![background image](http://html1.mh-extra.com/html/racom/ripex/ripex_user-manual_3186409166.webp)
Symmetrical cryptography is used to encrypt the packets. The symmetric keys must be safely
delivered to the peer. In order to maintain a secure connection, symmetric keys must be regularly
exchanged. The protocol used for secure key exchange is IKE (Internet Key Exchange). Both
IKE version 1 and the newer version 2 are available.
IKE protocol communication with the peer is established using UDP frames on port 500. However,
if the NAT-T (NAT Traversal) or MOBIKE (MOBile IKE) are active, the UDP port 4500 is used.
The IPsec tunnel is provided by Security Association (SA). There are 2 types of SA:
•
IKE SA: IKE Security Association providing SA keys exchange with the peer.
•
CHILD SA: IPsec Security Association providing packet encryption.
Every IPsec tunnel contains 1 IKE SA and at least 1 CHILD SA.
Link partner (peer) secure authentication is assured using Pre-Shared Key (PSK) authentication
method: Both link partners share the same key (password).
As and when the CHILD SA expires, new keys are generated and exchanged using IKE SA.
As and when the IKE SA version IKEv1 expires - new authentication and key exchange occurs
and a new IKE SA is created. Any CHILD SA belonging to this IKE SA is/are re-created as well.
As and when the IKE SA version IKEv2 expires one of two different scenarios might occur:
•
If the re-authentication is required - the behavior is similar to IKEv1 (see above).
•
It the re-authentication is not required - only new IKE SA keys are generated and exchange
■
IPsec in relation to other RipEX services
IPsec cannot be used in
Bridge
mode.
Any user defined
firewall
filtering is active prior to IPsec encryption and after IPsec decryption.
IPsec can be routed via the
radio channel
. The radio IP address or ETH IP address can be
used as a "Peer address".
IPsec can operate concurrently with IP
optimization
. The traffic is either forwarded to the IPsec
or the optimization module.
IPsec can be routed via the
Backup routes (BRMP)
. This happens when the "Peer address"
is routed using a routing rule with the backup route defined.
IPsec can be used to cooperate with the
TCP Proxy
. In this case, the packet is captured by
TCP Proxy first, encapsulated to UDP frame and then forwarded to the IPsec. The peer side
process works in reverse.
IPsec can be used together with the
SLIP
protocol (COM interface, terminal server). The IPsec
tunnel can be configured through the SLIP tunnel and user traffic can be routed to this tunnel.
IPsec can build a connection via
VLAN
or
subnet
. A corresponding source address must be
selected.
IPsec also functions in
HotStandby
mode. When in passive mode, IPsec is turned off. IPsec is
started on transition to active mode. New SA (security associations) are opened. On the peer
side: the new SA replaces the SA belonging to the RipEX which has transitioned to passive
mode.
RipEX Radio modem & Router – © RACOM s.r.o.
166
Advanced Configuration
Содержание RipEX
Страница 2: ......
Страница 42: ... DQ Data Quality Min 180 PER Packet Error Rate Max 5 RipEX Radio modem Router RACOM s r o 42 Network planning ...
Страница 222: ...Fig 10 3 ATEX Certificate RipEX 2 3 RipEX Radio modem Router RACOM s r o 222 Safety environment licensing ...
Страница 223: ...Fig 10 4 ATEX Certificate RipEX 3 3 223 RACOM s r o RipEX Radio modem Router Safety environment licensing ...