Avaya Configuring IPsec Services Manual de usuario descargar pdf (Pagina 32)

Configuring IPsec Services

1-12

308630-14.00 Rev 00

Automated Security Associations Using Internet Key Exchange (IKE)

Internet Key Exchange (IKE) is an automated protocol to establish security

associations over the Internet. (IKE is also referred to as the Internet Security

Association Key Management Protocol with Oakley Key Determination, or

ISAKMP/Oakley.) IKE handles negotiating, establishing, modifying, and deleting

security associations.

To set up these security associations, IKE itself must create a confidential, secure

connection between the sender and receiver. Authentication is accomplished with

one or more of the following:

• Pre-shared keys: These are set up ahead of time at each node in a transaction.

• Public key cryptography: Using the RSA public key algorithm, each

member of a transaction authenticates itself to the other using the other

member’s public key to encrypt an authentication value.

• Digital signature: Each member of a transaction sends a digital signature to

the other. The signatures are authenticated using the member’s public key,

obtained via an X.509 digital certificate.

The BayRS implementation of IKE uses pre-shared keys only.

Manual Security Associations

Manually configuring security associations is a more cumbersome and

labor-intensive process than using IKE. If possible, IKE should be used to make

large-scale secure communications practical.

Manually configured SAs often rely on static, symmetric keys on communicating

hosts or security gateways. As such, you must coordinate within your organization

and with outside parties to configure keys that will protect your information.

Security Associations for Bidirectional Traffic

An SA specifies the security services that are applied to data packets traveling in

one direction between security gateways. To secure the traffic in both directions,

the security gateway must have a Protect SA for data transmitted from the local

IPsec interface and an Unprotect SA for data received by the local IPsec interface

(Figure 1-4)

1 2 ... 27 28 29 30 31 32 33 34 35 36 37 ... 121 122

Sin comentarios

Avaya Configuring IPsec Services Manual de usuario Pagina 32