Netopia 3346N-ENT User Guide (en)

Download
Internet Key Exchange (IKE) IPsec Key Management for VPNs   6-1
C
C
C
Ch
h
h
haa
a
ap
p
p
pttttee
e
errrr    6
6
6
6
IIIIn
n
n
nttttee
e
errrrn
n
n
nee
e
etttt    K
K
K
Kee
e
eyyy
y    E
E
E
Exxxxcccch
h
h
haa
a
an
n
n
ng
g
g
gee
e
e    ((((IIIIK
K
K
KE
E
E
E))))    IIIIP
P
P
Pssssee
e
ecccc    K
K
K
Kee
e
eyyy
y    
M
M
M
Maa
a
an
n
n
naa
a
ag
g
g
gee
e
em
m
m
mee
e
en
n
n
ntttt    ffffo
o
o
orrrr    V
V
V
VP
P
P
PN
N
N
Nssss
IPsec stands for IP Security, a set of protocols that suppor ts secure exchange of IP packets at the IP layer. 
IPsec is deployed widely to implement Vir tual Private Networks (VPNs). See 
 for more information.
The Netopia Firmware Version 8.6.1 suppor ts Internet Key Exchange (IKE) for secure encr ypted communication 
over a VPN tunnel.
This chapter covers the following topics:
Overview
IPsec suppor ts two encapsulation modes: Transpor t and Tunnel. Transpor t mode encr ypts only the data por tion 
(payload) of each packet, but leaves the header untouched. Tunnel mode encr ypts both the header and the 
payload. On the receiving side, an IPsec-compliant device decr ypts each packet. Netopia Routers suppor t 
Tunnel mode.
DES stands for Data Encr yption Standard, a popular symmetric-key encr yption method. DES uses a 56-bit key. 
Netopia Routers offer IPsec 3DES (triple DES) encr yption as a standard option. 
Internet Key Exchange (IKE) is an authentication and encr yption key management protocol used in conjunction 
with the IPsec standard.
IKE is a two-phase protocol for key exchange.
Phase 1 authenticates the security gateways and establishes the Security Parameters (SPs) they will use 
to negotiate on behalf of the clients. Security Associations (SAs) are sets of information values that allow 
the two devices on the Internet to communicate securely.
Phase 2 establishes the tunnel and provides for secure transpor t of data.
IPsec can be configured without IKE, but IKE offers additional features, flexibility, and ease of configuration. Key 
exchange between your local Router and a remote point can be configured either manually or by using the key 
exchange protocol.