Ipsec; Ipsec Data Protection; Ipsec Mode; Ipsec Modes - Digi IX10 User Manual

Hide thumbs Also See for IX10:

Table of Contents

Virtual Private Networks (VPN)

IPsec

IPsec is a suite of protocols for creating a secure communication link—an IPsec tunnel—between a

host and a remote IP network or between two IP networks across a public network such as the

IPsec protects the data being sent across a public network by providing the following:

Data origin authentication

Authentication of data to validate the origin of data when it is received.

Data integrity

Authentication of data to ensure it has not been modified during transmission.

Data confidentiality

Encryption of data sent across the IPsec tunnel to ensure that an unauthorized device cannot read

Authentication of data to ensure an unauthorized device has not injected it into the IPsec tunnel.

The IX10 supports the Tunnel mode. With the Tunnel mode, the entire IP packet is encrypted and/or

authenticated and then encapsulated as the payload in a new IP packet. Transport mode is not

currently supported.

IPsec can run in two different modes: Tunnel and Transport.

The entire IP packet is encrypted and/or authenticated and then encapsulated as the payload in a

new IP packet.

Only the payload of the IP packet is encrypted and/or authenticated. The IP header is left

untouched. This mode has limitations when using an authentication header, because the IP

addresses in the IP header cannot be translated (for example, with Network Address Translation

(NAT), as it would invalidate the authentication hash value.

IKE is a key management protocol that allows IPsec to negotiate the security associations (SAs) that

are used to create the secure IPsec tunnel. Both IKEv1 and IKEv2 are supported.

SA negotiations are performed in two phases, known as phase 1 and phase 2.

In phase 1, IKE creates a secure authenticated communication channel between the device and the

peer (the remote device which is at the other end of the IPsec tunnel) using the configured pre-shared

key and the Diffie-Hellman key exchange. This creates the IKE SAs that are used to encrypt further IKE

communications.

For IKEv1, there are two modes for the phase 1 negotiation: Main mode and Aggressive mode. IKEv2

does not use these modes.

IX10 User Guide