IPSec
IPSec VPN Concepts
network. Tunneling is done by encapsulating and decapsulating data and information of the particular protocol within
the incompatible transmission units symmetrically. IPSec protocol sets define the processes, which is the Tunnel
Mode we will introduce later (See ""), to deliver encryption protected data between incompatible networks by tunneling
through an intermediate network. IPSec offers another option to deliver protected data end-to-end without tunneling,
which is called Transport Mode (See ""). It provides the flexibility to integrate other tunneling protocols with IPSec to
establish a VPN network.
Secure data transmission
IPSec employs encryption and authentication of data packets for VPN transmission to ensures that any third-party
from public network who intercepts the packets can not access the data and impersonate each endpoint. It protects
the communications between two endpoints against malicious attacks from intermediate, untrusted network, so that
privacy and authenticity are guaranteed to the communications. However, it is concerned that how the two endpoints
securely share the encryption and authentication methods, and the correspondent secret key without compromising
them to others. This is the major object that IPSec functions for. Once these security parameters are shared securely
between the two entities, which is called a establishment of Security Association (See ""), the privacy and
authentication of data transmission are guaranteed.
Basic IPSec VPN scenario
To connect two incompatible networks within an IPSec VPN network over an intermediate network, an IPSec VPN
device is required to be deployed in front of each the network. The IPSec VPN devices (the FortiWAN units) establish
an IPSec VPN tunnel with each other. Each of the IPSec VPN devices performs the processes to encrypt and
encapsulate, or decapsulate and decrypt the incoming packets (from the network behind it or the opposite IPSec VPN
device), and then forwards the packets to the destination (the opposite IPSec VPN device or the network behind it).
The two incompatible networks, therefore, have the secure access to each other through the two IPSec VPN devices
(the IPSec VPN tunnel established between the two devices). A host in the network communicates with a opposite
host (in the opposite network) without running any IPSec VPN software; what they do is like performing a
communication in the same network as usual. All the processes and details for a IPSec VPN communication are taken
by the two IPSec VPN devices; hosts are not aware of this. The IPSec VPN devices are so-called IPSec VPN gateways,
and this is the typical site-to-site VPN.
VPN tunnel between two private networks
172
FortiWAN Handbook
Fortinet Technologies Inc.
