Model 9289
Spectracom Corporation
NetClock/NTP Network Time Provider Instruction Manual
3-90
3.4.20 Configuring IPSec
Internet Protocol Security (IPSec) is a suite of IP protocols that authenticates and encrypts
network communications. IPSec supports IPv6 and IPv4 as of this writing.
IPSec defines a Security Association (SA), consisting of secured communications between two
network devices. Configuring IPSec requires us to define SA Policy (SAP) and SA Descriptors
(SAD). SAP determines what network traffic can or must be secured through IPSec. SAD
describes actively secured conversations. All network traffic for an SA contains an identical
Security Parameter Index (SPI).
3.4.20.1 AH vs. ESP
An Authentication Header (AH) and an Encapsulating Security Payload (ESP) are the primary
protocols used by IPSec. They authenticate (AH) or authenticate and encrypt (ESP) the data
across that connection. Typically, they are used independently, but it is possible to use them
together. The NetClock supports both protocols.
3.4.20.2 Transport Mode vs. Tunnel Mode
Transport mode provides a secure connection between two endpoints by encapsulating the IP
payload. Tunnel mode encapsulates the entire IP packet/
NOTE:
Tunnel mode is used to form a traditional Virtual Private Network (VPN), in which the
tunnel creates a secure path across a distrusted Internet connection. The NetClock
supports
Transport mode ONLY.
3.4.20.3 MD5 vs. SHA-1 vs. DES vs. 3DES vs. AES
An IPSec connection can use two or three encryption choices from among those available.
Authentication calculates an Integrity Check Value (ICV) over the data packet’s contents. It is
usually built on a hash algorithm (for example, MD5 or SHA-1). It uses a secure key known to
both endpoints, allowing the recipient to compute the ICV as the sender has computed it. If the
recipient gets the same value, the sender has effectively authenticated itself.
3.4.20.4 IKE vs. Manual Keys
To communicate, the devices at both endpoints must possess the same secure keys. Keys can
be entered manually. They may also be generated dynamically between two hosts through
Internet Key Exchange (IKE). The NetClock supports both IKE and manual keys.
3.4.20.5 Main Mode vs. Aggressive Mode
The initial IKE exchange may be efficient or it may be secure. This tradeoff is governed by the
exchange mode, Main or Aggressive. Main mode is completely secure and requires six packets
to be sent between the two devices. Aggressive mode requires only three packets be sent
between the two devices, but it is less secure.
NOTE:
The NetClock supports both Main and Aggressive modes. Aggressive mode is NOT
recommended because of the security risks involved.
Summary of Contents for 9289
Page 18: ...Model 9289 Spectracom Corporation NetClock NTP Network Time Provider Instruction Manual 1 8...
Page 36: ...Model 9289 Spectracom Corporation NetClock NTP Network Time Provider Instruction Manual 2 18...
Page 154: ...Model 9289 Spectracom Corporation NetClock NTP Network Time Provider Instruction Manual 3 118...
