VigorFly 210 Series User’s Guide
99
3
3
.
.
8
8
.
.
3
3
I
I
P
P
S
S
e
e
c
c
G
G
e
e
n
n
e
e
r
r
a
a
l
l
S
S
e
e
t
t
u
u
p
p
In
IPSec General Setup,
there are two major parts of configuration.
There are two phases of IPSec.
Phase 1: negotiation of IKE parameters including encryption, hash, Diffie-Hellman
parameter values, and lifetime to protect the following IKE exchange, authentication of
both peers using a Pre-Shared Key. The peer that starts the negotiation proposes all its
policies to the remote peer and then remote peer tries to find a highest-priority match
with its policies. Eventually to set up a secure tunnel for IKE Phase 2.
Phase 2: negotiation IPSec security methods including Authentication Header (AH) or
Encapsulating Security Payload (ESP) for the following IKE exchange and mutual
examination of the secure tunnel establishment.
There are two encapsulation methods used in IPSec,
Transport
and
Tunnel
. The
Transport
mode will add the AH/ESP payload and use original IP header to encapsulate the data payload
only. It can just apply to local packet, e.g., L2TP over IPSec. The
Tunnel
mode will not only
add the AH/ESP payload but also use a new IP header (Tunneled IP header) to encapsulate the
whole original IP packet.
Authentication Header (AH) provides data authentication and integrity for IP packets passed
between VPN peers. This is achieved by a keyed one-way hash function to the packet to create
a message digest. This digest will be put in the AH and transmitted along with packets. On the
receiving side, the peer will perform the same one-way hash on the packet and compare the
value with the one in the AH it receives.
Encapsulating Security Payload (ESP) is a security protocol that provides data confidentiality
and protection with optional authentication and replay detection service.
Available settings are explained as follows:
Item Description
Local Network/Mask
Type the IP address with subnet mask of the host.
IKE Authentication
Method
This usually applies to those are remote dial-in user or node
(LAN-to-LAN) which uses dynamic IP address and
IPSec-related VPN connections such as L2TP over IPSec
and IPSec tunnel.
Pre-Shared Key-
Specify a key for IKE authentication.
Содержание VigorFly 210
Страница 1: ......
Страница 8: ......
Страница 46: ...VigorFly 210 Series User s Guide 38 7 Click OK Now you have finished the product registration ...
Страница 180: ...VigorFly 210 Series User s Guide 172 This page is left blank ...
Страница 184: ...VigorFly 210 Series User s Guide 176 ...
