Nortel BSR222, Configuration, Page: 209 / 451

Chapter 13 VPN 209
Nortel Business Secure Router 222 Configuration — Basics
Outside header : The outside IP header contains the destination IP address of the
VPN switch.
Inside header : The inside IP header contains the destination IP address of the
final system behind the VPN switch. The security protocol appears after the outer
IP header and before the inside IP header.
IPSec and NAT
Read this section if you are running IPSec on a host computer behind the Business
Secure Router.
NAT is incompatible with the AH protocol in both Transport and Tunnel mode.
An IPSec VPN using the AH protocol digitally signs the outbound packet, both
data payload and headers, with a hash value appended to the packet. When using
AH protocol, packet contents (the data payload) are not encrypted.
A NAT device in between the IPSec endpoints rewrites either the source or
destination address with one of its own choosing. The VPN device at the receiving
end verifies the integrity of the incoming packet by computing its own hash value,
and complains that the hash value appended to the received packet does not
match. The VPN device at the receiving end does not know about the NAT in the
middle, so it assumes that the data was maliciously altered.
IPSec using ESP in Tunnel mode encapsulates the entire original packet
(including headers) in a new IP packet. The new IP packet's source address is the
outbound address of the sending VPN switch, and its destination address is the
inbound address of the VPN device at the receiving end. When using
ESP
protocol with authentication, the packet contents (in this case, the entire original
packet) are encrypted. The encrypted contents, but not the new headers, are signed
with a hash value appended to the packet.