Filter
Top Products
Introduction 364
SmartWare Software Configuration Guide 32 • VPN configuration
Transport and tunnel modes
The mode determines the payload of the ESP packet and hence the application:
• Transport mode: Encapsulates only the payload of the original IP packet, but not its header, so the IPsec
peers must be at the endpoints of the communications link.
• A secure connection between two hosts is the application of the transport mode.
• Tunnel mode: Encapsulates the payload and the header of the original IP packet. The IPsec peers can be
(edge) routers that are not at the endpoints of the communications link.
A secure connection of the two (private) LANs, a ‘tunnel’, is the application of the tunnel mode.
Permanent IKE Tunnels
By default, IKE tunnels are established as late as possible (when the first packet is flowing through) and IKE
tunnels with expired lifetimes are reestablished only in case there is traffic flowing through. With the perma-
nent option set, IKE tunnels are established shortly after boot and are reestablished after the expiration of their
lifetime even if there was no traffic flowing through.
Mode: Configure
Key management
The current implementation of IP works with pre-shared keys (also called manual keying or manual IPsec) or
using Internet Key Exchange (IKE). Keys are manually generated, distributed, and stored as a hexa-decimal
string in the startup-configuration of the SmartNode and its peer.
Note Depending on the processing hardware applied to reverse engineering a DES
key, it can take from 3 hours to 3 days to break the key. Thus, for maximum
security, DES keys must be manually updated regularly. AES- or 3DES-keys,
because they are much more complex, take so much longer to break as to be
practically infinite.
The automatically keyed IPSEC connections using the Internet Key Exchange (IKE / RFC2409) protocol that
is based on Internet Security Association and Key Management Protocol (ISAKMP / RFC2408) is the other
option. IKE supports authentication using pre-shared keys. There is currently no support for authentication
using Public Key Infrastructure (PKI) and digital certificates.
Step Command Purpose
1 node(pf-ipsik)[name]#protected- net-
work {host <local-host-ip>}|{subnet
<local-subnet-address> <local-subnet-
mask>}|{range <local-range-start>
<local-range-end>} {host <remote-host-
ip>}|{subnet <remote-subnet-address>
<remote-subnet-mask>}|{range
<remote-range-start><remote-range-
end>} [permanent-tunnel]
Optionally, if the remote system requires protected
networks to be specified in the identity payload of
the quick mode, you can define one or more pro-
tected networks using this command. If the tunnel
shall be established permanently the permanent-
tunnel flag must be set.