Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 14: Configuring Virtual Private Networks
Sidewinder G2 VPN overview
396
VPN configuration options
VPN involves establishing an association (or a trust relationship) between your
Sidewinder G2 and an IPSec-compliant remote Sidewinder G2, host, or client.
(These entities are referred to as “VPN peers.”) Once this trust relationship is
defined, data sent between the two ends is encrypted and then authenticated
before it is transmitted. There are three important concepts that comprise the
Sidewinder G2 VPN:
• IPSec keys, which determine how the information is encrypted and
decrypted, and may be manually or automatically exchanged.
• certificates, pre-shared passwords, and extended authentication, which
authenticate the VPN peer.
• tunnel or transport encapsulation, two methods of how header information
is passed.
Understanding the options associated with each concept will assist you greatly
in creating your security association. Study the following information to help
you determine which VPN configuration best suits your network environment.
About IPSec keys
A key is a number that is used to electronically sign, encrypt and authenticate
data when you send it, and decrypt and authenticate your data when it is
received. When a VPN is established between two sites, two keys are
generated for each remote end: an encryption key and an authentication key.
To prevent these keys from being guessed or calculated by a third party, a key
is a large number. Encryption and authentication (or session) keys are unique
to each VPN security association you create.
Once generated, these keys are exchanged (either automatically or manually)
between the sites, so that each end of the VPN knows the other end’s keys.
To generate key pairs, the Sidewinder G2 gives you two options:
• Manual key generation — If the remote site is not Internet Key Exchange
(IKE)-compliant, you may want to choose the manual method of key
generation. With this method, the Sidewinder G2 provides randomlygenerated
encryption and authentication keys (or you can create your own)
which you must copy and pass to the remote end of the VPN via secure email,
diskette, or telephone. Repeat this process each time you generate
keys. Manual keys are more labor intensive than automatic keys and rarely
used.
• Automatic key generation using IKE — If the remote end of your VPN uses
the IKE protocol, the Sidewinder G2 can manage the generation of session
keys between sites automatically. This process also regularly changes the
keys to avoid key-guessing attacks. Automatic keys are very common in
today’s network environments.