ORiNOCO BG-2000, User Manual

Page: 80 / 128

Virtual Private Networks
8-2
■
IP Security (IPSec - RFC 2401, RFC 2402, RFC 2406).
■
Point-to-Point Tunneling Protocol (PPTP - RFC 2637).
■
Layer 2 Tunneling Protocol (L2TP - RFC 2661).
IPSec Overview
IP Security (IPSec) protects IP traffic with two protocols, Authentication
Header (AH), and Encapsulating Security Payload (ESP). AH integrity
ensures data integrity by authenticating a packet’s IP header and payload. If
a system intruder alters an IP packet and replays it, the intended recipient is
made aware by AH that the packet underwent modification during
transmission.
ESP confidentiality guarantees data confidentiality by encrypting IP packets
so that intruders can’t decode them. ESP confidentiality is mandatory in
IPSec. The difference between AH integrity and ESP integrity is that ESP
integrity does not authenticate IP headers. ESP integrity is an option in
IPSec implementation and can be used with ESP confidentiality for high
security. However, if you use Network Address Translation (NAT) to
translate your private IP addresses into Internet addresses, you can only
use ESP integrity because AH integrity manipulates IP headers, while ESP
integrity does not.
IPSec operates in transport and tunnel mode. In transport mode, AH or ESP
resides in the original IP packet between the IP header and upper-layer
extension header information. IPSec uses transport mode to provide end-
to-end security between two end systems. For example, between a
Windows 2000 workstation and a Windows 2000 server. In tunnel mode,
IPSec places an original IP packet in a new IP packet and inserts AH or