Avaya Configuring IPsec Services Bedienungsanleitung PDF herunterladen (Seite 33)

Overview of IPsec

308630-14.00 Rev 00

1-13

Figure 1-4. Security Associations for Bidirectional Traffic

Under most circumstances, you will configure the Internet Key Exchange (IKE)

protocol to negotiate SAs between security gateways automatically. You can also

manually configure SAs.

How IKE Negotiates Security Associations

The Internet Key Exchange (IKE) protocol automates the process of IPsec SA

configuration by creating an IKE SA for Protect SA and Unprotect SA

negotiation. Each IKE peer sends IPsec SA parameter negotiation information in a

secure IKE packet. The peers generate keys based on the agreed parameters and

then verify each other’s identity. Once this is done, the IPsec SA is established.

The IKE protocol itself is secured through an IKE SA created using the

Diffie-Hellman algorithm (Oakley) to determine the key, and the authentication

methods described in “

Automated Security Associations Using Internet Key

Exchange (IKE)” on page 1-12. The Nortel Networks implementation uses a

pre-shared key.

Security Parameter Index (SPI)

A security parameter index (SPI) is an arbitrary but unique 32-bit (4 byte) value

that, when combined with the IP destination address and the numeric value of the

security protocol used (ESP), uniquely identifies the SA for a data packet.

IPsec discards any incoming ESP packet if the SPI does not match any SA in the

inbound security associations database (SAD).

IP0079A

Network

Security gateway Security gateway

132.245.145.195

132.245.145.205

Protect SA

Source: 132.245.145.205

Destination: 132.245.145.195

Protect SA

Source: 132.245.145.195

Destination: 132.245.145.205

Unprotect SA

Source: 132.245.145.205

Destination: 132.245.145.195

Unprotect SA

Source: 132.245.145.195

Destination: 132.245.145.205

1 2 ... 28 29 30 31 32 33 34 35 36 37 38 ... 121 122

Keine Kommentare

Avaya Configuring IPsec Services Bedienungsanleitung Seite 33