TCP/IP Tutorial and Technical Overview - IBM Redbooks

Case 4: Remote access
This case, shown in Figure 22-37, applies to remote hosts that use the Internet to
reach a server in the organization protected by a firewall. The remote host
typically uses a PPP dial-in connection to an ISP.
H1
Internet/
intranet
Figure 22-37 Remote access
Between the remote host H1 and the firewall G2, only tunnel mode is required.
The choices are the same as in case 2. Between the hosts themselves, either
tunnel mode or transport mode can be used, with the same choices as in case 1.
A typical setup is to use AH in tunnel mode between H1 and G2 and ESP in
transport mode between H1 and H2. Older IPSec implementations that do not
support AH in tunnel mode cannot implement this.
It is also common to create a combined AH-ESP tunnel between the remote host
H1 and the gateway G2. In this case, H1 can access the whole intranet using just
one SA bundle, while if it were using the setup shown in Figure 22-37, it only
could access one host with one SA bundle.
22.4.5 Internet Key Exchange (IKE) protocol
The Internet Key Exchange (IKE) framework, previously referred to as
ISAKMP/Oakley, supports automated negotiation of Security Associations, and
automated generation and refresh of cryptographic keys. The ability to perform
these functions with little or no manual configuration of machines is a critical
element to any enterprise-scale IPSec deployment.
G2
Connection IPSec tunnels
intranet
H2
Chapter 22. TCP/IP security 829