VPN configuration task list
283
SmartWare Software Configuration Guide
25 • VPN configuration
Transport and tunnel modes
The mode determines the payload of the ESP packet and hence the application:
•
Transport mode: Encapsulates only the payload of the original IP packet, but not its header, so the IPsec
peers must be at the endpoints of the communications link.
•
A secure connection between two hosts is the application of the transport mode.
•
Tunnel mode: Encapsulates the payload and the header of the original IP packet. The IPsec peers can be
(edge) routers that are not at the endpoints of the communications link.
A secure connection of the two (private) LANs, a ‘tunnel’, is the application of the tunnel mode.
Key management
The current implementation of IP works with pre-shared keys (also called manual keying or manual IPsec) or
using Internet Key Exchange (IKE). Keys are manually generated, distributed, and stored as a hexa-decimal
string in the startup-configuration of the SmartNode and its peer.
Note
Depending on the processing hardware applied to reverse engineering a DES
key, it can take from 3 hours to 3 days to break the key. Thus, for maximum
security, DES keys must be manually updated regularly. AES- or 3DES-keys,
because they are much more complex, take so much longer to break as to be
practically infinite.
The automatically keyed IPSEC connections using the Internet Key Exchange (IKE / RFC2409) protocol that
is based on Internet Security Association and Key Management Protocol (ISAKMP / RFC2408) is the other
option. IKE supports authentication using pre-shared keys. There is currently no support for authentication
using Public Key Infrastructure (PKI) and digital certificates.
VPN configuration task list
To configure a VPN connection, perform the following tasks:
•
Creating an IPsec transformation profile
•
Creating an IPsec policy profile
•
Creating/modifying an outgoing ACL profile for IPsec
•
Configuration of an IP Interface and the IP router for IPsec
•
Displaying IPsec configuration information
•
Debugging IPsec
Creating an IPsec transformation profile
The IPsec transformation profile defines which authentication and/or encryption protocols, which authentica-
tion and/or encryption algorithms shall be applied.
Procedure:
To create an IPsec transformation profile
