ZyXEL NBG420N Manuel d'utilisateur télécharger pdf (Page 189)

Chapter 15 IPSec VPN

NBG420N User’s Guide

189

These modes are illustrated below.

In tunnel mode, the NBG420N uses the IPSec protocol to encapsulate the entire IP packet. As

a result, there are two IP headers:

• Outside header: The outside IP header contains the IP address of the NBG420N or remote

IPSec router, whichever is the destination.

• Inside header: The inside IP header contains the IP address of the computer behind the

NBG420N or remote IPSec router. The header for the IPSec protocol (AH or ESP)

appears between the IP headers.

In transport mode, the encapsulation depends on the IPSec protocol. With AH, the NBG420N

includes part of the original IP header when it encapsulates the packet. With ESP, however, the

NBG420N does not include the IP header when it encapsulates the packet, so it is not possible

to verify the integrity of the source IP address.

IPSec SA Proposal and Perfect Forward Secrecy

An IPSec SA proposal is similar to an IKE SA proposal (see IKE SA Proposal on page 185),

except that you also have the choice whether or not the NBG420N and remote IPSec router

perform a new DH key exchange every time an IPSec SA is established. This is called Perfect

Forward Secrecy (PFS).

If you enable PFS, the NBG420N and remote IPSec router perform a DH key exchange every

time an IPSec SA is established, changing the root key from which encryption keys are

generated. As a result, if one encryption key is compromised, other encryption keys remain

secure.

If you do not enable PFS, the NBG420N and remote IPSec router use the same root key that

was generated when the IKE SA was established to generate encryption keys.

The DH key exchange is time-consuming and may be unnecessary for data that does not

require such security.

Figure 115 VPN: Transport and Tunnel Mode Encapsulation

Original Packet IP Header TCP

Header

Data

Transport Mode Packet IP Header AH/ESP

Header

TCP

Header

Data

Tunnel Mode Packet IP Header AH/ESP

Header

IP Header TCP

Header

Data

1 2 ... 184 185 186 187 188 189 190 191 192 193 194 ... 339 340

Pas de commentaire

ZyXEL NBG420N Manuel d'utilisateur Page 189