HP MSR SERIES, Руководство по настройке

Страница: 367 / 889

350
Configuring IPsec VPN
You can perform the following IPsec VPN configurations in the Web interface:
• Configure an IPsec connection.
•
Display IPsec VPN monitoring information.
Overview
IP Security (IPsec) is a security framework defined by the IETF for securing IP communications. It is a Layer
3 VPN technology that transmits data in a secure tunnel established between two endpoints.
IPsec provides the following security services in insecure network environments:
• Confidentiality —The sender encrypts packets before transmitting them over the Internet, protecting
the packets from being eavesdropped en route.
•
Data integrity —The receiver verifies the packets received from the sender to ensure they are not
tampered with during transmission.
• Data origin authentication —The receiver verifies the authenticity of the sender.
•
Anti-replay —The receiver examines packets and drops outdated and duplicate packets.
IPsec delivers these benefits:
• Reduced key negotiation overheads and simplified maintenance by supporting the IKE protocol.
IKE provides automatic key negotiation and automatic IPsec SA setup and maintenance.
•
Good compatibility. You can apply IPsec to all IP-based application systems and services without
modifying them.
• Encryption on a per-packet rather than per-flow basis. Per-packet encryption allows for flexibility
and greatly enhances IP security.
IKE is built on a framework defined by ISAKMP. It provides automatic key negotiation and SA
establishment services for IPsec, simplifying the application, management, configuration and
maintenance of IPsec dramatically.
Instead of transmitting keys directly across a network, IKE peers transmit keying materials between them,
and calculate shared keys respectively. Even if a third party captures all exchanged data for calculating
the keys, it cannot calculate the keys.
For more information about IPsec and IKE, see
Security Configuration Guide in HP MSR Router Series
Configuration Guides (V5) .
Recommended configuration procedure
Step Remarks
1. Configuring an IPsec
connection
Required.