RACOM RipEX, User Manual

Page: 166 / 234

Symmetrical cryptography is used to encrypt the packets. The symmetric keys must be safely
delivered to the peer. In order to maintain a secure connection, symmetric keys must be regularly
exchanged. The protocol used for secure key exchange is IKE (Internet Key Exchange). Both
IKE version 1 and the newer version 2 are available.
IKE protocol communication with the peer is established using UDP frames on port 500. However,
if the NAT-T (NAT Traversal) or MOBIKE (MOBile IKE) are active, the UDP port 4500 is used.
The IPsec tunnel is provided by Security Association (SA). There are 2 types of SA:
•
IKE SA: IKE Security Association providing SA keys exchange with the peer.
• CHILD SA: IPsec Security Association providing packet encryption.
Every IPsec tunnel contains 1 IKE SA and at least 1 CHILD SA.
Link partner (peer) secure authentication is assured using Pre-Shared Key (PSK) authentication
method: Both link partners share the same key (password).
As and when the CHILD SA expires, new keys are generated and exchanged using IKE SA.
As and when the IKE SA version IKEv1 expires - new authentication and key exchange occurs
and a new IKE SA is created. Any CHILD SA belonging to this IKE SA is/are re-created as well.
As and when the IKE SA version IKEv2 expires one of two different scenarios might occur:
•
If the re-authentication is required - the behavior is similar to IKEv1 (see above).
• It the re-authentication is not required - only new IKE SA keys are generated and exchange
■ IPsec in relation to other RipEX services
IPsec cannot be used in Bridge mode.
Any user defined firewall filtering is active prior to IPsec encryption and after IPsec decryption.
IPsec can be routed via the radio channel . The radio IP address or ETH IP address can be
used as a "Peer address".
IPsec can operate concurrently with IP optimization . The traffic is either forwarded to the IPsec
or the optimization module.
IPsec can be routed via the Backup routes (BRMP) . This happens when the "Peer address"
is routed using a routing rule with the backup route defined.
IPsec can be used to cooperate with the TCP Proxy . In this case, the packet is captured by
TCP Proxy first, encapsulated to UDP frame and then forwarded to the IPsec. The peer side
process works in reverse.
IPsec can be used together with the SLIP protocol (COM interface, terminal server). The IPsec
tunnel can be configured through the SLIP tunnel and user traffic can be routed to this tunnel.
IPsec can build a connection via VLAN or subnet . A corresponding source address must be
selected.
IPsec also functions in HotStandby mode. When in passive mode, IPsec is turned off. IPsec is
started on transition to active mode. New SA (security associations) are opened. On the peer
side: the new SA replaces the SA belonging to the RipEX which has transitioned to passive
mode.
RipEX Radio modem & Router – © RACOM s.r.o. 166
Advanced Configuration