NetModule NB3711, User Manual

Page: 97 / 214

NB3711 User Manual 4.0
5.6.2. IPsec
IPsec is a protocol suite for securing IP communications by authenticating and encrypt-
ing each packet of a communication session and thus establishing a secure virtual private
network.
IPsec includes various cryptographic protocols and ciphers for key exchange and data
encryption and can be seen as one of the strongest VPN technologies in terms of security.
It uses the following mechanisms:
Mechanism Description
AH Authentication Headers (AH) provide connectionless integrity and data origin
authentication for IP datagrams and ensure protection against replay attacks.
ESP Encapsulating Security Payloads (ESP) provide confidentiality, data-origin
authentication, connectionless integrity, an anti-replay service and limited
traffic-flow confidentiality.
SA Security Associations (SA) provide a secure channel and a bundle of algo-
rithms that provide the parameters necessary to operate the AH and/or ESP
operations. The Internet Security Association Key Management Protocol
(ISAKMP) provides a framework for authenticated key exchange.
Negotating keys for encryption and authentication is generally done by the Internet Key
Exchange protocol (IKE) which consists of two phases:
Phase Description
IKE
phase
1 IKE authenticates the peer during this phase for setting up an ISAKMP se-
cure association. This can be carried out by either using
main
or
aggressive
mode. The
main
mode approach utilizes the Diffie-Hellman key exchange and
authentication is always encrypted with the negotiated key.The
aggressive
mode just uses hashes of the pre-shared key and therefore represents a less-
secure mechanism which should generally be avoided as it is prone to dictio-
nary attacks.
IKE
phase
2 IKE finally negotiates IPSec SA parameters and keys and sets up matching
IPSec SAs in the peers which is required for AH/ESP later on.
Administration
This page can be used to enable/disable IPsec, you may also specify whether NAT-
Traversal should be used.
NAT-Traversal is mainly used for connections which traverse a path where a router
97