Routing
TransPort LR User Guide
84
IPsec
IPsec is a suite of protocols for creating a secure communication link, or IPsec tunnel, between a
host and a remote IP network or between two IP networks across a public network such as the
internet.
TransPort LR devices support to up
32
IPsec tunnels.
IPsec data protection
IPsec protects the data being sent across a public network by providing the following:
Data origin authentication
Authentication of data to validate the origin of data when it is received.
Data integrity
Authentication of data to ensure it has not been modified during transmission.
Data confidentiality
Encryption of data sent across the IPsec tunnel to ensure that an unauthorized device cannot
read the data.
Anti-Replay
Authentication of data to ensure an unauthorized device has not injected it into the IPsec tunnel.
IPsec modes
IPsec can run in two different modes:
Tunnel
and
Transport
.
Currently, TransPort LR devices support tunnel mode only.
Tunnel
The entire IP packet is encrypted and/or authenticated and then encapsulated as the payload in
a new IP packet.
Transport
Only the payload of the IP packet is encrypted and/or authenticated. The IP header is left
untouched. This mode has limitations when using an authentication header, because the IP
addresses in the IP header cannot be translated (for example, with Network Address Translation
(NAT), as it would invalidate the authentication hash value.
Internet Key Exchange (IKE) settings
IKE is a key management protocol is used by IPsec to negotiate the security associations (SAs) that
are used to create the secure IPsec tunnel.
SA negotiations are perfomed in two phases, known as
phase 1
and
phase 2
.
Phase 1
In phase 1, IKE creates a secure authenticated communication channel between the device and the
peer (the remote device which is at the other end of the IPsec tunnel) using the configured pre-
shared key and the Diffie-Hellman key exchange. This creates the IKE SAs that are used to encrypt
further IKE communications.
There are two modes for the phase 1 negotiation:
Main mode
and
Aggressive mode
.
Main mode
Main mode is the default mode. It is slower that aggressive mode, but more secure, in that all
sensitive information sent between the device and its peer is encrypted.
Aggressive mode
