Enterasys Networks CSX5500, CSX6000, CSX7000 manual 12345678 8888CCCC, 8888CCCC 12345678

CONFIGURING ENCRYPTION

Encryption Background Information

The peer must also have corresponding Security Associations. (Note that the gateway address and the source/destination subnet addresses are switched to reflect the peer subnet.)

Security Associations between peer CyberSWITCH nodes are identified by a Security Parameter Index (SPI). The SPI is transmitted in the ESP header and is used by the peer node to identify the necessary information to decrypt the ESP payload.

IP ENCRYPTION EXAMPLE

"SITE A"	Untrusted Media		"SITE B"
			CSX5500
CSX5500		197.1.1.1
	197.4.1.1

INTERNET

Trusted

Subnet

197.4.2.2

Trusted

Subnet

197.1.2.2

Site “A”	Security Associations
	Outgoing:	Incoming:
Final Destination:	197.1.2.2	197.4.2.2
Mask:	16 bits	16 bits
Destination gateway:	197.1.1.1	197.1.1.1
Shared Secret Key:	AAABBB1234567890	9876543210ABCDEF
SPI:	12345678	8888CCCC
Site “B”	Security Associations
	Outgoing:	Incoming:
Final Destination:	197.4.2.2	197.1.2.2
Mask:	16 bits	16 bits
Destination gateway:	197.4.1.1	197.4.1.1
Shared Secret Key:	9876543210ABCDEF	AAABBB1234567890
SPI:	8888CCCC	12345678

AUTHENTICATION HEADERS

Authentication Header (AH) protocol provides integrity and authentication for IP datagrams by assuring that a received packet originated from the destination it claims. Packets originating from the CyberSWITCH may be authenticated with AH protocol, as long as AH is enabled and properly configured.

Central Site Remote Access Switch 237