Netopia 4000 Series, Руководство пользователя программного обеспечения

Страница: 131 / 314

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-1
C C
C Ch
h
h haa a ap
p
p pttttee e errrr 5
5
5 5
IIIIn n
n nttttee e errrrn
n
n nee e etttt K
K
K Kee e eyyy y E
E
E Exxxxcccch
h
h haa a an
n
n ng
g
g gee e e ((((IIIIK
K
K KE
E
E E)))) IIIIP
P
P Pssssee e ecccc K
K
K Kee e eyyy y M
M
M Maa a an
n
n naa a ag
g
g gee e em
m
m mee e en
n
n ntttt
ffffo o
o orrrr V
V
V VP
P
P PN
N
N Nssss
IPsec stands for IP Security, a set of protocols that suppor ts secure exchange of IP packets at the IP layer.
IPsec is deployed widely to implement Vir tual Private Networks (VPNs). See “Vir tual Private Networks (VPNs)”
on page 4-1 for more information.
The Version 5.3 firmware suppor ts Internet Key Exchange (IKE) for secure encr ypted communication over a VPN
tunnel.
This chapter covers the following topics:
■ “Over view” on page 5-1
■ “Internet Key Exchange (IKE) Configuration” on page 5-2
■ “Key Management” on page 5-9
■ “IPsec WAN Configuration Screens” on page 5-18
■ “IPsec Manual Key Entr y” on page 5-19
Overview
IPsec suppor ts two encapsulation modes: Transpor t and Tunnel. Transpor t mode encr ypts only the data por tion
(payload) of each packet, but leaves the header untouched. Tunnel mode encr ypts both the header and the
payload. On the receiving side, an IPsec-compliant device decr ypts each packet. Netopia Routers suppor t
Tunnel mode.
DES stands for Data Encr yption Standard, a popular symmetric-key encr yption method. DES uses a 56-bit key.
Netopia Routers offer IPsec 3DES (triple DES) encr yption as a standard option.
Note:
Some models suppor t built-in hardware acceleration of 3DES encr yption at line speeds. The optional
VPN-accelerated models (all 4652 models and 4522 routers whose model number ends in “ -XL ”) accelerate
IPsec encr yption and authentication.
Internet Key Exchange (IKE) is an authentication and encr yption key management protocol used in conjunction
with the IPsec standard.
IKE is a two-phase protocol for key exchange.
■
Phase 1 authenticates the security gateways and establishes the Security Parameters (SPs) they will use
to negotiate on behalf of the clients. Security Associations (SAs) are sets of information values that allow