NETGEAR VPN User Manual

TechNote: VPN Configuration Case Studies
1-4 VPN Concepts, Tips, and Techniques
Version 1.0, July 2003
The ESP header is inserted into the packet between the IP header and any subsequent packet
contents. However, because ESP encrypts the data, the payload is changed. ESP does not encrypt
the ESP header, nor does it encrypt the ESP authentication.
Authentication Header (AH)
AH provides authentication and integrity, which protect against data tampering, using the same
algorithms as ESP. AH also provides optional anti-replay protection, which protects against
unauthorized retransmission of packets. The authentication header is inserted into the packet
between the IP header and any subsequent packet contents. The payload is not touched.
Although AH protects the packet’s origin, destination, and contents from being tampered with, the
identity of the sender and receiver is known. In addition, AH does not protect the data’s
confidentiality. If data is intercepted and only AH is used, the message contents can be read. ESP
protects data confidentiality. For added protection in certain cases, AH and ESP can be used
together. In the following table, IP HDR represents the IP header and includes both source and
destination IP addresses.
Figure 1-2: Original packet and packet with IPSec Authentication Header
IKE Security Association
IPSec introduces the concept of the Security Association (SA). An SA is a logical connection
between two devices transferring data. An SA provides data protection for unidirectional traffic by
using the defined IPSec protocols. An IPSec tunnel typically consists of two unidirectional SAs,
which together provide a protected, full-duplex data channel.
The SAs allow an enterprise to control exactly what resources may communicate securely,
according to security policy. To do this an enterprise can set up multiple SAs to enable multiple
secure VPNs, as well as define SAs within the VPN to support different departments and business
partners.
Intro2VPN.fm Page 4 Sunday, November 23, 2003 12:57 PM

NETGEAR VPN Specifications

General

Brand	NETGEAR
Model	VPN
Category	Network Router
Language	English

Summary

VPN Fundamentals and IPSec

Defining Virtual Private Networks (VPNs)

Explains VPNs as secure networks for private data, accessible via the internet or private networks.

Understanding IPSec for Network Security

Details IPSec as an IETF standard suite providing data authentication, integrity, and confidentiality.

Key IPSec Security Features

Covers IPSec's authentication, integrity, and confidentiality features for secure data transfer.

IPSec Components: ESP, AH, and IKE

Explains core IPSec components: ESP for encryption, AH for integrity, and IKE for key management.

IPSec Modes of Operation

Compares IPSec's Transport Mode (payload protection) and Tunnel Mode (full packet protection).

VPN Configuration and Operation

IPSec Key Management and SA Setup

Details IPSec key management using IKE and the setup of Security Associations (SAs).

Preparing for VPN Configuration

Guides users on gathering essential information before starting VPN configuration.

VPN Gateway and Network Addressing

Explains VPN gateway roles and the importance of public/private network interface addressing.

Firewall Configuration for VPNs

Emphasizes the need for proper firewall rules to permit VPN tunnel traffic.

Establishing a VPN Tunnel: Negotiation Steps

Outlines the sequence of steps involved in IPSec SA negotiation for tunnel establishment.

IPSec and IKE Configuration Parameters

Lists critical parameters for IKE Phase I and Phase II required for VPN setup.

Testing and Troubleshooting VPN Connections

Provides methods for testing VPN functionality and common troubleshooting steps.