3Com 10014299 manual IPSec Protocol

40 CONFIGURING IPSEC

	This chapter covers the following topics:
	■	IPSec Protocol Overview
	■	Configuring IPSec
	■ Creating a Security Policy
	■ Displaying and Debugging IPSec
	■	IPSec Configuration Example
	■	Troubleshooting IPSec
IPSec Protocol	IPSec is the general name of a series of network security protocols that provide
Overview	services such as access control, connectionless integrity, data authentication,
	anti-replay, encryption and classified encryption of data flow for both
	communication parties.

With IPSec, it is unnecessary to worry about the data to be monitored, modified or forged when they are transmitted in public network, which enables secure access to VPN (Virtual Private Network), including internal, external networks and that between remote users.

NDEC Card In actual implementation, the packets processing performed by IPSec includes processing ESP protocol, adding an authentication header to packets after encryption, and deleting the authentication header after packets are authenticated. To ensure security, the algorithms of encryption, decryption, and authentication are very complicated. The encryption and decryption algorithm process of the router occupies large quantities of resources; as a result the performance of the integrated machine is affected. Using crypto cards (modular plug-in cards), the 3Com modular series routers process encryption and decryption operation in a way of hardware. It improves performance of the router when software is processing the IPSec, and improves the operating efficiency of the router.

A crypto card uses the following procedure to implement encryption/decryption. The host of the router transmits the data to be encrypted or decrypted to the crypto card. Then the crypto card performs the encryption or decryption algorithms, and adds or deletes encryption frame header. After that, the crypto card will send the encrypted or decrypted data back to the host to forward.

Dividing the works of processing user data among multiple crypto cards. 3Com modular series routers can support multiple crypto cards. The host software divides the work of processing the user data among the crypto cards in normal