ZyXEL NBG420N Manuel d'utilisateur télécharger pdf (Page 187)

Chapter 15 IPSec VPN

NBG420N User’s Guide

187

In the following example, the ID type and content do not match so the authentication fails and

the NBG420N and the remote IPSec router cannot establish an IKE SA.

Negotiation Mode

There are two negotiation modes: main mode and aggressive mode. Main mode provides

better security, while aggressive mode is faster.

Main mode takes six steps to establish an IKE SA.

Steps 1-2: The NBG420N sends its proposals to the remote IPSec router. The remote IPSec

router selects an acceptable proposal and sends it back to the NBG420N.

Steps 3-4: The NBG420N and the remote IPSec router participate in a Diffie-Hellman key

exchange, based on the accepted DH key group, to establish a shared secret.

Steps 5-6: Finally, the NBG420N and the remote IPSec router generate an encryption key from

the shared secret, encrypt their identities, and exchange their encrypted identity information

for authentication.

In contrast, aggressive mode only takes three steps to establish an IKE SA.

Step 1: The NBG420N sends its proposals to the remote IPSec router. It also starts the Diffie-

Hellman key exchange and sends its (unencrypted) identity to the remote IPSec router for

authentication.

Step 2: The remote IPSec router selects an acceptable proposal and sends it back to the

NBG420N. It also finishes the Diffie-Hellman key exchange, authenticates the NBG420N,

and sends its (unencrypted) identity to the NBG420N for authentication.

Step 3: The NBG420N authenticates the remote IPSec router and confirms that the IKE SA is

established.

Aggressive mode does not provide as much security as main mode because the identity of the

NBG420N and the identity of the remote IPSec router are not encrypted. It is usually used

when the address of the initiator is not known by the responder and both parties want to use

pre-shared keys for authentication (for example, telecommuters).

VPN, NAT, and NAT Traversal

In the following example, there is another router (A) between router X and router Y.

Table 68 VPN Example: Mismatching ID Type and Content

NBG420N REMOTE IPSEC ROUTER

Local ID type: E-mail Local ID type: IP

Local ID content: tom@yourcompany.com Local ID content: 1.1.1.2

Peer ID type: IP Peer ID type: E-mail

Peer ID content: 1.1.1.15 Peer ID content: tom@yourcompany.com

1 2 ... 182 183 184 185 186 187 188 189 190 191 192 ... 339 340

Pas de commentaire

ZyXEL NBG420N Manuel d'utilisateur Page 187