HP 10500 series, Security Configuration Manual

Page: 292 / 596

278
algorithms such as DES, 3DES, and AES, and authentication algorithms HMAC-MD5 and
HMAC-SHA1.
Both AH and ESP provide authentication services, but the authentication service provided by AH is
stronger. In practice, you can choose either or both security protocols. When both AH and ESP are
used, an IP packet is encapsulated first by ESP and then by AH.
Encapsulation modes
IPsec supports the following encapsulation modes:
•
Transport mode —The security protocols protect the upper layer data of an IP packet. Only the
transport layer data is used to calculate the security protocol headers. The calculated security
protocol headers and the encrypted data (only for ESP encapsulation) are placed after the
original IP header. You can use the transport mode when end-to-end security protection is
required (the secured transmission start and end points are the actual start and end points of
the data). The transport mode is typically used for protecting host-to-host communications, as
shown in
Figure 84 .
Figure 84 IPsec protection in transport mode
•
Tunnel mode —The security protocols protect the entire IP packet. The entire IP packet is used
to calculate the security protocol headers. The calculated security protocol headers and the
encrypted data (only for ESP encapsulation) are encapsulated in a new IP packet. In this mode,
the encapsulated packet has two IP headers. The inner IP header is the original IP header. The
outer IP header is added by the network device that provides the IPsec service. You must use
the tunnel mode when the secured transmission start and end points are not the actual start and
end points of the data packets (for example, when two gateways provide IPsec but the data
start and end points are two hosts behind the gateways). The tunnel mode is typically used for
protecting gateway-to-gateway communications, as shown in
Figure 85 .
Figure 85 IPsec protection in tunnel mode
Figure 86 shows how the security protocols encapsulate an IP packet in different encapsulation
modes.
Figure 86 Security protocol encapsulations in different modes
Host A
Host B
Data flow
IPsec tunnel
Host A
Host B
Gateway A Gateway B
Data flow
IPsec tunnel
Mode
Protocol
Transport Tunnel
AH
ESP
AH-ESP ESP-T IP Data ESP AH IP
ESP-T IP Data ESP IP
IP Data AH IP IP Data AH
ESP-T IP Data ESP
ESP-T IP Data ESP AH