ZyXEL 793H Guida Utente
Chapter 11 IPSec VPN
P-793H User’s Guide
160
• Inside header: The inside IP header contains the IP address of the computers behind the
ZyXEL Device or remote IPSec router.
In transport mode, the IP header is the original IP header, and the encapsulation depends on
the active protocol. If the active protocol is AH, the ZyXEL Device includes part of the IP
header when it encapsulates the packet. If the active protocol is ESP, the ZyXEL Device does
not include the original IP header when it encapsulates the packet, in which case it is not
possible to verify the integrity of the source IP address.
the active protocol. If the active protocol is AH, the ZyXEL Device includes part of the IP
header when it encapsulates the packet. If the active protocol is ESP, the ZyXEL Device does
not include the original IP header when it encapsulates the packet, in which case it is not
possible to verify the integrity of the source IP address.
"
The ZyXEL Device and remote IPSec router must use the same
encapsulation.
encapsulation.
Usually, you should use tunnel mode because it is more secure. Transport mode should only
be used when the IPSec SA is used for communication between the ZyXEL Device and
remote IPSec router (for example, for remote management), not between computers on the
local and remote networks.
be used when the IPSec SA is used for communication between the ZyXEL Device and
remote IPSec router (for example, for remote management), not between computers on the
local and remote networks.
11.1.3.4 IPSec SA Proposal and Perfect Forward Secrecy
An IPSec SA proposal is similar to an IKE SA proposal (see
Section 11.1.1.2 on page 155
),
except that you also have the choice whether or not the ZyXEL Device and remote IPSec
router perform a new DH key exchange every time an IPSec SA is established. This is called
Perfect Forward Secrecy (PFS).
If you enable PFS, the ZyXEL Device and remote IPSec router perform a DH key exchange
every time an IPSec SA is established, changing the shared secret from which encryption keys
are generated. As a result, if one encryption key is compromised, other encryption keys are
secure because they are created from different shared secrets.
If you do not enable PFS, the ZyXEL Device and remote IPSec router use the same shared
secret that was generated when the IKE SA was established to generate encryption keys. The
ZyXEL Device and remote IPSec router still create a new shared secret every time they
establish (or re-establish) the IKE SA.
A DH key exchange is time-consuming. You might consider disabling PFS, if it takes a long
time to establish IPSec SA and if the VPN tunnel has good security (for example, strong
encryption) without it.
router perform a new DH key exchange every time an IPSec SA is established. This is called
Perfect Forward Secrecy (PFS).
If you enable PFS, the ZyXEL Device and remote IPSec router perform a DH key exchange
every time an IPSec SA is established, changing the shared secret from which encryption keys
are generated. As a result, if one encryption key is compromised, other encryption keys are
secure because they are created from different shared secrets.
If you do not enable PFS, the ZyXEL Device and remote IPSec router use the same shared
secret that was generated when the IKE SA was established to generate encryption keys. The
ZyXEL Device and remote IPSec router still create a new shared secret every time they
establish (or re-establish) the IKE SA.
A DH key exchange is time-consuming. You might consider disabling PFS, if it takes a long
time to establish IPSec SA and if the VPN tunnel has good security (for example, strong
encryption) without it.
11.1.4 Additional Topics for IPSec SA
This section provides more information about IPSec SA.
11.1.4.1 IPSec SA using Manual Keys
You might set up an IPSec SA using manual keys when you want to establish a VPN tunnel
quickly (for example, while troubleshooting). You should do this only as a temporary solution,
however, because it is not as secure as a regular IPSec SA.
quickly (for example, while troubleshooting). You should do this only as a temporary solution,
however, because it is not as secure as a regular IPSec SA.