UTT Technologies
Chapter 10 VPN
http://www.uttglobal.com
Page
18518518
Figure 11-14 Viewing IPSec Security Policy
3. Trigger Way
The PPTP virtual interface is triggered by the IP route. However, the IPSec virtual
interface is triggered by the security policy in the Security Policy Database (SPD). The
IPSec module starts outbound packet processing after the IP module has processed the
packet, and completes inbound packet processing before the IP module receives the
packet. By changing the execution order of triggers, you can implement IPSec over PPTP
or PPTP over IPSec on the gateway to provide the most powerful VPN functionality.
When the UTT VPN gateway receives an outbound packet that requires IPSec protection
and the IPSec tunnel is not established, it will initiate IKE negotiation to establish a pair of
IPSec SAs (that is, an IPSec tunnel). After the IPSec tunnel is established, the UTT VPN
gateway will do the required IPSec processing (e.g., encryption and/or authentication)
before sending the packet to the remote endpoint through the tunnel; and the remote
endpoint will do the required IPSec processing (e.g., authentication and/or decryption)
before sending the packet to its intend destination.
In the CLI, you can use the
show crypt ipsec sa
command to check if the IPSec tunnel is established.
As shown in
Figure 11-15 Viewing IPSec SAs
, “total: 1 SAs active” means that there is a pair of
active SAs now, in other words, there is an IPSec tunnel established.
Figure 11-15 Viewing IPSec SAs
Note
For a dynamic-to-static or static-to-dynamic IPSec tunnel with IKE aggressive mode,
the IPSec endpoint with a static IP address cannot initiate IKE negotiation because it
doesn’t know where to send request; therefore, it will only act as a responder, and the
IPSec endpoint with a dynamic IP address will only act as an initiator.
