|
|
|
|
|
| |
| |
|
IPSec Guides
| |
| |
| |
| |
| |
| |
| |
|
|
This document presents the document roadmap for IPSec, as well as a
host-to-host architectural model, followed by a sequence of slides illustrating
IPSec traffic processing related to this model.
Architecture & Traffic Processing
-- 2 March 2005, v1.0
Figure 1 depicts one side of an IPSEC peer-to-peer relationship.
The meaning of the abbreviations that are used in this figure is as follows:
| AH | Authentication Header |
| ESP | Encapsulating Security Payload |
| SA | Security Association |
| SAD | Security Association Database |
| SPD | Security Policy Database |
| IKE | Internet Key Exchange |
| ISAKMP | Internet Security Association and Key Management Protocol |
|
Figure 1: IPSec Architectural Components
|
| |
| |
| |
| |
| |
| |
| |
|
|
This document illustrates, as a synopsis, the IPSec encapsulation of secured
IP packets according to IPSec protocol (AH or ESP) and mode (Transport or Tunnel).
IPSec Modes & Protocols
-- 12 October 2006, v1.1
|
Figure 2: Synopsis of IPSec Modes and Protocols
|
| |
| |
| |
| |
| |
| |
| |
|
|
This document illustrates IKE message formats.
These formats result from ISAKMP framework definition (RFC 2408) refined
by IPSec DOI (domain of interpretation, defined in RFC 2407) for phase 2 attributes,
and finally appendix A of RFC 2409 (IKE) for phase 1 attributes.
Color codes are used consistently throughout this document for relevant
information sources.
ISAKMP & IKE Formats
-- 2 March 2005, v1.0
|
Figure 3: IKE Structure
|
| |
| |
| |
| |
| |
| |
| |
|
|
This document shows detailed time diagrams for Phase 1 and Phase 2 IKE exchanges.
Phase 1 is where two IKE peers establish the ISAKMP Security Association, a secure
and authenticated channel. The four authentication methods defined in RFC2409 are
illustrated, in "Main" mode only.
Phase 2 is where Security Associations are negotiated on behalf of IPSec. The "Quick" mode exchanges are detailed with and without PFS (perfect forward secrecy) service.
IKE Exchanges
-- 2 March 2005, v1.0
|
Figure 4: IKE Phase 1 Exchanges in Main Mode
|
| |
| |
| |
| |
| |
| |
| |
|
|
This document illustrates IKEv2 message formats as defined in
RFC4306
-- Internet Key Exchange (IKEv2) Protocol.
This version of the IKE specification combines the contents of what
were previously separate documents, including ISAKMP (RFC 2408), IKE
(RFC 2409), the Internet DOI (RFC 2407), NAT Traversal, Legacy
authentication, and remote address acquisition.
Version 2 of IKE does not interoperate with version 1, but it has
enough of the header format in common that both versions can
unambiguously run over the same UDP port.
IKEv2 Formats
-- 2 March 2005, v1.0
|
Figure 5: IKEv2 Formats
|
| |
| |
| |
| |
| |
|
|
|
|
