Nortel 4134 사용자 가이드
50
IPsec VPN fundamentals
Figure 12
IKE aggressive mode
IKE aggressive mode
Phase 2: quick mode
In phase 2 of shared key negotiation, a security association is negotiated
over the IKE security association created in phase 1. This is achieved
using quick mode. Quick mode provides for negotiating various security
parameters between the gateways.
over the IKE security association created in phase 1. This is achieved
using quick mode. Quick mode provides for negotiating various security
parameters between the gateways.
Peer authentication methods for IKE
The symmetric key derived using Diffie Hellman exchange in IKE is
unauthenticated and therefore susceptible to man-in-the-middle attacks.
The IKE protocol supports multiple methods to provide authentication of
the peers. The SR4134 provides support for the following authentication
methods:
unauthenticated and therefore susceptible to man-in-the-middle attacks.
The IKE protocol supports multiple methods to provide authentication of
the peers. The SR4134 provides support for the following authentication
methods:
•
Pre-shared key
The pre-shared key authentication method relies on a secret key (or
password) being shared by the gateways. This password is one of the
parameters used by both the gateways in generating a symmetric key
after Diffie Hellman exchange. However, for large meshed topologies, it
can become onerous to maintain a unique set of passwords for each
pair of peers given that, the number of key pairs increases exponentially
for each new peer that is added to the topology.
password) being shared by the gateways. This password is one of the
parameters used by both the gateways in generating a symmetric key
after Diffie Hellman exchange. However, for large meshed topologies, it
can become onerous to maintain a unique set of passwords for each
pair of peers given that, the number of key pairs increases exponentially
for each new peer that is added to the topology.
Furthermore, with remote-access configurations, a single pre-shared-key
on the SR4134 is not unique as it must be shared by all remote-access
clients. In this case, if one remote client is compromised, then all
pre-shared keys must be updated. It is also more difficult to ensure the
integrity of a password that is shared by multiple clients.
on the SR4134 is not unique as it must be shared by all remote-access
clients. In this case, if one remote client is compromised, then all
pre-shared keys must be updated. It is also more difficult to ensure the
integrity of a password that is shared by multiple clients.
•
RSA or DSS signatures
Signature based authentication provides for an explicit form of peer
authentication after the Diffie Hellman exchange. This involves public
key cryptography where each gateway provides a digital signature of
the negotiation to the other side. Verification of the signature provides
authentication of the peers. This method is more secure, but requires a
Public Key Infrastructure using X.509 digital certificates. RSA and DSS
authentication after the Diffie Hellman exchange. This involves public
key cryptography where each gateway provides a digital signature of
the negotiation to the other side. Verification of the signature provides
authentication of the peers. This method is more secure, but requires a
Public Key Infrastructure using X.509 digital certificates. RSA and DSS
Nortel Secure Router 4134
Security — Configuration and Management
NN47263-600
01.02
Standard
10.0
3 August 2007
Copyright © 2007, Nortel Networks
.