Draytek Vigor3300 Series, Руководство пользователя, Страница: 108 / 213

Vigor3300 Series User’s Guide
102
such as X.509 and DHCP over Internet Protocol Security (IPSec). This VPN feature is only
supported for Vigor 3300, Vigor3300V routers. IPSec is the security architecture for IP
networks. IPSec provides security services at the IP layer by enabling a system to select
required security protocols. It determines the algorithms to use for the services, and puts in
place any cryptographic keys required to provide the requested services. IPSec can be used to
protect one or more "paths" between a pair of hosts, between a pair of security gateways, or
between a security gateway and a host.
The Vigor3300 Series supports ESP Tunnel mode with IKE for key management. Internet Key
Exchange (IKE) Protocol, a key protocol in the IPSec architecture, is a hybrid protocol using
part of Oakley and part of SKEME in conjunction with ISAKMP to obtain authenticated
keying material for use with ISAKMP, and for other security associations such as AH and ESP
for the IPsec DOI.
3
3
.
.
6
6
.
.
1
1
I
I
P
P
S
S
e
e
c
c
The IPSec services can provide access control, connectionless integrity, data origin
authentication, rejection of replayed packets that is a form of partial sequence integrity, and
confidentiality by encryption. These objectives are met through the use of two traffic security
protocols, the Authentication Header (AH) and the Encapsulating Security Payload (ESP), and
through the use of cryptographic key management procedures and protocols.
G
G
e
e
n
n
e
e
r
r
a
a
l
l
S
S
e
e
t
t
u
u
p
p
General Setup allows you to set MTU value for VPN. The default number is 1400.
P
P
o
o
l
l
i
i
c
c
y
y
T
T
a
a
b
b
l
l
e
e
To create a VPN IPSec policy, click the Policy Table option under the IPSec menu.