Table of Contents
Advertisement
Vantage CNM 2.0
In applications where confidentiality is not required or not sanctioned by government encryption restrictions, an
AH can be employed to ensure integrity. This type of implementation does not protect the information from
dissemination but will allow for verification of the integrity of the information and authentication of the
originator.
ESP (Encapsulating Security Payload) Protocol
The ESP protocol (RFC 2406) provides encryption as well as some of the services offered by AH. ESP
authenticating properties are limited compared to the AH due to the non-inclusion of the IP header information
during the authentication process. However, ESP is sufficient if only the upper layer protocols need to be
authenticated.
An added feature of the ESP is payload padding, which further protects communications by concealing the size
of the packet being transmitted.
DES (default)
Data Encryption Standard (DES) is a widely used method
of data encryption using a secret key. DES applies a 56-bit
key to each 64-bit block of data.
3DES
Triple DES (3DES) is a variant of DES, which iterates
three times with three separate keys (3 x 56 = 168 bits),
effectively doubling the strength of DES.
AES
Advanced Encryption Standard is a newer method of data
encryption that also uses a secret key. This
implementation of AES applies a 128-bit key to 128-bit
blocks of data. AES is faster than 3DES.
Select DES for minimal security and 3DES or AES for
maximum. Select NULL to set up a tunnel without
encryption.
11.1.8 Key Management
Key management allows you to determine whether to use IKE (ISAKMP) or manual key configuration in order
to set up a VPN.
11.1.9 Encapsulation
The two modes of operation for IPSec VPNs are Transport mode and Tunnel mode.
Transport Mode
Transport mode is used to protect upper layer protocols and only affects the data in the IP packet. In Transport
mode, the IP packet contains the security protocol (AH or ESP) located after the original IP header and options,
but before any upper layer protocols contained in the packet (such as TCP and UDP).
With ESP, protection is applied only to the upper layer protocols contained in the packet. The IP header
information and options are not used in the authentication process. Therefore, the originating IP address cannot
be verified for integrity against the data.
With the use of AH as the security protocol, protection is extended forward into the IP header to verify the
integrity of the entire packet by use of portions of the original IP header in the hashing process.
11-2
Table 11-1 AH and ESP
ESP
AH
MD5 (default)
MD5 (Message Digest 5) produces a 128-bit
digest to authenticate packet data.
SHA1
SHA1 (Secure Hash Algorithm) produces a
160-bit digest to authenticate packet data.
Select MD5 for minimal security and SHA-1 for
maximum security.
Configuration > VPN
Advertisement
Table of Contents
