Page 10 - Overview of Secure VPN Implementation
If the unprotected packet matches a condition for which there is not an established SA
then IP Office will initiate IPSec tunnel establishment (ISAKMP) to the specified remote
gateway. Once the tunnel is established the packet is encrypted and forwarded to the
appropriate interface. In this way, an inbound unprotected packet serves as the trigger
mechanism for IPSec tunnel establishment.
The other case for a packet arriving on an interface is where the packet is an IPSec
packet type. There are two types:
1. ISAKMP - used to establish the tunnel and thereby form the SA.
2. ESP - used to carry the encrypted data.
If the received IPSec packet is an ESP addressed to the IP Office, then IP Office will
check for a valid SA. If a valid SA is found then the packet is decrypted and forwarded.
If not, the ESP packet is discarded.
Yes
Decrypt packet
ESP
Forward packet
(ESP)
Close connection
ISAKMP
No
Listen for IPSec
Check IPSec
packet type
Check for valid
Security Association
(SA)
No
Drop packet
Setup IPSec
Security
Association
established
Is there is a source
address match on
the IPSec list?
Is IPSec mode
established?
Yes
No
Yes
Figure 5. Inbound Unprotected Packet Type Detection
Page 10 - Overview of Secure VPN Implementation
IP Office (R3.0)
IPSec Implementation
40DHB0002UKER Issue 3 (4th February 2005)
