Discussion

Chapter
CHAPTER
3
3
IPSec 3
3.0 Introduction
IP Security (IPSec) is a protocol suite developed in the late 1990s that provides security
services for Layer 3 IP datagrams, which otherwise have no inherent security. It is
defined in RFCs 2401 through 2412. IPSec is optional for IPv4 and mandatory for
IPv6. Because it operates at Layer 3, IPSec provides security for higher-level traffic,
including TCP and UDP.
The IPSec suite defines the security protocols, the algorithms used to provide security,
and the cryptographic keys required to provide the services.
Traffic protection is provided by two security protocols, Authentication Header (AH)
and Encapsulation Security Payload (ESP). AH provides connectionless integrity and
data origin authentication for IP packets, authenticating the complete packet, including
the IP header, except for IP header fields that change in transit. It also provides
protection against replay attacks, a type of network attack in which valid data is
maliciously transmitted repeatedly. ESP offers encryption to provide data confidentiality,
and it authenticates the packet payload and the ESP header itself, but not the
outer IP header. In the JUNOS software, you can configure either AH or ESP, or a
combination of the two.
IPSec authentication algorithms use a shared key to verify the identity of the sending
IPSec device. The protocol suite defines two algorithms, MD5 and SHA1. MD5 uses
a one-way hash function to convert messages to a 128-bit digest. The calculated
digest is compared with one that has been decrypted with a shared key, and if the
two match, the IPSec device is authenticated. SHA1 is a stronger algorithm, producing
a 160-bit digest. The JUNOS software implements the HMAC version of both
these algorithms, and they are available for the AH and ESP protocols and for the
Internet Key Exchange (IKE) protocol, which establishes and maintains SAs and
exchanges the authentication and encryption keys between IPSec devices.
106
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.