UTT Technologies
Chapter 10 VPN
http://www.uttglobal.com
Page
18718718
for more information.
9.5.1.8 Packet Flow – IPSec Responder
As shown in
Figure 11-16 IPSec Packet Flow
, during the IPSec tunnel establishment
and data transmission processes, the packet flow through the IPSec responder can be
summarized as follows:
1. After the IPSec tunnel parameters are configured properly, the new policy is added
into the SPD (2).
2. IKE phase 1 negotiation takes place (started by the initiator), and the IKE SA is
established (4). Refer to section 4.2.1.3 for more information.
3. IKE phase 2 negotiation takes place, and the IPSec SAs are established (5).
4. The responder receives the IPSec protected packets from the initiator, and
authenticates and/or decrypts them (8).
5. The responder forwards the user data (i.e., original packets) to their intend
destinations (9).
6. The responder receives the user data (i.e., original packets), and then uses ESP
and/or AH to protect them (10).
7. The responder sends the IPSec packets to the initiator through the IPSec tunnel (11)
8. The two endpoints renegotiate IPSec SAs as required (14). Refer to section 4.2.1.4
for more information.
Note
In
Manual Key
mode, IKE phase 1 and phase 2 negotiations are not required
because all the necessary SA parameters are defined during the configuration of the
IPSec tunnel.
9.5.1.9MTU and Fragmentation
The UTT VPN gateway will fragment an IP packet if it exceeds the MTU of the
outbound physical interface. For example, a standard Ethernet-type interface has a MTU
of 1500 bytes, thus the UTT VPN gateway will fragment a packet exceeding 1500 bytes in
order to transmit it over the Ethernet interface.
With IPSec, the addition of IPSec headers may cause IP fragmentation. When an IP
packet is nearly the size of MTU of the outbound physical interface (for example, ERP or
FTP packets are often relatively large), and it is further encapsulated with IPSec headers,
the encapsulated packet is likely to exceed the MTU of the outbound physical interface.
This causes the encapsulated packet to be fragmented before transmission, and the
IPSec receiver is responsible for reassembling the fragments back into the original
encapsulated packet before decapsulation (authentication and/or decryption). More
specifically, the receiver cannot perform reassembly until the last fragment is received;
