Brocade Web Tools Administrator's Guide - Supporting Fabric OS v7.0.0 (53-1002152-01, March 2012)

202 Web Tools Adminstrator’s Guide

53-1002152-01

IPsec concepts

Authentication Header

AH can be used to authenticate a data stream, but does not provide encryption needed for privacy.

The AH contains a message authentication code (MAC). The MAC is created by a hash algorithm

calculation. The MAC is transmitted in an IP datagram. The same hash algorithm is then used by

the receiver to verify the integrity of the packet. AH can be used in either transport mode or tunnel

mode, as shown in Figure 40.

FIGURE 40 AH header in transport mode and tunnel mode

Encapsulating Security Payload

ESP provides authentication, and also provides privacy by encrypting the IP datagram. The use of

an ESP header is similar to the use of the AH header. A hash algorithm is used to calculate an

authentication value, the authentication value is sent in an IP datagram, and the same hash

algorithm is used by the receiver to verify the authentication value. ESP can be used in either

transport mode or tunnel mode, as shown in Figure 41.

FIGURE 41 ESP header in transport mode and tunnel mode

Basic IPsec configurations

There are three basic configurations for IPsec use:

• Endpoint to Endpoint

• Gateway to Gateway