18.07.2013 Views

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

<strong>Sidewinder</strong> <strong>G2</strong> VPN overview<br />

13-6 Configuring Virtual Private Networks<br />

a pre-shared password — When you must generate keys, the<br />

<strong>Sidewinder</strong> <strong>G2</strong> and the remote end must both use the agreed upon<br />

password, defined during the initial configuration <strong>of</strong> the VPN, to<br />

authenticate each peer.<br />

a single certificate — Single certificate authentication requires that<br />

the <strong>Sidewinder</strong> <strong>G2</strong> generate a certificate and private key to be kept<br />

on the <strong>Sidewinder</strong> <strong>G2</strong> and a certificate and private key to be<br />

exported and installed on a client. Each certificate, once installed<br />

on its end <strong>of</strong> a VPN connection, acts as a trust point. A single<br />

certificate (also referred to as a "self-signed certificate") differs from<br />

Certificate Authority (CA) based certificates in that no root<br />

certificate is necessary.<br />

a Certificate Authority policy — The <strong>Sidewinder</strong> <strong>G2</strong> can be configured<br />

to trust certificates from a particular certificate authority (CA).<br />

Thus, it will trust any certificate that is signed by a particular CA<br />

and meets certain administrator-configured requirements on the<br />

identity contained within the certificate. Because <strong>of</strong> the nature <strong>of</strong><br />

this type <strong>of</strong> policy, Secure Computing recommends that only<br />

locally administered Certificate Authorities be used in this type <strong>of</strong><br />

policy. Certificate authorities are described further in “Configuring<br />

Certificate Management” later in this chapter.<br />

Transport mode vs. tunnel mode<br />

There are two methods for encapsulating packets in a VPN<br />

connection: transport mode and tunnel mode. The following<br />

paragraphs provide a description <strong>of</strong> each method.<br />

Transport mode — In transport mode, only the data portion <strong>of</strong> the<br />

packet gets encrypted. This means that if a packet is intercepted, a<br />

hacker will not be able to read your information, but will be able<br />

to determine where it is going and where it has originated. This<br />

mode existed before firewalls and was designed for host-to-host<br />

communications.<br />

Tunnel mode — In tunnel mode, both the header information and<br />

the data is encrypted and a new packet header is attached. The<br />

encryption and new packet header act as a secure cloak or<br />

"tunnel" for the data inside. If the packet is intercepted, a hacker<br />

will not be able to determine any information about the true<br />

origin, final destination or data contained within the packet. This<br />

mode is designed to address the needs <strong>of</strong> hosts that exist behind a<br />

<strong>Sidewinder</strong> <strong>G2</strong>. Because the packet header is encrypted, private<br />

source or destination IP addresses can remain hidden.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!