ZyXEL Communications wireless n gigbit router zyxel IPSec SA Proposal and Perfect Forward Secrecy

Chapter 15 IPSec VPN

In transport mode, the encapsulation depends on the IPSec protocol. With AH, the NBG-460N includes part of the original IP header when it encapsulates the packet. With ESP, however, the NBG-460N does not include the IP header when it encapsulates the packet, so it is not possible to verify the integrity of the source IP address.

15.6.9 IPSec SA Proposal and Perfect Forward Secrecy

An IPSec SA proposal is similar to an IKE SA proposal (see IKE SA Proposal on page 219), except that you also have the choice whether or not the NBG-460N and remote IPSec router perform a new DH key exchange every time an IPSec SA is established. This is called Perfect Forward Secrecy (PFS).

If you enable PFS, the NBG-460N and remote IPSec router perform a DH key exchange every time an IPSec SA is established, changing the root key from which encryption keys are generated. As a result, if one encryption key is compromised, other encryption keys remain secure.

If you do not enable PFS, the NBG-460N and remote IPSec router use the same root key that was generated when the IKE SA was established to generate encryption keys.

The DH key exchange is time-consuming and may be unnecessary for data that does not require such security.

15.6.10 Additional IPSec VPN Topics

This section discusses other IPSec VPN topics that apply to either IKE SAs or IPSec SAs or both. Relationships between the topics are also highlighted.

SA Life Time

SAs have a lifetime that specifies how long the SA lasts until it times out. When an SA times out, the NBG-460N automatically renegotiates the SA in the following situations:

•There is traffic when the SA life time expires

•The IPSec SA is configured on the NBG-460N as nailed up (see below)

Otherwise, the NBG-460N must re-negotiate the SA the next time someone wants to send traffic.

Note: If the IKE SA times out while an IPSec SA is connected, the IPSec SA stays connected.

NBG-460N User’s Guide

225