ZyXEL NBG-460N User Guide - Page 212
IPSec SA Proposal and Perfect Forward Secrecy, Additional IPSec VPN Topics
View all ZyXEL NBG-460N manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 212 highlights
Chapter 15 IPSec VPN Figure 130 VPN: Transport and Tunnel Mode Encapsulation Transport Mode Packet IP Header AH/ESP Header TCP Header Data Tunnel Mode Packet IP Header AH/ESP Header IP Header TCP Header Data In tunnel mode, the NBG-460N uses the IPSec protocol to encapsulate the entire IP packet. As a result, there are two IP headers: • Outside header: The outside IP header contains the IP address of the NBG-460N or remote IPSec router, whichever is the destination. • Inside header: The inside IP header contains the IP address of the computer behind the NBG-460N or remote IPSec router. The header for the IPSec protocol (AH or ESP) appears between the IP headers. In transport mode, the encapsulation depends on the IPSec protocol. With AH, the NBG-460N includes part of the original IP header when it encapsulates the packet. With ESP, however, the NBG-460N does not include the IP header when it encapsulates the packet, so it is not possible to verify the integrity of the source IP address. 15.6.9 IPSec SA Proposal and Perfect Forward Secrecy An IPSec SA proposal is similar to an IKE SA proposal (see IKE SA Proposal on page 207), except that you also have the choice whether or not the NBG-460N and remote IPSec router perform a new DH key exchange every time an IPSec SA is established. This is called Perfect Forward Secrecy (PFS). If you enable PFS, the NBG-460N and remote IPSec router perform a DH key exchange every time an IPSec SA is established, changing the root key from which encryption keys are generated. As a result, if one encryption key is compromised, other encryption keys remain secure. If you do not enable PFS, the NBG-460N and remote IPSec router use the same root key that was generated when the IKE SA was established to generate encryption keys. The DH key exchange is time-consuming and may be unnecessary for data that does not require such security. 15.6.10 Additional IPSec VPN Topics This section discusses other IPSec VPN topics that apply to either IKE SAs or IPSec SAs or both. Relationships between the topics are also highlighted. 212 NBG-460N User's Guide