Patton electronic SmartNode 4110 Series manual Transport and tunnel modes, Permanent IKE Tunnels

SmartWare Software Configuration Guide 32 • VPN configuration

Transport and tunnel modes

The mode determines the payload of the ESP packet and hence the application:

•Transport mode: Encapsulates only the payload of the original IP packet, but not its header, so the IPsec peers must be at the endpoints of the communications link.

•A secure connection between two hosts is the application of the transport mode.

•Tunnel mode: Encapsulates the payload and the header of the original IP packet. The IPsec peers can be (edge) routers that are not at the endpoints of the communications link.

A secure connection of the two (private) LANs, a ‘tunnel’, is the application of the tunnel mode.

Permanent IKE Tunnels

By default, IKE tunnels are established as late as possible (when the first packet is flowing through) and IKE tunnels with expired lifetimes are reestablished only in case there is traffic flowing through. With the perma- nent option set, IKE tunnels are established shortly after boot and are reestablished after the expiration of their lifetime even if there was no traffic flowing through.

Mode: Configure

Step	Command	Purpose
1	node(pf-ipsik)[name]#protected- net-	Optionally, if the remote system requires protected
	work {host <local-host-ip>}{subnet	networks to be specified in the identity payload of
	<local-subnet-address> <local-subnet-	the quick mode, you can define one or more pro-
	mask>}{range <local-range-start>	tected networks using this command. If the tunnel
	<local-range-end>} {host <remote-host-	shall be established permanently the permanent-
	ip>}{subnet <remote-subnet-address>	tunnel flag must be set.
	<remote-subnet-mask>}{range
	<remote-range-start><remote-range-
	end>} [permanent-tunnel]

Key management

The current implementation of IP works with pre-shared keys (also called manual keying or manual IPsec) or using Internet Key Exchange (IKE). Keys are manually generated, distributed, and stored as a hexa-decimal string in the startup-configuration of the SmartNode and its peer.

Note Depending on the processing hardware applied to reverse engineering a DES key, it can take from 3 hours to 3 days to break the key. Thus, for maximum security, DES keys must be manually updated regularly. AES- or 3DES-keys, because they are much more complex, take so much longer to break as to be practically infinite.

The automatically keyed IPSEC connections using the Internet Key Exchange (IKE / RFC2409) protocol that is based on Internet Security Association and Key Management Protocol (ISAKMP / RFC2408) is the other option. IKE supports authentication using pre-shared keys. There is currently no support for authentication using Public Key Infrastructure (PKI) and digital certificates.

Introduction 364