Ipsec Overview - Huawei S9700 Series Configuration Manual

S9700 Core Routing Switch
Configuration Guide - SPU

4.1 IPSec Overview

The IP Security (IPSec) protocol family is a series of protocols defined by the Internet
Engineering Task Force (IETF). This protocol family provides high quality, interoperable, and
cryptology-based security for IP packets. Communicating parties encrypt data and authenticate
the data source at the IP layer to ensure data confidentiality and integrity and prevent replay of
data packets.
IPSec uses two security protocols: Authentication Header (AH) protocol and Encapsulating
Security Payload (ESP). Key exchange and SA establishment in IPSec is implemented by the
Internet Key Exchange (IKE) protocol, which simplifies use and management of IPSec.
IPSec involves the following terms:
l
l
Issue 01 (2012-03-15)
Security association (SA)
– An SA is a set of conventions adopted by the communicating parties. For example, it
determines the security protocol (AH, ESP, or both), encapsulation mode (transport
mode or tunnel mode), key algorithm (DES, 3DES, or AES), shared key to protect
certain flow, and the lifetime of the shared key.
– An SA is unidirectional, at least two SAs are required to protect data flows in
bidirectional communication. If two peers need to communicate using both AH and
ESP, each peer needs to establish two SAs for the two protocols.
– An SA is identified by three parameters: Security Parameter Index (SPI), destination IP
address, and security protocol ID (AH or ESP).
Encapsulation mode
– Transport mode: AH or ESP is inserted behind the IP header but before all transport-
layer protocols or all other IPSec protocols, as shown in
– Tunnel mode: AH or ESP is inserted before the original IP header but behind a new IP
header, as shown in
Figure 4-1 Packet format in transport mode
Mode
Protocol
AH IP Header AH
IP Header
ESP
IP Header
AH-ESP
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
Figure 4-2.
transport
TCP Header
TCP Header
ESP
AH ESP TCP Header
4 IPSec Configuration
Figure 4-1.
data
ESP
data
ESP Auth data
Tail
data ESP Tail ESP Auth data
113