 1 each T1 high speed Internet connections with static IP’s 1 each HNS 9201 and Thrane Explorer 500 BGAN UT’s with static IP’s 2 each BGAN SIM cards. Inmarsat provided airtime for testing Used DOS FTP script for all 3MB data transfers 6.2 Equipment Settings for Figure 1: Thrane Explorer UT set for ‘Modem Mode’ operation Client/Server computer MTU settings at 1400 unless noted otherwise Encryptor settings: See ‘Encryptor Working Configurations’ on page 20 and Tables See above Figure 1 for IP address scheme AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 7 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 6.3 Test results for the KG-175B (Mini-Taclane) Type-1 encryptor are reported below. 6.3.1 Thrane Explorer 500 UT Baseline Testing without KG-175B: BGAN I-4 Tests FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation FTP Transfer Rates Download/Get Upload/Put Time (sec) Kbps Time (sec) Kbps 76.14 66.60 72.54 330.56 377.92 348.21 21.1 113.23 88.25 96.76 217.04 278.48 257.76 28.8 Test Notes: Baseline Tests BGAN: Thrane Explorer 500 f/w 1.06 in modem mode Test Set started at: 2006 10 27 15:30:23 Test Iterations: 3 Table 2 – Thrane Explorer 500 UT Baseline Data Test Card without KG-175B Encryptor Thrane Explorer 500 UT and KG-175B testing (KG-175B MTU set to 800): BGAN I-4 Tests FTP Transfer Rates Download/Get Time (sec) Kbps FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation 259.48 100.54 200.40 96.96 250.32 139.60 55.1 Upload/Put Time (sec) Kbps 221.90 94.00 119.52 113.44 267.68 224.72 47.8 Test Notes: Encryptor - GD KG-175B Mini-Taclane Type 1 IP encryptor with MTU size set to 800; Rel R3.1V4 BGAN: Thrane Explorer 500 f/w 1.06 in modem mode Test Set started at: 2006 10 26 18:48:14 Test Iterations: 10 Table 3 – Thrane Explorer 500 UT and KG-175B Test Card (KG-175B MTU set to 800) AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 8 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 Thrane Explorer 500 UT and KG-175 testing (KG-175B MTU set to 1184): BGAN I-4 Tests FTP Transfer Rates Download/Get Time (sec) Kbps FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation 183.64 191.98 232.49 46.32 131.12 101.64 25.5 Upload/Put Time (sec) Kbps 220.76 93.22 112.76 114.00 269.92 238.24 46.6 Test Notes: Encryptor - GD KG-175B Mini-Taclane Type 1 IP encryptor with MTU size set to 1184; Rel R3.1V4 BGAN: Thrane Explorer 500 f/w 1.06 in modem mode Test Set started at: 2006 10 26 22:20:37 Test Iterations: 10 Table 4 - Thrane Explorer 500 UT and KG-175B Test Card (KG-175B MTU set to 1184) Thrane Explorer 500 UT and KG-175 testing (KG-175B MTU set to 1424): BGAN I-4 Tests FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation FTP Transfer Rates Download/Get Upload/Put Time (sec) Kbps Time (sec) Kbps 100.99 94.70 96.81 249.20 265.76 260.08 5.8 117.64 94.12 100.17 213.92 267.36 252.96 19.8 Test Notes: Encryptor - GD KG-175B Mini-Taclane IP encryptor with MTU size set to 1424 (Max); Rel R3.1v4 BGAN: Thrane Explorer 500 f/w 1.06 in modem mode Test Set started at: 2006 10 26 23:54:07 Test Iterations: 10 Table 5 - Thrane Explorer 500 UT and KG-175B Test Card (KG-175B MTU set to 1424) AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 9 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 6.3.2 Hughes 9201 UT Baseline Testing without KG-175B Encryptor: BGAN I-4 Tests FTP Transfer Rates Download/Get Time (sec) Kbps FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation 59.55 59.46 59.50 Test Notes: Baseline Testing BGAN: Hughes 9201 f/w 3.6.1.0 Test Set started at: 2006 10 27 13:07:44 422.56 423.20 422.96 0.3 Upload/Put Time (sec) Kbps 147.66 92.07 110.84 170.40 273.36 238.32 48.0 Test Iterations: 3 Table 6 – Hughes 9201 UT Baseline Data Test Card without KG-175B Encryptor Hughes 9201 UT and KG-175 Encryptor testing: BGAN I-4 Tests FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation FTP Transfer Rates Download/Get Upload/Put Time (sec) Kbps Time (sec) Kbps 94.67 93.23 93.81 265.84 269.92 268.24 1.3 126.53 93.58 102.28 198.88 268.96 248.64 24.4 Test Notes: Encryptor - GD KG-175B Mini-Taclane IP encryptor with MTU size set to 1424 (max); Rel R3.1v4 BGAN: Hughes 9201 f/w 3.6.1.0 Test Set started at: 2006 10 27 13:55:23 Test Iterations: 10 Table 7 – Hughes 9201 UT and KG-175B Test Card AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 10 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 6.4 Test results for the ViaSat AltaSec KG-250 Type-1 encryptor is reported below: 6.4.1 Thrane Explorer 500 UT Baseline Testing without KG-250: BGAN I-4 Tests FTP Transfer Rates Download/Get Time (sec) Kbps FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation 64.09 57.28 60.14 Test Notes: Baseline Testing BGAN: Thrane Explorer 500 f/w 1.06 Test Set started at: 2006 11 08 18:04:29 392.64 439.36 418.88 13.44 Upload/Put Time (sec) Kbps 82.39 71.76 74.71 305.44 350.64 337.44 13.68 Test Iterations: 10 Table 8 – Thrane Explorer 500 UT Baseline Data Test Card without KG-250 Encryptor Thrane Explorer 500 UT and KG-250 Testing: BGAN I-4 Tests FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation FTP Transfer Rates Download/Get Upload/Put Time (sec) Kbps Time (sec) Kbps 75.13 63.57 67.91 334.96 395.84 371.68 20.1 154.39 92.24 104.38 162.96 272.80 246.80 32.7 Test Notes: Encryptor - ViaSat AltaSec KG-250, MTU 1344 Red Side, 1500 Black side, f/w 1.3.95 BGAN: Thrane Explorer 500 f/w 1.06 Test Set started at: 2006 11 08 15:07:58 Test Iterations: 10 Table 9 - Thrane Explorer 500 UT and KG-250 Test Card AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 11 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 6.4.2 Hughes 9201 UT Baseline Testing without KG-250: BGAN I-4 Tests FTP Transfer Rates Download/Get Time (sec) Kbps FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation 58.86 56.38 58.40 Upload/Put Time (sec) Kbps 427.60 446.32 431.49 14.84 Test Notes: Baseline Testing BGAN: Hughes 9201 f/w 3.6.1.0 Test Set started at: 2006 11 09 14:32:52 120.87 69.20 83.12 208.16 363.68 311.97 49.54 Test Iterations: 10 Table 10 – Hughes 9201 UT Baseline Data Test Card without KG-250 Encryptor Hughes 9201 UT and KG-250 testing: BGAN I-4 Tests FTP Transfer Rates Download/Get Time (sec) Kbps FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation 72.64 71.88 72.33 346.40 350.08 347.92 1.18 Upload/Put Time (sec) Kbps 744.13 89.20 329.68 33.84 282.16 147.68 110.34 Test Notes: Encryptor - ViaSat AltaSec KG-250, Red MTU 1344, Black MTU 1500, f/w 1.3.95 BGAN: Hughes 9201 f/w 3.6.1.0 Test Set started at: 2006 11 08 20:55:36 Test Iterations: 10 Table 11 – Hughes 9210 UT and KG-250 Test Card AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 12 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 6.5 Mobile-to-Mobile BGAN Operation and KG-250 Testing - Double satellite hop (Ping RTT 1720ms to 1920ms) Thrane Explorer 500 UT to Thrane Explorer UT and KG-250 testing configuration BGAN UT Tested: Thrane Explorer 500 Thrane IP 161.30.180.252 (Modem Mode) Thrane IP 161.30.191.1 (Modem Mode) IP Encryptor AOS HQ Dallas 10.200.200.1/24 10.10.1.1/24 Burum BGAN E/S IP Encryptors KG175B KG250 10.200.200.2/24 10.10.1.2/24 Figure 2 - BGAN Thrane 500 UT to Thrane 500 UT (Mobile-to-Mobile) Configuration: BGAN I-4 Tests FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation FTP Transfer Rates Download/Get Upload/Put Time (sec) Kbps Time (sec) Kbps 206.34 136.79 162.83 122.00 184.00 158.58 24.64 145.36 137.91 141.00 173.12 182.48 178.52 2.69 Test Notes: Encryptor - ViaSat AltaSec KG-250 IP encryptor, MTU 1344 Red Side, 1500 Black side, f/w 1.3.95 Thrane Explorer 500 f/w 1.06 Test Set started at: 2006 11 16 17:26:54 Test Iterations: 10 Table 12 - Thrane 500 UT to Thrane 500 UT and KG-250 Test Card AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 13 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 6.6 Test results for the GD KG-235 type-1 encryptor is reported below: 6.6.1 Thrane Explorer 500 UT Baseline Testing without KG-235: BGAN I-4 Tests FTP Transfer Rates Download/Get Time (sec) Kbps FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation 59.30 54.17 55.87 Test Notes: Baseline Testing BGAN: Thrane Explorer 500 f/w 1.06 Test Set started at: 2006 11 16 00:17:25 424.40 464.56 450.81 13.14 Upload/Put Time (sec) Kbps 71.60 70.09 70.52 351.44 359.04 356.87 2.70 Test Iterations: 10 Table 13 - Thrane Explorer 500 UT Baseline Data Test Card without KG-235 Encryptor Thrane Explorer 500 UT and KG-235 Testing: BGAN I-4 Tests FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation FTP Transfer Rates Download/Get Upload/Put Time (sec) Kbps Time (sec) Kbps 64.98 62.96 63.77 387.28 399.68 394.66 4.15 165.90 98.79 116.65 151.68 254.72 224.62 40.86 Test Notes: Encryptor - GD KG-235, MTU not configurable, Config ver 3.3, h/w version 284678.0 BGAN: Thrane Explorer 500 f/w 1.06 Test Set started at: 2006 11 14 14:01:34 Test Iterations: 10 Table 14 - Thrane Explorer 500 UT and KG-235 Test Card AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 14 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 6.6.2 Hughes 9201 UT Baseline Testing without KG-235 Encryptor: BGAN I-4 Tests FTP Transfer Rates Download/Get Time (sec) Kbps FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation 60.86 56.48 57.94 Test Notes: Baseline Testing BGAN: Hughes 9201 f/w 3.6.1.0 Test Set started at: 2006 11 13 16:13:21 413.52 445.52 434.56 9.00 Upload/Put Time (sec) Kbps 113.51 74.80 89.16 221.68 336.48 286.96 35.04 Test Iterations: 10 Table 15 - Hughes 9201 UT Baseline Data Test Card without KG-235 Encryptor Hughes 9201 UT and KG-235 Testing: BGAN I-4 Tests FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation FTP Transfer Rates Download/Get Upload/Put Time (sec) Kbps Time (sec) Kbps 69.02 67.72 68.28 364.64 371.60 368.56 2.38 283.90 96.71 130.74 88.64 260.24 219.28 59.79 Test Notes: Encryptor: GD KG-235, MTU not configurable, Config version 3.3, h/w version 284678.0 BGAN: Hughes 9201 f/w 3.6.1.0 Test Set started at: 2006 11 14 16:00:44 Test Iterations: 10 Table 16 - Hughes 9210 UT and KG-235 Test Card AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 15 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 7 Thales DC2K IP Encryptor (non-Type-1) and GRE Tunnel Single satellite hop (Ping RTT 950ms to 1300ms) The PS test arrangement with Thales DC2K is configured as in Figure 3 below: BGAN UT’s to be tested: HNS 9201 Thrane Explorer 500 Thrane IP 161.30.180.252 (Modem Mode) HNS IP 192.168.128.101 Cisco 1720 Router Cisco 2600 Router Cisco routers provide GRE Tunnel IP 12.191.85.83 Public Internet 192.168.155.1/24 192.168.155.2/24 IP Encryptor 192.168.122/1/24 192.268.122.2/24 10.10.1.1/24 AOS HQ Dallas 10.200.200.1/24 IP Encryptors DC2K 10.10.1.2/24 Burum BGAN E/S T1 Internet Access AOS Dallas 10.200.200.2/24 Figure 3 - The GRE Packet Switched Testing via BGAN I-4 Configuration for DC2K 7.1 The equipment required for this CS configuration is: 2 each Thales DC2K IP Encryptors 1 each Computer with Windows XP Pro SP2 w/DOS FTP script (Client PC) 1 each Computers with Linux FC4 Samba ProFTPD (Server PC) 1 each T1 high speed Internet connections with static IP’s 1 each HNS 9201 and Thrane Explorer 500 BGAN UT’s with static IP’s 2 each BGAN SIM cards. Inmarsat provided airtime for testing Used DOS FTP script for all 3MB data transfers 7.2 Equipment Settings for Figure 3: Thrane Explorer UT set for ‘Modem Mode’ operation See Appendix for Cisco Router GRE tunnel configurations Client/Server computer MTU settings at 1400 unless noted otherwise DC2K Encryptor settings: See ‘Encryptor Working Configurations’ on pg 20 & Tables See above Figure 3 for IP address scheme AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 16 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 7.3 Test results for the Thales DC2K non-Type-1 encryptor are reported below. 7.3.1 Thrane Explorer 500 UT Baseline testing of Cisco GRE tunnel without DC2K: BGAN I-4 Tests FTP Transfer Rates Download/Get Time (sec) Kbps FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation 89.39 63.35 71.73 Upload/Put Time (sec) Kbps 281.52 397.28 356.27 41.69 207.03 92.40 121.33 34.12 121.52 272.32 220.70 49.08 Test Notes: Baseline Testing of GRE tunnel BGAN: Thrane Explorer 500 f/w 1.06 Test Set started at: 2006 10 30 18:36:45 Test Iterations: 10 Table 17 – Thrane Explorer 500 UT GRE Tunnel Baseline Test Card w/o DC2K Thrane Explorer 500 UT with Thales DC2K via GRE Tunnel: BGAN I-4 Tests FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation FTP Transfer Rates Download/Get Upload/Put Time (sec) Kbps Time (sec) Kbps 308.19 62.60 92.34 81.68 402.00 343.04 92.96 143.02 92.79 105.38 176.00 271.20 244.16 34.02 Test Notes: Thales DC2K IP encryptor through GRE tunnel BGAN: Thrane Explorer 500 f/w 1.06 Test Set started at: 2006 10 25 23:42:20 Test Iterations: 10 Table 18 – Thrane Explore 500 and Thales DC2K via GRE Tunnel Test Card AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 17 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 7.3.2 Hughes 9201 UT Baseline testing of Cisco GRE tunnel without Thales DC2K: BGAN I-4 Tests FTP Transfer Rates Download/Get Time (sec) Kbps FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation 66.62 65.77 66.20 377.76 382.64 380.13 2.0 Upload/Put Time (sec) Kbps 93.19 92.62 92.48 270.00 271.68 272.11 1.9 Test Notes: Baseline Testing of GRE tunnel BGAN: Hughes 9201 f/w 3.6.1.0 Test Set started at: 2006 11 07 16:14:30 Test Iterations: 3 Table 19 – Hughes 9201 UT GRE Tunnel Baseline Test Card w/o DC2K Hughes 9201 UT with Thales DC2K via GRE Tunnel: BGAN I-4 Tests FTP Tests Min Data Rate Max Data Rate Avg Data Rate Std Deviation FTP Transfer Rates Download/Get Upload/Put Time (sec) Kbps Time (sec) Kbps 208.48 197.88 201.00 120.72 127.20 125.23 1.67 117.68 92.95 105.30 213.84 270.72 241.82 26.19 Test Notes: Thales DC2K IP encryptor through GRE tunnel BGAN: Hughes 9201 f/w 3.6.1.0 Test Set started at: 2006 10 31 14:35:50 Test Iterations: 10 Table 20 – Hughes 9201 UT and Thales DC2K via GRE Tunnel Test Card AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 18 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 8 Summary of Test Data 8.1 Summary of Thrane Explorer 500 Test Data: Thrane Exp 500 3MB Data KG-175 DC2K (via GRE) KG-250 KG-235 Baseline Test Date 10/27/2006 10/30/2006 11/8/2006 11/16/2006 Download Avg 348.21 356.27 418.88 450.81 Std Dev 21.10 41.69 13.44 13.14 Upload Avg 257.76 220.70 337.44 356.87 Std Dev 28.80 49.08 13.68 2.70 Upload Avg 252.96 244.18 246.80 224.62 Std Dev 19.80 34.02 32.70 40.86 Upload Avg 238.32 272.11 311.97 286.96 Std Dev 48.00 1.90 49.54 35.04 Upload Avg 248.64 241.82 147.68 219.28 Std Dev 24.40 26.19 110.34 59.79 Encrypted KG-175 DC2K (via GRE) KG-250 KG-235 Test Date 10/26/2006 10/25/2006 11/8/2006 11/14/2006 Download Avg 260.08 343.04 371.68 394.66 Std Dev 5.80 92.96 20.10 4.15 Table 21: Summary of Thrane Explorer 500 Test Data 8.2 Summary of Hughes 9201 Test Data: Hughes 9201 3MB Data KG-175 DC2K (via GRE) KG-250 KG-235 Baseline Test Date 10/27/2006 11/7/2006 11/9/2006 11/13/2006 Download Avg 422.96 380.13 431.49 434.56 Std Dev 0.30 2.00 14.84 9.00 Encrypted KG-175 DC2K (via GRE) KG-250 KG-235 Test Date 10/27/2006 10/31/2006 11/8/2006 11/14/2006 Download Avg 268.24 125.23 347.92 368.58 Std Dev 1.30 1.67 1.18 2.38 Table 22: Summary of Hughes 9201 Test Data AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 19 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 9 Encryptor Working Configurations 9.1 Thales DC2K IP Encryptor Configuration Settings All configurations are standard default settings; except for below IP Security screens: 9.1.1 Server IP Security screens (DC2K) Port Setup Private IP Address: 10.200.200.1 Private Mask: 255.255.255.0 Private Gateway: 0.0.0.0 Public IP Address: 192.168.122.2 Public Mask: 255.255.255.0 Public Gateway: 192.168.122.1 Private Network Selectors: Type: Range Address/From: 10.200.200.1 Mask/To: 10.200.200.10 Network Setup: Tunneling: 192.168.100.2 9.1.2 Client IP Security screens (DC2K) Port Setup Private IP Address: 10.10.1.1 Private Mask: 255.255.255.0 Private Gateway: 0.0.0.0 Public IP Address: 192.168.100.2 Public Mask: 255.255.255.0 Public Gateway: 192.168.100.1 Private Network Selectors: Type: Range Address/From: 10.10.1.1 Mask/To: 10.10.1.10 Network Setup: Tunneling: 192.168.122.2 9.2 Taclane KG-175 Encryptor Configuration Settings See “For Distribution to US Government Personnel Only” document for configuration settings. 9.3 ViaSat KG-250 Encryptor Configuration Settings Same as 9.2 above. 9.4 GD KG-235 Encryptor Configuration Settings Same as 9.2 above AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 20 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 10 Summary of Test Results - The objective of this report is to provide feedback to the Inmarsat user community regarding the compatibility of US Centric packet switched IP encryptors via the BGAN AOR I-4 satellite. During the course of this report only the Thrane Explorer 500 and Hughes 9201 BGAN UT’s were tested. The only IP encryptors available during the tests were the Thales DC2K, General Dynamics Mini-Taclane KG-175B, ViaSat KG-250 and General Dynamics KG-235. The L3 KG-240 Type-encryptor will be tested when available. The IP encryptor test data throughput measurements are tabulated in Tables 1 through 20. Tables 21 and 22 summarize all testing less the BGAN UT-to-UT testing as described on page 13. This data validates the DC2K, KG-175, KG-235 and KG-250 IP encryptor’s capability to pass encrypted data via the BGAN network. DOS FTP encrypted download speeds ranged from an average of 125 Kbps to 395Kbps, whereas, FTP uploads averaged from 148 Kbps to 253 Kbps. The October-November data throughput values were impressive considering the that fact that the BGAN system is a ‘shared’ network with an Internet back haul from the Burum BGAN earth station to the AOS’ Dallas, Texas testing location. These variables produced a round trip time (RTT) between 950ms to 1300ms over a single satellite hop test. Testing the non-Type-1 Thales DC2K IP encryptor required the addition of a Cisco Generic Routing Encapsulation (GRE) tunnel (see Figure 3) to allow proper exchange of encryption keys. Previous tests showed that if the transport network Cisco routers have Cisco Express Forwarding (CEF) enabled the DC2K’s would not exchange encryption keys due to the encryptors IPSec incompatibility with Cisco’s CEF. See Appendix A and B for router configuration instructions for BGAN operation via the Thrane Explorer 500 and Hughes 9201. Generally speaking most encryptors used the manufacturers default settings. Configuring the Type-1 KG-175B, KG-235 and KG-250 IP encryptors was straight forward except for the KG-235. Please see the US Government version of this report for detailed configuration instructions for all Type-1 encryptors. After configuring all administrative settings (i.e., red/black setup and handling keying materials) the encryptors would synchronize with each other within a minute. Various MTU settings were tried before the best possible settings were obtained. It should be noted that although the Type-1 encyrptors did not require an intermediary router to operate the user needs to check with their local network security personnel to verify Transec/COMSEC requirements. The above GRE tunnel concept may satisfy this requirement. The proper setting of the Maximum Transmission Unit (MTU) was important to insure the highest possible data transfer. While using a network protocol analyzer (Ethereal) the MTU’s on the computer, Cisco routers GRE tunnel and encryption equipment was adjusted for maximum data transfer. As in the case when adjusting the MTU value on AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 21 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 the KG-175B encryptor from 800 to 1424 the data throughput approximately doubled from 140Kbps to 260 Kbps; see section 6.2.1. Maximum data transfer would occur when packets were not being fragmented as they passed through the encryptor, router and computer interfaces. As a general rule all computer MTU’s were set to 1400 and both GRE network routers MTU’s were set to 1416. The DC2K, KG-175 and KG-250 MTU settings were 1400, 1424 and 1344/1500 (red/black interfaces) respectively. These values are documented on the test tables (Tables 1 to 20). Note that the MTU settings for the KG-235 are not configurable. Although not in the original scope of this work mobile-to-mobile test results were obtained with the ViaSat KG-250 encryptors and the Thrane Explorer 500 UT’s; see section 6.4 (page 13). Reasonable throughput data throughput speeds averaged 159 Kbps (download) and 179 Kpbs (upload). It should be noted that the test configurations used here were aimed at obtaining the best measurement of the abilities of the BGAN network. A computer user with a Windows based operating system and graphical based FTP clients, more typically available, may see markedly different results, in many cases lower. Those with questions should refer to Inmarsat’s Application notes (http://support.inmarsat.com/techsupport) for details regarding the test and setup of various FTP clients in order to insure maximum performance. The reader should note that this configuration used the standard BGAN IP server with a back haul through the public Internet, therefore, the variability in test results is not totally unexpected. For users who have restrictions on the use of the public Internet, private line services from Inmarsat’s Distribution Partners is available and should provide additional consistency and performance. This concludes the testing of the Thales DC2K, GD Mini-Taclane KG-175B, GD KG235 and ViaSat KG-250. BGAN Circuit Switched Type-1 encryption testing of the L3 STE, SafeNet KIV7, L3 Omni, AT&T STU-III, GD Sectera Wireline will now start with a report expected by the end of March 2007. This report will be supplemented with the results of the L3 KG-240 when the encryptor is available. AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 22 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 Appendix A: Cisco Config for GRE tunnels for Thrane Explorer 500 Configuration for Cisco 2600 Terrestrial Router (Thrane Explorer 500 UT) GRE1#sh run Current configuration : 1149 bytes version 12.3 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption hostname GRE1 boot-start-marker boot-end-marker enable secret 5 $1$Ywbs$WdSjSL.J/JQ8cLyrY7QPD/ username cisco password 0 cisco no aaa new-model ip subnet-zero no ip cef no ip domain lookup ip dhcp pool local network 192.168.100.0 255.255.255.0 default-router 192.168.100.1 ip audit po max-events 100 interface Tunnel1 description Hub Tunnel endpoint ip address 172.18.18.1 255.255.255.0 tunnel source FastEthernet0/0 tunnel destination 161.30.180.252 interface FastEthernet0/0 ip address 12.191.85.83 255.255.255.192 duplex auto speed auto interface FastEthernet0/1 ip address 192.168.100.1 255.255.255.0 duplex auto speed auto router eigrp 100 redistribute static network 172.18.18.0 0.0.0.255 network 192.168.100.0 no auto-summary ip http server AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 23 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 Appendix A Continued Cisco Configuration for GRE tunnels for Thrane Explorer 500 terrestrial router no ip http secure-server ip classless ip route 0.0.0.0 0.0.0.0 12.191.85.65 ip route 172.16.1.0 255.255.255.0 192.168.100.2 line con 0 line aux 0 line vty 0 4 login local end Configuration for Cisco 1720 Client/Remote Router (Thrane Explorer 500 UT) Current configuration : 1549 bytes version 12.3 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption hostname GRE2 boot-start-marker boot-end-marker logging buffered 4096 emergencies mmi polling-interval 60 no mmi auto-configure no mmi pvc mmi snmp-timeout 180 no aaa new-model ip subnet-zero ip dhcp pool local network 192.168.122.0 255.255.255.0 default-router 192.168.122.1 dns-server 151.164.1.8 no ip cef no ip domain lookup ip ips po max-events 100 no ftp-server write-enable username cisco password 0 cisco no crypto isakmp ccm interface Tunnel1 AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 24 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 Appendix A Continued Cisco Config for GRE tunnels for Thrane Explorer 500 Client/Remote Router description Tunnel Endpoint ip address 172.18.18.2 255.255.255.0 tunnel source FastEthernet0 tunnel destination 12.191.85.83 interface BRI0 no ip address shutdown interface FastEthernet0 ip address 161.30.180.252 255.255.255.0 ip virtual-reassembly duplex auto speed auto interface FastEthernet1 interface FastEthernet2 interface FastEthernet3 interface FastEthernet4 interface Vlan1 ip address 192.168.122.1 255.255.255.0 ip nat inside ip virtual-reassembly router eigrp 100 network 172.18.18.0 0.0.0.255 network 192.168.122.0 network 192.168.128.0 no auto-summary ip classless ip route 0.0.0.0 0.0.0.0 161.30.180.251 ip http server ip http authentication local ip http secure-server ip nat inside source list 99 interface FastEthernet0 overload access-list 99 permit 192.168.122.0 0.0.0.255 control-plane line con 0 line aux 0 line vty 0 4 login local end AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 25 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 Appendix B: Cisco Configuration for GRE tunnels for Hughes 9201 Configuration for Cisco 2600 Terrestrial Router (Hughes 9201 UT) GRE1#sh run Current configuration : 1149 bytes version 12.3 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption hostname GRE1 boot-start-marker boot-end-marker enable secret 5 $1$Ywbs$WdSjSL.J/JQ8cLyrY7QPD/ username cisco password 0 cisco no aaa new-model ip subnet-zero no ip cef no ip domain lookup ip dhcp pool local network 192.168.100.0 255.255.255.0 default-router 192.168.100.1 ip audit po max-events 100 interface Tunnel1 description Hub Tunnel endpoint ip address 172.18.18.1 255.255.255.0 tunnel source FastEthernet0/0 tunnel destination 161.30.180.252 interface FastEthernet0/0 ip address 12.191.85.83 255.255.255.192 duplex auto speed auto interface FastEthernet0/1 ip address 192.168.100.1 255.255.255.0 duplex auto speed auto router eigrp 100 redistribute static network 172.18.18.0 0.0.0.255 network 192.168.100.0 no auto-summary ip http server no ip http secure-server AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 26 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 Appendix B Continued Cisco Configuration for GRE tunnels for Hughes 9201 UT Terrestrial router ip classless ip route 0.0.0.0 0.0.0.0 12.191.85.65 ip route 172.16.1.0 255.255.255.0 192.168.100.2 line con 0 line aux 0 line vty 0 4 login local end Configuration for Cisco 1720 Client/Remote Router (Hughes 9201 UT) sh run Current configuration : 1549 bytes version 12.3 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption hostname GRE2 boot-start-marker boot-end-marker logging buffered 4096 emergencies mmi polling-interval 60 no mmi auto-configure no mmi pvc mmi snmp-timeout 180 no aaa new-model ip subnet-zero ip dhcp pool local network 192.168.122.0 255.255.255.0 default-router 192.168.122.1 dns-server 151.164.1.8 no ip cef no ip domain lookup ip ips po max-events 100 no ftp-server write-enable username cisco password 0 cisco no crypto isakmp ccm interface Tunnel1 AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 27 of 28 www.aosusa.com 17817 Davenport Rd., Suite 225, Dallas, Tx Tel: +1 972 735 0101 Appendix B Continued Configuration for Cisco 1720 Client/Remote Router (Hughes 9201 UT) description Tunnel Endpoint ip address 172.18.18.2 255.255.255.0 tunnel source FastEthernet0 tunnel destination 12.191.85.83 interface BRI0 no ip address shutdown interface FastEthernet0 ip address 192.168.128.201 255.255.255.0 ip nat outside ip virtual-reassembly duplex auto speed auto interface FastEthernet1 interface FastEthernet2 interface FastEthernet3 interface FastEthernet4 interface Vlan1 ip address 192.168.122.1 255.255.255.0 ip nat inside ip virtual-reassembly router eigrp 100 network 172.18.18.0 0.0.0.255 network 192.168.122.0 network 192.168.128.0 no auto-summary ip classless ip route 0.0.0.0 0.0.0.0 192.168.128.100 ip http server ip http authentication local ip http secure-server ip nat inside source list 99 interface FastEthernet0 overload access-list 99 permit 192.168.122.0 0.0.0.255 control-plane line con 0 line aux 0 line vty 0 4 login local end AOS, Inc. 17817 Davenport Rd., #225 Dallas, Texas USA Proprietary Page 28 of 28 www.aosusa.com