Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

to-live (TTL) field in the IP header of the encapsulated (RED) packets of the forwarded packets
so that they remain transparent to the packet flow. (Note: if they are end-systems, they similarly
will not decrement the TTL. However, if they are routers, then they will need to decrement the
TTL because that is normal router behavior.)
The selected VPN approach for this architecture uses IPsec in tunnel mode. It was designed by
the L3VPN working group of the IETF [100]. This VPN design is entitled “Architecture for the
Use of PE-PE IPsec Tunnels in BGP/MPLS IP VPNs” [99]. (Note: at the time of this writing,
reference 99 has passed the IETF L3VPN working group’s last call and is currently in the RFC
editor’s queue to be issued as an Informational RFC.) This is the secured IPsec variant to the
L3VPN’s VPN design approach, which is “BGP/MPLS IP Virtual Private Networks” that was
defined in RFC 4364. RFC 4364 is an IETF Proposed Standard protocol.
The high-level architectural view of figure 30 does not show the encapsulation method
recommended by this architecture. The encapsulation method detail is shown in figure 33.
Section 5.6 introduced the concept of VPN and section 5.2 described the current DoD COMSEC
approach using a type of IPsec VPN. The particular VPN variant selected for this design was
chosen because of its scalability, minimal latency, and high security properties. However, other
VPN alternatives also exist (e.g., Intra-Site Automatic Tunnel Addressing Protocol (see RFC
4214); IP with virtual link extension [101]; Teredo (see RFC 4380); and the bump-in-the-wire
security gateway of RFC 4301).
Aircraft
Level A
Level D
Inner IP header
addressed using
“Level A”
IP Address
Space
Inner IP header
addressed using
“Level D”
IP Address
Space
Encapsulation
Gateway
Encapsulation
Gateway
Outer IP header
Addressed using
“Service Provider”
IP Address Space
High Assurance LAN
Outer IP header
Addressed using
“Service Provider”
IP Address Space
Figure 33. Close-Up Detail of How Encapsulation is Accomplished
Figure 34 shows the current architecture that underlies this design. This figure, which is a copy
of Figure 1.1 from RFC 4110, shows that an ISP provides a provider edge (PE) interface to their
network services. The fact that these network services are physically conveyed via a VPN
through the service provider’s network infrastructure is not necessarily known to their
customers, who interface to the PE interface device via their own Customer Edge (CE) device.
109