Siemens RUGGEDCOM RX1510, Руководство пользователя

Страница: 645 / 856

RUGGEDCOM ROX II
User Guide
Chapter 5
Setup and Configuration
IPsec Tunneling Concepts 613
• Section 5.28.6, “Managing Connections”
• Section 5.28.7, “Managing the Internet Key Exchange (IKE) Protocol”
• Section 5.28.8, “Managing the Encapsulated Security Payload (ESP) Protocol”
• Section 5.28.9, “Configuring the Connection Ends”
• Section 5.28.10, “Managing Private Subnets”
Section 5.28.1
IPsec Tunneling Concepts
The IPsec suite of protocols were developed by the Internet Engineering Task Force (IETF) and are required as
part of IP version 6. Openswan is the open source implementation of IPsec used by ROX II.
The protocols used by IPsec are the Encapsulating Security Payload (ESP) and Internet Key Exchange (IKE)
protocols. ESP provides encryption and authentication (ensuring that a message originated from the expected
sender and has not been altered on route). IKE negotiates connection parameters, including keys, for ESP. IKE is
based on the Diffie-Hellman key exchange protocol, which allows two parties without any initial shared secret to
create one in a manner immune to eavesdropping.
The following sections provide more information about IPsec and its implementation in ROX II:
•
Section 5.28.1.1, “IPsec Modes”
• Section 5.28.1.2, “Supported Encryption Protocols”
• Section 5.28.1.3, “Public and Secret Key Cryptography”
• Section 5.28.1.4, “X509 Certificates”
• Section 5.28.1.5, “NAT Traversal”
• Section 5.28.1.6, “Remote IPsec Client Support”
• Section 5.28.1.7, “IPsec and Router Interfaces”
Section 5.28.1.1
IPsec Modes
IPsec has two basic modes of operation. In transport mode, IPsec headers are added as the original IP datagram
is created. The resultant packet is composed of an IP header, IPsec headers and IP payload (including a
transport header). Transport mode is most commonly used between IPsec end-stations, or between an end-
station and a gateway.
In
tunnel mode, the original IP datagram is created normally and then encapsulated into a new IP datagram. The
resultant packet is composed of a new IP header, IPsec headers, old IP header and IP payload. Tunnel mode is
most commonly used between gateways, the gateway acting as a proxy for the hosts behind it.
Section 5.28.1.2
Supported Encryption Protocols
Openswan supports the following standard encryption protocols:
•
3DES (Triple DES)