Ipsec Concepts; Secure Ip Interfaces - Juniper JUNOSE 11.0.X IP SERVICES Configuration Manual

JUNOSe 11.0.x IP Services Configuration Guide
For information about using digital certificates, see "Configuring Digital Certificates"
on page 213.

IPSec Concepts

This section provides an overview of IPSec concepts.
IPSec provides security to IP flows through the use of authentication and encryption.
IPSec comprises two encapsulation protocols:
Both protocols are defined with two modes of operation:

Secure IP Interfaces

Secure IP interfaces are virtual IP interfaces that you can configure to provide
confidentiality and authentication services for the data flowing through such interfaces.
The software provides these services using mechanisms created by the suite of IPSec
standards established by the IETF.
Secure IP interfaces connect the router to any other endpoint through the routed
network and allow much of the same functionality as other IP interfaces. Traffic can
reach a secure IP interface via routing or policy routing.
128
IPSec Concepts
RFC 2410 The NULL Encryption Algorithm and Its Use With IPSec (November
1998)
RFC 3706 A Traffic-Based Method of Detecting Dead Internet Key Exchange
(IKE) Peers (February 2004)
Authentication verifies that data is not altered during transmission and ensures
that users are communicating with the individual or organization that they believe
they are communicating with.
Encryption makes data confidential by making it unreadable to everyone except
the sender and intended recipient.
Encapsulating Security Payload (ESP) provides confidentiality and authentication
functions to every data packet.
Authentication header (AH) provides authentication to every data packet.
Tunnel mode completely encapsulates the original packet within another IP
header.
Transport mode keeps the original header and does not add the extra IP header.
A secure tunnel is a layer 2 entity. It is a point-to-point connection that is mapped
on top of other IP interfaces. Secure tunnels carry only IP traffic.
A secure IP interface is a layer 3 entity; that is, an IP interface mapped on top
of a secure tunnel that inherits all security associated with it.