Internet Key Exchange Concepts - Brocade Communications Systems StoreFabric SN6500B Administrator's Manual

15
IPsec concepts
Gateway to Gateway
In a gateway to gateway configuration, IPsec protection is implemented between network nodes.
Tunnel mode is commonly used in a gateway to gateway configuration. A tunnel endpoint
represents a set of IP addresses associated with actual endpoints that use the tunnel. IPsec is
transparent to the actual endpoints.
Endpoint to Gateway
In an endpoint to gateway configuration, a protected endpoint connects through an IPsec protected
tunnel. This can be used as a virtual private network (VPN) for connecting a roaming computer, like
a service laptop, to a protected network.

Internet Key Exchange concepts

Internet Key Exchange (IKE) is used to authenticate the end points of an IP connection, and to
determine security policies for IP traffic over the connection. The initiating node proposes a policy
based on the following:
•
•
•
•
•
Encryption algorithms
An encryption algorithm is used to encrypt messages used in the IKE negotiation.
available encryption algorithms. A brief description is provided. If you need further information,
please refer to the RFC.
TABLE 18
Encryption algorithm
3des_cbc
null_enc
aes128_cbc
aes256_cbc
192
An encryption algorithm to protect data.
A hash algorithm to check the integrity of the authentication data.
A Pseudo-Random Function (PRF) algorithm that can be used with the hash algorithm for
additional cryptographic strength.
An authentication method requiring a digital signature, and optionally a certificate exchange.
A Diffie-Hellman exchange that generates prime numbers used in establishing a shared secret
key.
Encryption algorithm options
Description
3DES processes each block three times, using
a unique 56-bit key each time.
No encryption is performed.
Advanced Encryption Standard (AES) 128 bit
block cipher.
Advanced Encryption Standard (AES) 256 bit
block cipher.
Table 18 lists the
RFC number
RFC 2451
RFC 4869
RFC 4869
Web Tools Administrator's Guide
53-1002756-01