Transport And Tunnel Modes; Key Management; Vpn Configuration Task List; Creating An Ipsec Transformation Profile - Patton electronics SmartNode Series Software Configuration Manual

SmartWare Software Configuration Guide
The single DES algorithm does not offer adequate security any longer because of its short key length. A key
length of at least 100 Bit is recommended. The AES algorithm is very efficient and allows the fastest encryp-
tion. AES with a key length of 128 Bit is therefore the recommended algorithm.

Transport and tunnel modes

The 'mode' determines the payload of the ESP packet and hence the application:
• Transport Mode:encapsulates only the payload of the original IP packet but not its header. The IPsec peers
must therefore be the endpoints of the communication.
A secure connection of two hosts is the application of the Transport Mode.
• Tunnel Mode:encapsulates the payload and the header of the original IP packet. The IPsec peers can be
(edge) routers that are not the endpoints of the communication.
A secure connection of the two (private) LANs, a 'tunnel', is the application of the Tunnel Mode.

Key management

The current implementation of IPsec in SmartWare works with Pre-shared Keys (also called Manual Keying or
Manual IPsec). Keys are manually generated, distributed, and stored into the startup-configuration of the
SmartNode and its peer, as a hexa-decimal string.
Note
The key life-time of a DES-key ranges between 3 hours and 3 days depend-
ing on the processing hardware applied to 'reverse engineering' the key.
DES-Keys must be manually updated in constant intervals in order to main-
tain security. The life-time of an AES- or 3DES-key is close to the infinity
compared to a human life.
The Internet Key Exchange (IKE) protocol is not supported yet.
VPN configuration task list
To configure a VPN connection, perform the following tasks:
• Creating an IPsec Transformation Profile
• Creating an IPsec Policy Profile
• Creating/Modifying an Outgoing ACL Profile for IPsec
• Configuration of an IP Interface and the IP Router for IPsec
• Displaying IPsec Configuration Information
• Debugging IPsec
Creating an IPsec transformation profile
The IPsec Transformation Profile defines which authentication and/or encryption protocols, which authentica-
tion and/or encryption algorithms shall be applied.
Procedure: To create an IPsec Transformation Profile

VPN configuration task list

22 • VPN configuration
265