GE MDS ORBIT ECR, Technical Manual

Page: 248 / 463

248 MDS Orbit MCR/ECR Technical Manual MDS 05-6632A01, Rev. F
The first part, IKE, is the initial negotiation phase, where the Orbit device and VPN gateway agree on
which methods will be used to provide security for the underlying IP traffic. There are two IKE protocol
versions: IKE-v1 and IKE-v2. These are not compatible with each other. The IKE-v2 is more efficient
and therefore should be preferred for new deployments. The MCR supports IKE-v1 and IKE-v2.
The other part is the actual IP data being transferred, using the encryption and authentication methods
agreed upon in the IKE negotiation. This is accomplished by using IPsec protocols like Encapsulating
Security Payload (ESP) or Authentication Header (AH). Orbit MCR only supports ESP protocol as it
provides both encryption and authentication of the data. The AH protocol provides only data
authentication.
The process of IPsec VPN connection establishment consists of following phases:

IKE Phase-1 (IKE security negotiation)
- IKE authenticates IPSec peers and negotiates IKE Security Association (SAs) during this
phase, setting up a secure channel for negotiating IPSec SAs in phase 2

IKE Phase-2 (IPsec Security Association)
- IKE negotiates IPSec SA parameters and sets up matching IPSec SAs in the peers

Data Transfer
- Data is transferred between IPSec peers based on the IPSec parameters and keys stored in the
SA database
Both the IKE and the IPsec connections have limited lifetimes. These lifetimes prevent a connection from
being used too long, which is desirable from a cryptanalysis perspective.
The IPsec lifetime is generally shorter than the IKE lifetime. This allows for the IPsec connection to be
re-keyed simply by performing another phase-2 negotiation.
Configuration
Site-to-Site IPsec VPN Configuration
The Figure 3-166 below shows a site-to-site policy-based IPsec VPN setup to securely connect remote
private network (LAN or WiFi) with the customer’s backoffice/data center private network. This enables
IP traffic from/to devices connected to either LAN, WiFi or Serial port of the Orbit to securely flow
to/from back-office applications via a secure tunnel through a public cellular network. The tunneled
application traffic is authenticated and encrypted to protect from eavesdropping, tampering and replay
attacks.