D-Link DFL-210-WCF-12 Product Manual - Page 391
IPsec Components, 9.3.1. Overview, 9.3.2. Internet Key Exchange (IKE), Security Associations SAs
UPC - 790069601545
View all D-Link DFL-210-WCF-12 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 391 highlights
9.3. IPsec Components Chapter 9. VPN 9.3. IPsec Components This section looks at the IPsec standards and describes in general terms the various components, techniques and algorithms that are used in IPsec based VPNs. 9.3.1. Overview Internet Protocol Security (IPsec) is a set of protocols defined by the Internet Engineering Task Force (IETF) to provide IP security at the network layer. An IPsec based VPN is made up of two parts: • Internet Key Exchange protocol (IKE) • IPsec protocols (AH/ESP/both) The first part, IKE, is the initial negotiation phase, where the two VPN endpoints agree on which methods will be used to provide security for the underlying IP traffic. Furthermore, IKE is used to manage connections, by defining a set of Security Associations, SAs, for each connection. SAs are unidirectional, so there are usually at least two for each IPsec connection. The second part is the actual IP data being transferred, using the encryption and authentication methods agreed upon in the IKE negotiation. This can be accomplished in a number of ways; by using IPsec protocols ESP, AH, or a combination of both. The flow of events can be briefly described as follows: • IKE negotiates how IKE should be protected • IKE negotiates how IPsec should be protected • IPsec moves data in the VPN The following sections will describe each of these stages in detail. 9.3.2. Internet Key Exchange (IKE) This section describes IKE, the Internet Key Exchange protocol, and the parameters that are used with it. Encrypting and authenticating data is fairly straightforward, the only things needed are encryption and authentication algorithms, and the keys used with them. The Internet Key Exchange (IKE) protocol, IKE, is used as a method of distributing these "session keys", as well as providing a way for the VPN endpoints to agree on how the data should be protected. IKE has three main tasks: • Provide a means for the endpoints to authenticate each other • Establish new IPsec connections (create SA pairs) • Manage existing connections Security Associations (SAs) IKE keeps track of connections by assigning a set of Security Associations, SAs, to each connection. An SA describes all parameters associated with a particular connection, such as the IPsec protocol used (ESP/AH/both) as well as the session keys used to encrypt/decrypt and/or authenticate/verify the transmitted data. 391