Avaya Configuring IP Security Services Manual de usuario descargar pdf (Pagina 40)

Configuring IPsec Services

2-4

304111-B Rev 00

Securing Your Site

To enforce IPsec, carefully restrict unauthorized access to the routers that encrypt

data and the workstations that you use to configure IPsec. Keep in mind that the

encryption standards that IPsec uses are public. Your data is secure only if you

properly protect the encryption and authentication keys. The configuration files

that contain these keys include safeguards to prevent unauthorized access.

Securing Your Configuration

Store any files containing encryption keys on diskettes or other removable media,

and keep the media in a secure place. Physically protecting your equipment is

always a good strategy and the easiest way to prevent unauthorized access to these

files.

Always configure your node protection keys (NPKs) locally, not over a network.

When you connect a PC or a workstation to a router console port to configure

encryption, use a machine that is not connected to any other equipment. Be sure to

also protect the routers on which the NPKs reside.

Encryption Keys

IPsec uses a hierarchy of keys to protect and transmit data:

• Node protection key (NPK) -- encrypts the manual cipher and integrity keys

for storage on the router or transfer from Site Manager.

-- Cipher key -- encrypts data that travels across the network in the IKE or

ESP payload. (IKE cipher and integrity keys are not stored on the router.)

-- Integrity key -- calculates the integrity check value (ICV), which is used

at the data packet destination to detect any unauthorized modification of

the ESP or IKE data.

• Pre-shared authentication key -- authenticates the IKE SA used to protect the

negotiation and rekeying of IPsec SAs.

Caution:

The NPK is the most critical key in the hierarchy. If the NPK is

compromised, all encrypted data on the router can be compromised.

1 2 ... 35 36 37 38 39 40 41 42 43 44 45 ... 99 100

Sin comentarios

Avaya Configuring IP Security Services Manual de usuario Pagina 40