Discussion

Encryption, which is the encoding of packet data, is also done with algorithms that
create and verify shared keys. The JUNOS software implements DES and Triple-DES
for encryption, both with cipher block chaining (CBC). DES-CBC uses a 64-bit key
for encryption (56 bits for encryption and 8 bits for error checking), and the stronger
3DES-CBC uses three times the number of bits (168 bits) for encryption.
To identify the traffic to protect, IPSec creates security associations (SAs) to negotiate
the desired security services. Each SA, which is identified by a security parameter
index (SPI), defines preferences for authentication, encryption, and security protocol.
SAs can be either unidirectional or bidirectional and are created either manually
or dynamically. For manual SAs, you configure matching preset shared keys for
authentication and encryption, security protocols, and fixed SPI values on both ends
of the IPSec connection. Dynamic SAs are negotiated by IKE, but you can configure
recommended suggestions for all IPSec parameters. As a result of the negotiation
with the peer, an SA pair is set up, one inbound and one outbound. The inbound
half of the SA pair de-encrypts and authenticates the incoming traffic from the IPSec
peer, and the outbound half encrypts and authenticates the outbound traffic going to
the peer.
IPSec SAs operate in one of two modes, tunnel mode or transport mode. A tunnel
mode SA is essentially an IP tunnel between two security gateways, which are routers
or other devices protecting the networks behind them. One common way to use
tunnel mode is to send secure traffic between two sites on an intranet (that is, within
a corporate network). The router at each end of the tunnel acts as a security gateway.
Any data transferred between the two sites is protected as it traverses the tunnel
between the security gateways. Transport mode provides security between two hosts,
protecting traffic (such as OSPF and BGP traffic) that is destined for the router itself.
For a tunnel mode SA, an IP header specifies the IPsec processing destination and an
inner IP header specifies the packet’s ultimate destination. The security protocol
header is placed between the outer and inner headers. If the protocol is AH, portions
of the outer IP header and the entire tunneled IP packet (the inner IP header
and the higher-layer protocols) are protected. With ESP, only the tunneled packet is
protected, not the outer header.
To use IPSec with M-series and T-series routers, the router must have either an ES
PIC or an Adaptive Services (AS) PIC. The configuration for these two PICs differs
slightly. The J-series routers also run IPSec but require no additional hardware
because they have built-in AS functionality. In this chapter, we show how to configure
IPSec with both PICs.
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.
Introduction | 107