Table of Contents
Advertisement
11.1 VPN Overview
A VPN (Virtual Private Network) provides secure communications between sites without the expense of leased
site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and
auditing technologies/services used to transport traffic over the Internet or any insecure network that uses the
TCP/IP protocol suite for communication.
11.1.1 IPSec
Internet Protocol Security (IPSec) is a standards-based VPN that offers flexible solutions for secure data
communications across a public network like the Internet. IPSec is built around a number of standardized
cryptographic techniques to provide confidentiality, data integrity and authentication at the IP layer.
11.1.2 Security Association
A Security Association (SA) is a contract between two parties indicating what security parameters, such as keys
and algorithms they will use.
11.1.3 Encryption
Encryption is a mathematical operation that transforms data from "plaintext" (readable) to "ciphertext"
(scrambled text) using a "key". The key and clear text are processed by the encryption operation, which leads to
the data scrambling that makes encryption secure. Decryption is the opposite of encryption: it is a mathematical
operation that transforms "ciphertext" to plaintext. Decryption also requires a key.
11.1.4 Data Confidentiality
The IPSec sender can encrypt packets before transmitting them across a network.
11.1.5 Data Integrity
The IPSec receiver can validate packets sent by the IPSec sender to ensure that the data has not been
altered during transmission.
11.1.6 Data Origin Authentication
The IPSec receiver can verify the source of IPSec packets. This service depends on the data integrity service.
11.1.7 IPSec Algorithms
The ESP and AH protocols are necessary to create a Security Association (SA), the foundation of an IPSec
VPN. An SA is built from the authentication provided by the AH and ESP protocols. The primary function of
key management is to establish and maintain the SA between systems. Once the SA is established, the transport
of data may commence.
AH (Authentication Header) Protocol
AH protocol (RFC 2402) was designed for integrity, authentication, sequence integrity (replay resistance), and
non-repudiation but not for confidentiality, for which the ESP was designed.
Configuration > VPN
11 Configuration > VPN
This chapter shows you how to configure VPNs using Vantage.
Vantage CNM 2.0
11-1
Advertisement
Table of Contents
