D-Link 800 - DFL 800 - Security Appliance, User Manual

Page: 332 / 469

9.3. IPsec Components
9.3.1. Overview
Internet Protocol Security (IPsec) is a set of protocols defined by the Internet Engineering Task
Force (IETF) to provide IP security at the network layer. An IPsec based VPN is made up of two
parts:
• Internet Key Exchange protocol (IKE)
• IPsec protocols (AH/ESP/both)
The first part, IKE, is the initial negotiation phase, where the two VPN endpoints agree on which
methods will be used to provide security for the underlying IP traffic. Furthermore, IKE is used to
manage connections, by defining a set of Security Associations, SAs, for each connection. SAs are
unidirectional, so there are usually at least two for each IPsec connection.
The second part is the actual IP data being transferred, using the encryption and authentication
methods agreed upon in the IKE negotiation. This can be accomplished in a number of ways; by
using IPsec protocols ESP, AH, or a combination of both.
The flow of events can be briefly described as follows:
• IKE negotiates how IKE should be protected
• IKE negotiates how IPsec should be protected
• IPsec moves data in the VPN
The following sections will describe each of these stages in detail.
9.3.2. Internet Key Exchange (IKE)
This section describes IKE, the Internet Key Exchange protocol, and the parameters that are used
with it.
Encrypting and authenticating data is fairly straightforward, the only things needed are encryption
and authentication algorithms, and the keys used with them. The Internet Key Exchange (IKE)
protocol, IKE, is used as a method of distributing these "session keys", as well as providing a way
for the VPN endpoints to agree on how the data should be protected.
IKE has three main tasks:
• Provide a means for the endpoints to authenticate each other
• Establish new IPsec connections (create SA pairs)
• Manage existing connections
Security Associations (SAs)
IKE keeps track of connections by assigning a set of Security Associations, SAs, to each connection.
An SA describes all parameters associated with a particular connection, such as the IPsec protocol
used (ESP/AH/both) as well as the session keys used to encrypt/decrypt and/or authenticate/verify
the transmitted data.
An SA is unidirectional and relates to traffic flow in one direction only. For the bidirectional traffic
that is usually found in a VPN, there is therefore a need for more than one SA per connection. In
most cases, where only one of ESP or AH is used, two SAs will be created for each connection, one
9.3. IPsec Components Chapter 9. VPN
332