P-2608HWL-Dx Series User’s Guide
226
Chapter 18 IPSec VPN
18.1.2 Additional Topics for IKE SA
This section provides more information about IKE SA.
18.1.2.1 Negotiation Mode
There are two negotiation modes: main mode and aggressive mode. Main mode provides
better security, while aggressive mode is faster.
Main mode takes six steps to establish an IKE SA.
Steps 1-2: The ZyXEL Device sends its proposals to the remote IPSec router. The remote
IPSec router selects an acceptable proposal and sends it back to the ZyXEL Device.
Steps 3-4: The ZyXEL Device and the remote IPSec router participate in a Diffie-Hellman key
exchange, based on the accepted DH key group, to establish a shared secret.
Steps 5-6: Finally, the ZyXEL Device and the remote IPSec router generate an encryption key
from the shared secret, encrypt their identities, and exchange their encrypted identity
information for authentication.
In contrast, aggressive
mode only takes three steps to establish an IKE SA.
Step 1: The ZyXEL Device sends its proposals to the remote IPSec router. It also starts the
Diffie-Hellman key exchange and sends its (unencrypted) identity to the remote IPSec router
for authentication.
Step 2: The remote IPSec router selects an acceptable proposal and sends it back to the ZyXEL
Device. It also finishes the Diffie-Hellman key exchange, authenticates the ZyXEL Device,
and sends its (unencrypted) identity to the ZyXEL Device for authentication.
Step 3: The ZyXEL Device authenticates the remote IPSec router and confirms that the IKE
SA is established.
Aggressive mode does not provide as much security as main mode because the identity of the
ZyXEL Device and the identity of the remote IPSec router are not encrypted. It is usually used
when the address of the initiator is not known by the responder and both parties want to use
pre-shared keys for authentication (for example, telecommuters).
18.1.2.2 VPN, NAT and NAT Traversal
In the following example, there is another router (
A
) between router
X
and router
Y
.
Содержание P-2608HWL-D1
Страница 1: ...P 2608HWL Dx Series 802 11g Wireless ADSL2 VoIP IAD User s Guide Version 3 40 10 2006 Edition 1 ...
Страница 2: ......
Страница 7: ...P 2608HWL Dx Series User s Guide Safety Warnings 7 This product is recyclable Dispose of it properly ...
Страница 24: ...P 2608HWL Dx Series User s Guide 24 Table of Contents ...
Страница 32: ...P 2608HWL Dx Series User s Guide 32 List of Figures ...
Страница 38: ...P 2608HWL Dx Series User s Guide 38 List of Tables ...
Страница 44: ...P 2608HWL Dx Series User s Guide 44 Chapter 1 Getting To Know the ZyXEL Device ...
Страница 66: ...P 2608HWL Dx Series User s Guide 66 Chapter 3 Internet and Wireless Setup Wizard ...
Страница 72: ...P 2608HWL Dx Series User s Guide 72 Chapter 4 VoIP Wizard And Example ...
Страница 78: ...P 2608HWL Dx Series User s Guide 78 Chapter 5 Bandwidth Management Wizard ...
Страница 88: ...P 2608HWL Dx Series User s Guide 88 Chapter 6 Status Screens ...
Страница 118: ...P 2608HWL Dx Series User s Guide 118 Chapter 8 LAN Setup ...
Страница 138: ...P 2608HWL Dx Series User s Guide 138 Chapter 9 Wireless LAN ...
Страница 166: ...P 2608HWL Dx Series User s Guide 166 Chapter 11 SIP ...
Страница 176: ...P 2608HWL Dx Series User s Guide 176 Chapter 12 Phone ...
Страница 184: ...P 2608HWL Dx Series User s Guide 184 Chapter 13 Phone Book ...
Страница 206: ...P 2608HWL Dx Series User s Guide 206 Chapter 16 Firewall Configuration Figure 107 Firewall Edit Rule ...
Страница 220: ...P 2608HWL Dx Series User s Guide 220 Chapter 17 Content Filtering ...
Страница 257: ...P 2608HWL Dx Series User s Guide Chapter 19 Certificates 257 Figure 138 My Certificate Details ...
Страница 268: ...P 2608HWL Dx Series User s Guide 268 Chapter 19 Certificates Figure 146 Trusted Remote Host Details ...
Страница 276: ...P 2608HWL Dx Series User s Guide 276 Chapter 20 Static Route ...
Страница 288: ...P 2608HWL Dx Series User s Guide 288 Chapter 21 Bandwidth Management ...
Страница 292: ...P 2608HWL Dx Series User s Guide 292 Chapter 22 Dynamic DNS Setup ...
Страница 306: ...P 2608HWL Dx Series User s Guide 306 Chapter 23 Remote Management Configuration ...
Страница 318: ...P 2608HWL Dx Series User s Guide 318 Chapter 24 Universal Plug and Play UPnP ...
Страница 324: ...P 2608HWL Dx Series User s Guide 324 Chapter 25 System ...
Страница 344: ...P 2608HWL Dx Series User s Guide 344 Chapter 27 Tools ...
Страница 348: ...P 2608HWL Dx Series User s Guide 348 Chapter 28 Diagnostic ...
Страница 360: ...P 2608HWL Dx Series User s Guide 360 Chapter 29 Troubleshooting ...
Страница 378: ...P 2608HWL Dx Series User s Guide 378 Appendix B Setting up Your Computer s IP Address ...
Страница 402: ...P 2608HWL Dx Series User s Guide 402 Appendix F Triangle Route ...
Страница 440: ...P 2608HWL Dx Series User s Guide 440 Appendix H Internal SPTGEN ...