Chapter 20 IPSec VPN
These modes are illustrated below.
Figure 265 VPN: Transport and Tunnel Mode Encapsulation
|
|
|
|
|
|
|
Original Packet | IP Header | TCP | Data |
|
|
|
|
| Header |
|
|
|
|
Transport Mode Packet |
|
|
|
|
|
|
|
|
|
|
|
| |
IP Header | AH/ESP | TCP | Data |
|
| |
|
| Header | Header |
|
|
|
Tunnel Mode Packet |
|
|
|
|
|
|
|
|
|
|
|
| |
IP Header | AH/ESP | IP Header | TCP | Data |
| |
|
| Header |
| Header |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
In tunnel mode, the ZyWALL uses the active protocol to encapsulate the entire IP packet. As a result, there are two IP headers:
•Outside header: The outside IP header contains the IP address of the ZyWALL or remote IPSec router, whichever is the destination.
•Inside header: The inside IP header contains the IP address of the computer behind the ZyWALL or remote IPSec router. The header for the active protocol (AH or ESP) appears between the IP headers.
In transport mode, the encapsulation depends on the active protocol. With AH, the ZyWALL includes part of the original IP header when it encapsulates the packet. With ESP, however, the ZyWALL does not include the IP header when it encapsulates the packet, so it is not possible to verify the integrity of the source IP address.
IPSec SA Proposal and Perfect Forward Secrecy
An IPSec SA proposal is similar to an IKE SA proposal (see IKE SA Proposal on page 373), except that you also have the choice whether or not the ZyWALL and remote IPSec router perform a new DH key exchange every time an IPSec SA is established. This is called Perfect Forward Secrecy (PFS).
If you enable PFS, the ZyWALL and remote IPSec router perform a DH key exchange every time an IPSec SA is established, changing the root key from which encryption keys are generated. As a result, if one encryption key is compromised, other encryption keys remain secure.
If you do not enable PFS, the ZyWALL and remote IPSec router use the same root key that was generated when the IKE SA was established to generate encryption keys.
The DH key exchange is
Additional Topics for IPSec SA
This section provides more information about IPSec SA in your ZyWALL.
380 |
| |
ZyWALL USG 100/200 Series User’s Guide |
| |
|
|
|