User's Manual

Configuring GRE, NAT, RIPSO, and BFE Services
4-2
308625-14.00 Rev 00
Figure 4-1. BFE Network Configuration
BFE devices receive authorization and address translation services from an access
control center (ACC) residing on the black network. The ACC makes access
control decisions that determine which hosts are allowed to communicate with
each other. A key distribution center (KDC) residing on the black network
provides encryption keys and key management services. A BFE device uses these
encryption keys for encrypting traffic between itself and other BFE devices.
The router-to-BFE interface is a modified version of the interface presented in the
1983 DDN X.25 Host Interface Specification. It supports data rates between
1200 b/s and 64 KB/s. To support BFE services, Revised IP Security Option
(RIPSO) must be enabled on the IP interface. All IP datagrams transmitted on the
interface must contain a RIPSO security label. The first option in each IP
datagram header must be the Basic Security option.
Router
BFE
Router
BFE
Router
BFE
Black network
Red network
Key
X.25 DDN
IP0015A