Proroute
GEM
2M
4G
Router
GEM-2M series User Manual
84
3.2.3.2 IPSec
Internet Protocol Security (IPSec) is a protocol suite for securing Internet Protocol (IP)
communications by authenticating and encrypting each IP packet of a communication
session. IPSec includes protocols for establishing mutual authentication between agents
at the beginning of the session and negotiation of cryptographic keys to be used during
the session.
An IPSec VPN tunnel is established between IPSec client and server. Sometimes, we call
the IPSec VPN client as the initiator and the IPSec VPN server as the responder. There
are two phases to negotiate between the initiator and responder during tunnel
establishment, IKE phase and IPSec phase. At IKE phase, IKE authenticates IPSec peers
and negotiates IKE SAs (Security Association) during this phase, setting up a secure
channel for negotiating IPSec SAs in phase 2. At IPSec phase, IKE negotiates IPSec SA
parameters and sets up matching IPSec SAs in the peers. After these both phases, data is
transferred between IPSec peers based on the IPSec parameters and keys stored in the
SA database.
3.2.3.2.1 IPSec VPN Tunnel Scenarios
There are some common IPSec VPN connection scenarios as follows:
Site to Site
The device establishes IPSec VPN tunnels with security gateway in headquarters
or branch offices. Either local or remote peer gateway which can be recognized by
a static IP address or a FQDN can initiate the establishing of an IPSec VPN tunnel
.
Two peers of the tunnel have their own Intranets and the secure tunnel serves for
data communication between these two subnets of hosts.
Dynamic
VPN
Business Security Gateway can ignore IP information of clients when using
Dynamic VPN, so it is suitable for users to build VPN tunnels with Business
Security Gateway from a remote mobile host or mobile site. Remote peer is a host
or a site will be indicated in the negotiation packets, including what remote subnet
