ZyXEL Communications NWD-210N - FOR MAC V1.00 Guide de l'utilisateur télécharger pdf (Page 143)

Chapter 18 IPSec VPN

NBG5715 User’s Guide

143

• Main Mode ensures the highest level of security when the communicating parties are

negotiating authentication (phase 1). It uses 6 messages in three round trips: SA negotiation,

Diffie-Hellman exchange and an exchange of nonces (a nonce is a random number). This mode

features identity protection (your identity is not revealed in the negotiation).

• Aggressive Mode is quicker than Main Mode because it eliminates several steps when the

communicating parties are negotiating authentication (phase 1). However the trade-off is that

faster speed limits its negotiating power and it also does not provide identity protection. It is

useful in remote access situations where the address of the initiator is not know by the responder

and both parties want to use pre-shared key authentication.

18.7.5 IPSec and NAT

Read this section if you are running IPSec on a host computer behind the NBG5715.

NAT is incompatible with the AH protocol in both Transport and Tunnel mode. An IPSec VPN using

the AH protocol digitally signs the outbound packet, both data payload and headers, with a hash

value appended to the packet. When using AH protocol, packet contents (the data payload) are not

encrypted.

A NAT device in between the IPSec endpoints will rewrite either the source or destination address

with one of its own choosing. The VPN device at the receiving end will verify the integrity of the

incoming packet by computing its own hash value, and complain that the hash value appended to

the received packet doesn't match. The VPN device at the receiving end doesn't know about the

NAT in the middle, so it assumes that the data has been maliciously altered.

IPSec using ESP in Tunnel mode encapsulates the entire original packet (including headers) in a

new IP packet. The new IP packet's source address is the outbound address of the sending VPN

gateway, and its destination address is the inbound address of the VPN device at the receiving end.

When using ESP protocol with authentication, the packet contents (in this case, the entire original

packet) are encrypted. The encrypted contents, but not the new headers, are signed with a hash

value appended to the packet.

Tunnel mode ESP with authentication is compatible with NAT because integrity checks are

performed over the combination of the "original header plus original payload," which is unchanged

by a NAT device.

Transport mode ESP with authentication is not compatible with NAT.

18.7.6 VPN, NAT, and NAT Traversal

NAT is incompatible with the AH protocol in both transport and tunnel mode. An IPSec VPN using

the AH protocol digitally signs the outbound packet, both data payload and headers, with a hash

value appended to the packet, but a NAT device between the IPSec endpoints rewrites the source or

destination address. As a result, the VPN device at the receiving end finds a mismatch between the

hash value and the data and assumes that the data has been maliciously altered.

Table 57 VPN and NAT

SECURITY PROTOCOL MODE NAT

AH Transport N

AH Tunnel N

ESP Transport N

ESP Tunnel Y

1 2 ... 138 139 140 141 142 143 144 145 146 147 148 ... 291 292

Commentaires sur ces manuels

Pas de commentaire

ZyXEL Communications NWD-210N - FOR MAC V1.00 Guide de l'utilisateur Page 143

Commentaires sur ces manuels

Produits connexes et manuels pour Routeurs ZyXEL Communications NWD-210N - FOR MAC V1.00