3Com MSR 50 Series, Руководство по настройке

Страница: 1878 / 2443

1878 C
HAPTER
100: IPS
EC
C
ONFIGURATION
■
Authentication header (AH), protocol 51: AH provides data origin
authentication, data integrity, and anti-replay services. It supports message
digest (MD5) and secure hash algorithm (SHA-1). AH is inserted behind the IP
header to ensure data integrity and authenticity, preventing attackers from
intercepting packets or inserting pseudo packets.
■
Encapsulating security payload (ESP), protocol 50: Unlike AH, ESP encrypts user
data before encapsulating it into IP packets to protect data confidentiality. ESP
supports encryption algorithms including DES, 3DES, and AES. As an option,
you can use MD5 and SHA-1 algorithms to protect data integrity and
authenticity.
AH and ESP can be employed independently or in combination. In the
implementation of AH and ESP combination on the device, a packet is
encapsulated first by ESP and then by AH, and therefore a resulting packet
includes the original IP message, ESP header, AH header, and outer IP header (from
inner layer outer).
Basic Concepts of IPSec Security association
IPSec provides secure communication between two ends, which are called IPSec
peers.
Security association (SA) is fundamental to IPSec. An SA is a combination of such
communication aspects as the protocol(s) (AH, ESP or both), encapsulation mode
(transport mode or tunnel mode), encryption algorithm (DES, 3DES, or AES),
shared key used for protection of particular specific flows, and key lifetime.
An SA is unidirectional. Therefore, at least two SAs are needed to protect data
flows in a bidirectional communication. Moreover, if both AH and ESP are used to
protect data flows between peers, each peer will construct an independent SA for
each protocol.
An SA is uniquely identified by a triplet, which consists of the security parameter
index (SPI), destination IP address, and security protocol (AH or ESP).
An SPI is a 32-bit number generated for uniquely identifying an SA. It is
transmitted in the AH/ESP header. A manually configured SA requires an SPI to be
specified manually for it while an IKE created SA will have an SPI generated at
random.
SA lifetime applies to only SAs set up through IKE negotiation and comes in two
types:
■
Time-based lifetime: Defines the duration of an SA, that is, the period after an
SA is created and before it becomes invalid.
■
Traffic-based lifetime: Defines the maximum traffic that an SA is allowed to
process.
An SA becomes invalid when its lifetime expires. Before an SA becomes invalid, IKE
will negotiate to set up a new SA and, once created, the new SA takes over the
responsibility immediately.