Patton electronic SmartNode 4110 Series ユーザーズマニュアル

Introduction

SmartWare Software Configuration Guide 

The mode determines the payload of the ESP packet and hence the application:

•

Transport mode: Encapsulates only the payload of the original IP packet, but not its header, so the IPsec 
peers must be at the endpoints of the communications link. 

•

A secure connection between two hosts is the application of the transport mode.

•

Tunnel mode: Encapsulates the payload and the header of the original IP packet. The IPsec peers can be 
(edge) routers that are not at the endpoints of the communications link. 

A secure connection of the two (private) LANs, a ‘tunnel’, is the application of the tunnel mode.

Permanent IKE Tunnels
By default, IKE tunnels are established as late as possible (when the first packet is flowing through) and IKE 
tunnels with expired lifetimes are reestablished only in case there is traffic flowing through. With the perma-
nent option set, IKE tunnels are established shortly after boot and are reestablished after the expiration of their 
lifetime even if there was no traffic flowing through.

Mode: Configure

The current implementation of IP works with pre-shared keys (also called manual keying or manual IPsec) or 
using Internet Key Exchange (IKE). Keys are manually generated, distributed, and stored as a hexa-decimal 
string in the startup-configuration of the SmartNode and its peer.

Depending on the processing hardware applied to reverse engineering a DES 
key, it can take from 3 hours to 3 days to break the key. Thus, for maximum 
security, DES keys must be manually updated regularly. AES- or 3DES-keys, 
because they are much more complex, take so much longer to break as to be 
practically infinite.

The automatically keyed IPSEC connections using the Internet Key Exchange (IKE / RFC2409) protocol that 
is based on Internet Security Association and Key Management Protocol (ISAKMP / RFC2408) is the other 
option. IKE supports authentication using pre-shared keys. There is currently no support for authentication 
using Public Key Infrastructure (PKI) and digital certificates. 

Optionally, if the remote system requires protected 
networks to be specified in the identity payload of 
the quick mode, you can define one or more pro-
tected networks using this command. If the tunnel 
shall be established permanently the permanent-
tunnel flag must be set.