Watchguard Firebox V10, Руководство пользователя

Страница: 338 / 477

CHAPTER 11: Using Virtual Private Networks (VPN)
306 Vcontroller
Three major qualifications are established in an IPSec
action:
Mode
Tunnel mode is used when Firebox Vclass
appliances act as security gateways on both ends or
when a remote Firebox Vclass VPN client connects
to a Firebox Vclass security appliance. Data packets
are encrypted and sent from one appliance to the
other, where decryption takes place and the data is
forwarded to its final destination. You must specify
the IP address of each tunnel peer.
Transport mode is usually applied in end-to-end
secured communications.
Key Management
This specifies whether the key is created
automatically or manually. Automatic key
management is done in accordance with IKE, an
IETF standard protocol. Using IKE, encryption
keys are automatically negotiated and selected by
two connected security appliances. This provides
the easiest, most efficient wat to manage keys.
Encryption/authentication
Two principal types of security protocols protect
data packets in Internet communications. The AH
(Authentication Header) protocol is applied to IP
packets for authentication, while ESP
(Encapsulating Security Payload) can be applied to
IP packets for both encryption and authentication.
Using Authentication and Encryption
The Firebox Vclass security appliance supports the follow-
ing algorithms:
Authentication Header (AH)
MD5, SHA
Encapsulating Security Payload (ESP)
DES, 3DES