Symantec™ Security Gateways Reference Guide - Sawmill

98 Understanding VPN tunnelsIPsec standardThe security gateway supports both the DEFLATE and LZS compression algorithms. Additionalinformation on the DEFLATE compression algorithm is found in RFC 1951 and additional information onthe LZS compression algorithm is found in RFC 1974.Warning: Turning on compression is highly CPU intensive, and degrades the security gateway’sperformance with tunnel traffic.Tunnel encryption keysThe encryption method used to keep tunnel traffic private requires tunnel encryption keys. These keysmust either be manually defined or generated dynamically. While it is more common to have keysgenerated dynamically, the security gateway both static and dynamic tunnel encryption keys.Static keysVPN tunnels support static configurations, where tunnel parameters are created at each security gateway.Both ends have to have the same parameters, including secret keys, security parameter indexes (SPIs),authentication schemes, encryption methods, and so forth. However, this system is cumbersome forseveral reasons:■■■■Administrators can enter the wrong information by mistake.Administrators have to select SPIs from a list of unused SPIs.Administrators have to negotiate what encryption and authentication schemes to use.There is no way to implement key expiration except manually.Dynamic keysThe Internet Key Exchange (IKE) protocol allows for the negotiation and dynamic creation of IPsec tunnels.The Internet Security Association and Key Management Protocol (ISAKMP) defines the procedure tonegotiate keys, establish SPIs, negotiate transforms, and provide key expiration for greater security andflexibility in VPN setup. Key negotiation, security parameter indices, and transform negotiations are alldone dynamically, and for this reason, there is no field for key generation when an IPsec/IKE policy isselected. The security gateway’s IKE component negotiates with its peer IKE application on the otherdevice to determine the encryption algorithm keys and authentication algorithm keys and SPIs of the IPsecprotocol (AH, ESP) for a specific VPN.The negotiation occurs in two phases. In Phase I, the IKE application creates an IKE security associationwith its peer to protect Phase II of the negotiation, which determines the protocol security association forthe tunnel. For Gateway-to-Gateway VPN tunnel connections, either system can initiate Phase I or Phase IIrenegotiation at any time. Both specify intervals after which to renegotiate. For Client-to-Gateway VPNtunnel connections, only the client can initiate Phase I or Phase II renegotiation. Phase II renegotiation isreferred to as quick mode renegotiation, because no Phase I renegotiation is performed.