Introduction
362
SmartWare Software Configuration Guide
32 • VPN configuration
Transport and tunnel modes
The mode determines the payload of the ESP packet and hence the application:
•
Transport mode: Encapsulates only the payload of the original IP packet, but not its header, so the IPsec
peers must be at the endpoints of the communications link.
•
A secure connection between two hosts is the application of the transport mode.
•
Tunnel mode: Encapsulates the payload and the header of the original IP packet. The IPsec peers can be
(edge) routers that are not at the endpoints of the communications link.
A secure connection of the two (private) LANs, a ‘tunnel’, is the application of the tunnel mode.
Permanent IKE Tunnels
By default, IKE tunnels are established as late as possible (when the first packet is flowing through) and IKE
tunnels with expired lifetimes are reestablished only in case there is traffic flowing through. With the perma-
nent option set, IKE tunnels are established shortly after boot and are reestablished after the expiration of their
lifetime even if there was no traffic flowing through.
Mode:
Configure
Key management
The current implementation of IP works with pre-shared keys (also called
manual keying
or
manual IPsec
) or
using Internet Key Exchange (IKE). Keys are manually generated, distributed, and stored as a hexa-decimal
string in the startup-configuration of the SmartNode and its peer.
Note
Depending on the processing hardware applied to
reverse engineering
a DES
key, it can take from 3 hours to 3 days to break the key. Thus, for maximum
security, DES keys must be manually updated regularly. AES- or 3DES-keys,
because they are much more complex, take so much longer to break as to be
practically infinite.
The automatically keyed IPSEC connections using the Internet Key Exchange (IKE / RFC2409) protocol that
is based on Internet Security Association and Key Management Protocol (ISAKMP / RFC2408) is the other
option. IKE supports authentication using pre-shared keys. There is currently no support for authentication
using Public Key Infrastructure (PKI) and digital certificates.
Step
Command
Purpose
1
node
(pf-ipsik)[
name
]#protected- net-
work {host <local-host-ip>}|{subnet
<local-subnet-address> <local-subnet-
mask>}|{range <local-range-start>
<local-range-end>} {host <remote-host-
ip>}|{subnet <remote-subnet-address>
<remote-subnet-mask>}|{range
<remote-range-start><remote-range-
end>} [permanent-tunnel]
Optionally, if the remote system requires protected
networks to be specified in the identity payload of
the quick mode, you can define one or more pro-
tected networks using this command. If the tunnel
shall be established permanently the permanent-
tunnel flag must be set.
Содержание SmartNode Series
Страница 250: ...RIP configuration task list 250 SmartWare Software Configuration Guide 23 RIP configuration rip enabled ...
Страница 635: ...635 Appendix A Terms and definitions Chapter contents Introduction 636 SmartWare architecture terms and definitions 636 ...
Страница 641: ...641 Appendix B Mode summary Chapter contents Introduction 642 ...
Страница 648: ...648 Appendix D Internetworking terms acronyms Chapter contents Abbreviations 649 ...
Страница 653: ...653 Appendix E Used IP ports available voice codecs Chapter contents Used IP ports 654 Available voice codecs 655 ...