Cisco PIX 525 Spécifications télécharger pdf (Page 446)

E-2

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Appendix E Supported VPN Standards and Security Proposals

Internet Key Exchange (IKE)

• ESP—Encapsulating Security Payload. A security protocol that provides data privacy services and

optional data authentication, and anti-replay services. ESP encapsulates the data to be protected.

The ESP protocol (RFC 2406) allows for the use of various cipher algorithms and (optionally)

various authentication algorithms. The PIX

Firewall implements the mandatory 56-bit DES-CBC

with Explicit IV (RFC 2405); as the encryption algorithm, and MD5-HMAC (RFC 2403) or

SHA-HMAC (RFC 2404) as the authentication.

Internet Key Exchange (IKE)

IKE is implemented per “The Internet Key Exchange” (RFC 2409).

ISAKMP—The Internet Security Association and Key Management Protocol. A protocol framework

that defines payload formats, the mechanics of implementing a key exchange protocol, and the

negotiation of a security association.

ISAKMP is implemented per “Internet Security Association and Key Management Protocol (ISAKMP)”

(RFC 2408).

Oakley—A key exchange protocol that defines how to derive authenticated keying material.

Skeme—A key exchange protocol that defines how to derive authenticated keying material, with rapid

key refreshment.

The component technologies implemented for use by IKE include:

• DES—Data Encryption Standard (DES) is used to encrypt packet data. IKE implements the 56-bit

DES-CBC with Explicit IV standard. See “CBC.”

• Triple DES (3DES)—A variant of DES, which iterates three times with three separate keys,

effectively tripling the strength of DES.

• CBC—Cipher Block Chaining (CBC) requires an initialization vector (IV) to start encryption. The

IV is explicitly given in the IPSec packet.

• Diffie-Hellman—A public-key cryptography protocol which allows two parties to establish a shared

secret over an unsecure communications channel. Diffie-Hellman is used within IKE to establish

session keys. 768-bit, 1024-bit, and 1536-bit Diffie-Hellman groups are supported.

• MD5 (HMAC variant)—Message Digest 5 (MD5) is a hash algorithm used to authenticate packet

data. HMAC is a variant which provides an additional level of hashing.

• SHA (HMAC variant)—Secure Hash Algorithm (SHA) is a hash algorithm used to authenticate

packet data. HMAC is a variant which provides an additional level of hashing.

• RSA signatures—RSA is the public key cryptographic system developed by Ron Rivest, Adi

Shamir, and Leonard Adleman. RSA signatures provide non-repudiation.

IKE Extended Authentication (Xauth) is implemented per the IETF draft-ietf-ipsec-isakmp-xauth-04.txt

(“extended authentication” draft). This provides this capability of authenticating a user within IKE using

TACACS+ or RADIUS.

IKE Mode Configuration (IKE Mode Config) is implemented per the IETF

draft-ietf-ipsec-isakmp-mode-cfg-04.txt. IKE Mode Configuration provides a method for a security

gateway to download an IP address (and other network level configuration) to the VPN client as part of

an IKE negotiation.

1 2 ... 441 442 443 444 445 446 447 448 449 450 451 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 446

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525