Appendix G - IPSEC
374
BLACK BOX
®
Advanced Console Server
Using IPsec to create a VPN
A VPN, or Virtual Private Network lets two networks communicate securely when the only
connection between them is over a third network which they do not trust.
The method is to put a security gateway machine between each of the communicating net-
works and the untrusted network. The gateway machines encrypt packets entering the
untrusted net and decrypt packets leaving it, creating a secure tunnel through it.
The Authentication
A complication, which applies to any type of connection, is that a secure connection cannot
be created magically. There must be some mechanism which enables the gateways to reliably
identify each other. Without this, they cannot sensibly trust each other and cannot create a
genuinely secure link.
In the BLACK BOX
®
Advanced Console Server IPsec implementation there are two methods
of authentication:
1.
A shared secret provides authentication. If Alice and Bob are the only ones who know a
secret and Alice receives a message which could not have been created without that
secret, then Alice can safely believe the message came from Bob.
2.
A public key or RSA authentication can also provide authentication. If Alice receives a
message signed with Bob's private key (which of course only he should know) and she
has a trustworthy copy of his public key (so that she can verify the signature), then she
can safely believe the message came from Bob.
The Encryption
In a tunnel, the two system must have a common key that they will use to encrypt and
decrypt the packages. The key for the encryption can be provided in two ways:
Maual keying
The two ends share a secret key to encrypt their message. Of
course, if an enemy gets the key, all is lost. The BLACK BOX
®
Advanced Console Server IPsec implementation does not
support manual keying.
Automatic keying
The two systems authenticate each other and negotiate their
own secret key. The key are automatically changed periodically.
