Juniper JUNOSE 11.2.X IP SERVICES, Configuration Manual

Page: 156 / 356

A transform set includes encapsulation protocols and transforms; for example,
encryption/decryption/authentication algorithms. These parameters are grouped to
specify the acceptable protection for a given data flow. Many transform sets are
supported, since different traffic requires distinct security levels.
A secure IP tunnel is associated with one transform set. Multiple secure IP tunnels can
refer to the same transform set.
Changing existing transform sets affects only future user SA negotiations. User SAs that
are already established remain valid and do not use the changed transform set until they
are renegotiated.
For manually configured secure IP tunnels, the associated transform set must contain a
single transform option.
Encapsulation Protocols
Both the AH and ESP protocols are supported. See supported transforms in Table 11 on
page 130.
•
AH provides authentication.
• ESP provides data confidentiality and antireplay functions. ESP can also provide data
authentication; although, in this implementation, ESP does not cover the outer IP
header.
Encapsulation Modes
IPSec supports two encapsulation modes—tunnel mode and transport mode. Tunnel
mode creates a second IP header in the packet and uses both the local and remote
security gateway addresses as source and destination IP addresses. Also, tunnel mode
allows an IP interface to be created and stacked right above it.
Transport mode does not add a second IP header and does not allow an IP interface to
be created and stacked right above it. Instead, transport mode allows other tunneling
applications, such as an L2TP tunnel, to be created and stacked on top of an IPSec
transport mode connection. See “Securing L2TP and IP Tunnels with IPSec” on page 275
for a description of L2TP transport mode.
Supported Transforms
Table 11 on page 130 describes the supported transforms.
Table 11: Supported Transforms
Description Transform
IPSec performs AH protocol encapsulation using the MD5 hash function with
HMAC message authentication. AH-MD5
IPSec performs AH protocol encapsulation using the SHA-1 hash function with
HMAC message authentication. SHA-1 is considered stronger than MD5. AH-SHA
IPSec performs ESP protocol encapsulation using the MD5 hash function with
HMAC message authentication. ESP-MD5
Copyright © 2010, Juniper Networks, Inc. 130
JunosE 11.2.x IP Services Configuration Guide