Zyxel-communications Internet Security Gateway ZyWALL 100 Manuel d'utilisateur télécharger pdf (Page 283)

ZyWALL 100 Internet Security Gateway

27-6 Introduction to IPSec

A NAT device in between the IPSec endpoints will rewrite either the source or destination address with one

of its own choosing. The VPN device at the receiving end will verify the integrity of the incoming packet by

computing its own hash value, and complain that the hash value appended to the received packet doesn't

match. The VPN device at the receiving end doesn't know about the NAT in the middle, so it assumes that

the data has been maliciously altered.

IPSec using ESP in Tunnel mode encapsulates the entire original packet (including headers) in a new IP

packet. The new IP packet's source address is the outbound address of the sending VPN gateway, and its

destination address is the inbound address of the VPN device at the receiving end. When using ESP protocol

with authentication, the packet contents (in this case, the entire original packet) are encrypted. The encrypted

contents, but not the new headers, are signed with a hash value appended to the packet.

Tunnel mode ESP with authentication is compatible with NAT because integrity checks are performed over

the combination of the "original header plus original payload," which is unchanged by a NAT device.

Transport mode ESP with authentication is not compatible with NAT.

Table 27-1 VPN and NAT

SECURITY PROTOCOL MODE NAT

Transport N

Tunnel N

ESP

Transport N

ESP

Tunnel Y

1 2 ... 278 279 280 281 282 283 284 285 286 287 288 ... 355 356

Pas de commentaire

Zyxel-communications Internet Security Gateway ZyWALL 100 Manuel d'utilisateur Page 283