UTT Technologies
Chapter 10 VPN
http://www.uttglobal.com
Page
13613613
ESP is used to provide data encryption and/or data authentication service. To use an
IPSec tunnel to protect your data, you can choose different security policies as required.
You can choose AH or ESP to provide authentication service only, or choose ESP to
provide encryption service only. Of course, you can choose ESP together with AH or only
ESP to provide both authentication and encryption services for your data. With IPSec,
most network security designers will choose to provide all of the supported security
services, including data confidentiality, data integrity, data origin authentication, and
anti-replay, for the data, which are currently the highest level of data protection services in
the IP network.
The IPSec architecture is shown in
Figure 11-11 IPSec Architecture
.
Figure 11-11 IPSec Architecture
IPSec supports two methods to create security associations (SAs):
•
The SAs can be created manually by the system administrator, which is called
Manual Key
on the UTT VPN gateway;
•
The SAs can be negotiated and created dynamically by IKE, which is called
AutoKey
(IKE)
on the UTT VPN gateway.
9.5.1.2 IPSec Modes
IPSec has two basic modes of operation: transport mode and tunnel mode. In transport
