3Com 3032 Configuration Manual page 571

Selecting the Encryption
and Authentication
Algorithm
Restore the default message
encapsulating mode (applicable to IPSec
software and crypto card)
The default mode is tunnel-encapsulation mode.
Select Security Protocol
After the transport mode is defined, it is necessary to select the security protocol
for the transport mode. The security protocols available at present include AH and
ESP, both of which can also be used at the same time. Both ends of security tunnel
must select the same security protocols.
The data encapsulation forms of various security protocols in transport and tunnel
mode are shown in the following figure:
Figure 173 Data encapsulation form of the security protocol
Transmission mode
Encryption
protocol
ah-new
IP AH
IP ESP data
esp-new
ah-esp-new
IP AH
Please configure the following in IPSec Proposal view (or proposal view of crypto
card).
Table 637 Select Security Protocol
Operation
Set security protocol used for IPSec
proposal (applicable to IPSec software and
crypto card)
Restore the default security protocol
(applicable to IPSec software and crypto
card)
The security protocol
esp-new
AH protocol cannot encrypt but authenticate packets. ESP in IPSec software
supports five security encryption algorithms that are 3des, des, blowfish, cast
and skipjack. There are seven kinds of security encryption algorithms supported
by ESP crypto card, which are 3des, des, blowfish, cast, skipjack, aes, and qc5.
The current security authentication algorithm includes MD5 (message digest
Version 5) and SHA (security hashing algorithm), both of which are HMAC
variables. HMAC is a hashing algorithm with key, which can authenticate data.
The algorithm md5 uses 128-bit key and the algorithm sha1 uses 160-bit key, and
the former calculates faster than the latter while the latter is more secure than the
former.
Both ends of security tunnel must select the same encryption algorithm and
authentication algorithm.
undo encapsulation-mode
transport
data
IP AH
IP ESP
ESP-T
ESP data ESP-T
IP AH
Command
transform { ah-new | esp-new |
ah-esp-new }
undo transform
prescribed in RFC2406 is used by default.
Configuring IPSec
tunnel
data
IP
data
IP ESP-T
data ESP-T
ESP IP
567