40 CONFIGURING IPSEC
This chapter covers the following topics:
■IPSec Protocol Overview
■Configuring IPSec
■Creating a Security Policy
■Displaying and Debugging IPSec
■IPSec Configuration Example
■Troubleshooting IPSec

IPSec Protocol

Overview IPSec is the general name of a series of network security protocols that provide
services such as access control, connectionless integrity, data authentication,
anti-replay, encryption and classified encryption of data flow for both
communication parties.
With IPSec, it is unnecessary to worry about the data to be monitored, modified or
forged when they are transmitted in public network, which enables secure access
to VPN (Virtual Private Network), including internal, external networks and that
between remote users.
NDEC Card In actual implementation, the packets processing performed by IPSec includes
processing ESP protocol, adding an authentication header to packets after
encryption, and deleting the authentication header after packets are
authenticated. To ensure security, the algorithms of encryption, decryption, and
authentication are very complicated. The encryption and decryption algorithm
process of the router occupies large quantities of resources; as a result the
performance of the integrated machine is affected. Using crypto cards (modular
plug-in cards), the 3Com modular series routers process encryption and decryption
operation in a way of hardware. It improves performance of the router when
software is processing the IPSec, and improves the operating efficiency of the
router.
A crypto card uses the following procedure to implement encryption/decryption.
The host of the router transmits the data to be encrypted or decrypted to the
crypto card. Then the crypto card performs the encryption or decryption
algorithms, and adds or deletes encryption frame header. After that, the crypto
card will send the encrypted or decrypted data back to the host to forward.
Dividing the works of processing user data among multiple crypto cards. 3Com
modular series routers can support multiple crypto cards. The host software
divides the work of processing the user data among the crypto cards in normal