InHand InGateway502, Руководство пользователя

Страница: 92 / 107

88
calculate a shared key. Other parties (such as hackers) cannot calculate
the key even if they intercept all the data exchanged for key calculation.
o
Lifetime: specifies the lifetime of the IKE SA. The two parties negotiate another
SA to replace the old one before the lifetime expires.
•
IPsec Policy
o
Name: specifies the name of the IPsec policy. This parameter cannot be changed
after the IPsec policy is configured successfully.
o
Encapsulation: specifies the encapsulation protocol used for IP packets. The
Authentication Header (AH) protocol defines an authentication method to
authenticate data sources and ensure data integrity. The Encapsulating
Security Payload (ESP) protocol defines encryption and authentication
(optional) methods to ensure data reliability.
•
AH: provides data source authentication, data integrity check, and packet anti-
replay. The sender uses a hash algorithm to calculate a digest field for an IP
packet based on the fixed fields in the IP header and the IP payload. The
receiver calculates the digest for the received IP packet and compares it with
the digest field carried in the packet to determine whether the packet has been
tampered with during transmission on the network.
•
ESP: provides all functions of the AH protocol and encrypts
payload of IP packets. The ESP protocol can protect data in IP
headers of IP packets.
o
Authentication: specifies the algorithm used for authentication. Options are MD5,
SHA1, SHA2-256, SHA2-384, and SHA2-512.
•
MD5: generates a 128-bit message digest for a message of any length.
•
SHA1: generates a 160-bit message digest for a message of a length less than
128 bits.
•
SHA2-256: generates a 256-bit message digest.
•
SHA2-384: generates a 384-bit message digest.
•
SHA2-512: generates a 512-bit message digest.
o
IPsec Mode: specifies the IPsec encapsulation mode.
•
Tunnel Mode: adds an IPsec header (AH or ESP) outside the original IP
header and adds a new IP header at the outermost layer. Then, the original IP
packet is protected by IPsec as a part of payload. The tunnel mode is generally
used between two security gateways. The packets encrypted by one security
gateway can only be decrypted by the peer security gateway.