326
V6100 and V7122 User Guide
Figure 110
IPSec Encryption
IPSec doesn’t function properly if the gateway’s IP address is changed on-the-fly
due to the fact that the crypto hardware can only be configured on reset. Therefore,
reset the gateway after you change its IP address.
IKE
IKE is used to obtain the Security Associations (SA) between peers (the gateway and the
application it’s trying to contact). The SA contains the encryption keys and profile used by the
IPSec to encrypt the IP stream. The IKE table lists the IKE peers with which the gateway
performs the IKE negotiation (up to 20 peers are available).
The IKE negotiation is separated into two phases: main mode and quick mode. The main
mode employs the Diffie-Hellman (DH) protocol to obtain an encryption key (without any prior
keys), and uses a pre-shared key to authenticate the peers. The created channel secures
the messages of the following phase (quick mode) in which the IPSec SA properties are
negotiated.
The IKE negotiation is as follows:
Main mode (the main mode creates a secured channel for the quick mode)
SA negotiation – The peers negotiate their capabilities using four (two for the V6100)
proposals. Each proposal includes three parameters: Encryption method,
Authentication protocol and the length of the key created by the DH protocol. The
key’s lifetime is also negotiated in this stage. For detailed information on configuring
the main mode proposals, see
IKE Configuration
.
Key exchange (DH) – The DH protocol is used to create a phase-1 key.
Authentication – The two peers authenticate one another using the pre-shared key
(configured by the parameter ‘IKEPolicySharedKey’).
Quick mode (quick mode negotiation is secured by the phase-1 SA)
SA negotiation – The peers negotiate their capabilities using four proposals (a single
proposal for the V6100). Each proposal includes two parameters: Encryption method
and Authentication protocol. The lifetime is also negotiated in this stage. For detailed
information on configuring the quick mode proposals, see the SPD table under
IPSec
Configuration
.
Key exchange – a symmetrical key is created using the negotiated SA.
Содержание TP-1610
Страница 28: ...28 V6100 and V7122 User Guide Reader s Notes ...
Страница 48: ...48 V6100 and V7122 User Guide Reader s Notes ...
Страница 72: ...72 V6100 and V7122 User Guide Reader s Notes ...
Страница 80: ...80 V6100 and V7122 User Guide Reader s Notes ...
Страница 151: ...V6100 and V7122 User Guide 151 Figure 83 Log off Prompt 2 Click OK in the prompt the Web session is logged off ...
Страница 152: ...152 V6100 and V7122 User Guide Reader s Notes ...
Страница 262: ...262 V6100 and V7122 User Guide Reader s Notes ...
Страница 284: ...284 V6100 and V7122 User Guide Reader s Notes ...
Страница 291: ...V6100 and V7122 User Guide 291 Figure 95 V7122 Startup Process ...
Страница 324: ...324 V6100 and V7122 User Guide Reader s Notes ...
Страница 354: ...354 V6100 and V7122 User Guide Reader s Notes ...
Страница 374: ...374 V6100 and V7122 User Guide Reader s Notes ...
Страница 382: ...382 V6100 and V7122 User Guide Figure 130 Example of a User Information File Reader s Notes ...
Страница 392: ...392 V6100 and V7122 User Guide Reader s Notes ...
Страница 409: ...V6100 and V7122 User Guide 409 Reader s Notes ...
Страница 413: ...V6100 and V7122 User Guide 413 Reader s Notes ...
Страница 425: ...V6100 and V7122 User Guide 425 Figure 145 UDP2File Utility Reader s Notes ...
Страница 431: ...V6100 and V7122 User Guide 431 Reader s Notes ...
Страница 447: ...V6100 and V7122 User Guide 447 Reader s Notes ...
Страница 449: ...V6100 and V7122 User Guide 449 Figure 146 Connection Module CM Figure 147 OSN Server Figure 148 Hard Drive Module HDMX ...
Страница 483: ...V6100 and V7122 User Guide 483 Reader s Notes ...