Table of Contents
Advertisement
JunosE 11.2.x IP Services Configuration Guide
IPSec Concepts
Secure IP Interfaces
122
RFC 2408—Internet Security Association and Key Management Protocol (ISAKMP)
(November 1998)
RFC 2409—The Internet Key Exchange (IKE) (November 1998)
RFC 2410—The NULL Encryption Algorithm and Its Use With IPSec (November 1998)
RFC 3706—A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE)
Peers (February 2004)
For information about using digital certificates, see "Configuring Digital Certificates" on
page 205.
This section provides an overview of IPSec concepts.
IPSec provides security to IP flows through the use of authentication and encryption.
Authentication verifies that data is not altered during transmission and ensures that
users are communicating with the individual or organization that they believe they are
communicating with.
Encryption makes data confidential by making it unreadable to everyone except the
sender and intended recipient.
IPSec comprises two encapsulation protocols:
Encapsulating Security Payload (ESP) provides confidentiality and authentication
functions to every data packet.
Authentication header (AH) provides authentication to every data packet.
Both protocols are defined with two modes of operation:
Tunnel mode completely encapsulates the original packet within another IP header.
Transport mode keeps the original header and does not add the extra IP header.
Secure IP interfaces are virtual IP interfaces that you can configure to provide
confidentiality and authentication services for the data flowing through such interfaces.
The software provides these services using mechanisms created by the suite of IPSec
standards established by the IETF.
Secure IP interfaces connect the router to any other endpoint through the routed network
and allow much of the same functionality as other IP interfaces. Traffic can reach a secure
IP interface via routing or policy routing.
A secure tunnel is a layer 2 entity. It is a point-to-point connection that is mapped on
top of other IP interfaces. Secure tunnels carry only IP traffic.
A secure IP interface is a layer 3 entity; that is, an IP interface mapped on top of a secure
tunnel that inherits all security associated with it.
Copyright © 2010, Juniper Networks, Inc.
Advertisement
Table of Contents
