User manual ZYXEL VANTAGE CNM V2.0

[. . . ] Vantage CNM 2. 0 Centralized Network Management User's Guide Version 2. 0. 00. 81. 10 2. 0. 00. 61. 10 July 2004 Vantage CNM 2. 0 User's Guide Copyright Copyright © 2004 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Note: Refer also to the "Open Software Announcements" on page 316. Disclaimer ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. [. . . ] This service depends on the data integrity service. 11. 1. 7 IPSec Algorithms The ESP and AH protocols are necessary to create a Security Association (SA), the foundation of an IPSec VPN. An SA is built from the authentication provided by the AH and ESP protocols. The primary function of key management is to establish and maintain the SA between systems. Once the SA is established, the transport of data may commence. 11. 1. 7. 1 AH (Authentication Header) Protocol AH protocol (RFC 2402) was designed for integrity, authentication, sequence integrity (replay resistance), and non-repudiation but not for confidentiality, for which the ESP was designed. In applications where confidentiality is not required or not sanctioned by government encryption restrictions, an AH can be employed to ensure integrity. This type of implementation does not protect the information from dissemination but will allow for verification of the integrity of the information and authentication of the originator. 11. 1. 7. 2 ESP (Encapsulating Security Payload) Protocol The ESP protocol (RFC 2406) provides encryption as well as some of the services offered by AH. ESP authenticating properties are limited compared to the AH due to the non-inclusion of the IP header information during the authentication process. However, ESP is sufficient if only the upper layer protocols need to be authenticated. An added feature of the ESP is payload padding, which further protects communications by concealing the size of the packet being transmitted. Table 52 AH and ESP ESP AH DES (default) MD5 (default) Data Encryption Standard (DES) is a widely used method MD5 (Message Digest 5) produces a 128of data encryption using a secret key. 3DES SHA1 Triple DES (3DES) is a variant of DES, which iterates three SHA1 (Secure Hash Algorithm) produces times with three separate keys (3 x 56 = 168 bits), a 160-bit digest to authenticate packet effectively doubling the strength of DES. data. 149 Chapter 11 Configuration > VPN Vantage CNM 2. 0 User's Guide Table 52 AH and ESP (continued) ESP AES Advanced Encryption Standard data encryption uses a secret key. This implementation of AES applies a 128-bit key to 128-bit blocks of data. AH 11. 1. 8 Key Management Key management allows you to determine whether to use IKE (ISAKMP) or manual key configuration in order to set up a VPN. 11. 1. 9 Encapsulation The two modes of operation for IPSec VPNs are Transport mode and Tunnel mode. 11. 1. 9. 1 Transport Mode Transport mode is used to protect upper layer protocols and only affects the data in the IP packet. In Transport mode, the IP packet contains the security protocol (AH or ESP) located after the original IP header and options, but before any upper layer protocols contained in the packet (such as TCP and UDP). With ESP, protection is applied only to the upper layer protocols contained in the packet. The IP header information and options are not used in the authentication process. Therefore, the originating IP address cannot be verified for integrity against the data. With the use of AH as the security protocol, protection is extended forward into the IP header to verify the integrity of the entire packet by use of portions of the original IP header in the hashing process. 11. 1. 9. 2 Tunnel Mode Tunnel mode encapsulates the entire IP packet to transmit it securely. A Tunnel mode is required for gateway services to provide access to internal systems. Tunnel mode is fundamentally an IP tunnel with authentication and encryption. Tunnel mode is required for gateway to gateway and host to gateway communications. Tunnel mode communications have two sets of IP headers: · Outside header: The outside IP header contains the destination IP address of the VPN gateway. [. . . ] Any other use of the Software by any other entity is strictly forbidden and is a violation of this License Agreement. 3. Copyright The Software and Documentation contain material that is protected by United States Copyright Law and trade secret law, and by international treaty provisions. You may not remove any proprietary notice of ZyXEL or any of its licensors from any copy of the Software or Documentation. 4. Restrictions 343 Vantage CNM 2. 0 User's Guide You may not publish, display, disclose, sell, rent, lease, modify, store, loan, distribute, or create derivative works of the Software, or any part thereof. You may not assign, sublicense, convey or otherwise transfer, pledge as security or otherwise encumber the rights and licenses granted hereunder with respect to the Software. You may not copy, reverse engineer, decompile, reverse compile, translate, adapt, or disassemble the Software, or any part thereof, nor shall you attempt to create the source code from the object code for the Software. [. . . ]