Cyclades AlterPath ACS, Справочник по командам

Страница: 149 / 420

AlterPath ACS Command Reference Guide
133
Network
4.10 VPN Configuration
The IPSec protocol provides encryption and authentication services at the IP level of the
network protocol stack. Working at this level, IPSec can protect any traffic carried over
IP, unlike other encryption which generally protects only a particular higher-level
protocol (PGP for mail, SSH for login, SSL for Web work and so on). The
implementation of IPSec used by the ACS is Openswan 2.3.0.
IPsec can be used on any machine which does IP networking. Dedicated IPsec gateway
machines can be installed wherever required to protect traffic. IPsec can also run on
routers, on firewall machines, on various application servers, and on end-user desktop
or laptop machines.
IPsec is used mainly to construct a secure connection (tunnel) between two networks
(ends) over a not-necessarily-secure third network. In our case, the IPsec will be used to
connect the ACS securely to a host or to a whole network configurations frequently
called host-to-network and host-to-host tunnel. Considering practical aspects, this is the
same thing as a VPN, but here one or both sides have a degenerated subnet (only one
machine).
Applications of IPsec
Because IPsec operates at the network layer, it is remarkably flexible and can be used to
secure nearly any type of Internet traffic.
Two applications, however, are extremely widespread:
•
A Virtual Private Network, or VPN, allows multiple sites to communicate with the
Console Server securely over an insecure Internet by encrypting all
communication between the sites and the Console Server.
•
Road Warriors connect to the Console Server from home, or perhaps from a hotel
somewhere.
A somewhat more detailed description of each of these applications is below. Our Quick
Start section will show you how to build each of them.
Using secure tunnels to create a VPN
A VPN, or Virtual Private Network lets the Console Server and a whole network
communicate securely when the only connection between them is over a third network
which is not trustable. The method is to put a security gateway machine in the network
and create a security tunnel between the Console Server and this gateway. The gateway
machine and the Console Server encrypt packets entering the untrusted net and decrypt
packets leaving it, creating a secure tunnel through it.