download

Chapter 8FreeBSD's IPSec implementation supports both Authenticated Header (AH) andEncapsulated Security Payload (ESP) protocols, which can be used either together,or separately.The AH protocol protects the packets to be modified on their way to theirdestination, by cryptographically hashing the IP header. Consequently, when apacket is modified by an attacker in a man-in-the-middle scenario, this will be easilydetected and discarded by the receiving host. AH does not encrypt the actual packetpayload and is not protected against sniffing and wiretapping.On the other hand, ESP offers a method to encrypt the packet payload usingsymmetric algorithms, including 3des and blowfish. When ESP encryption is ineffect, sniffing traffic does not reveal the actual contents of the packets.There is no conflict between ESP and AH, and they can be used together.Consequently, the packet content can be encrypted while the header is also hashed toprevent modification of packet on the wire.Operating ModesIPSec can operate in two modes—Tunnel mode and Transport mode.In the Tunnel mode, the packet will be completely encrypted and encapsulatedinto another IP packet before being sent to the destination host. In fact, the packetsare actually being tunneled over another IP packet. This mode is suitable to getconnected to another host over an untrusted public network (for example, theInternet). This mode is mostly referred to as IPSec Tunneling or IPSec VPN.The Transport mode offers another method of communication without modifyingthe routing (the source and destination address in IP packet header are notmodified). Instead it encrypts the packet payload or hashes the header to ensure thatthe packet does not get modified in the path between source and destination. Thismode is more suitable for host-to-host communications.Transport mode does not basically work behind a NAT router. SinceNAT needs to modify layer3 or layer4 addressing, this cannot be donewhen the packet is encrypted. Nevertheless, there are some NAT-T (NATTraversal) methods available as per RFC 3715. However, the Tunnel modeis safe to be used with NAT.[ 137 ]