User's Manual

Table Of Contents

Although there are 2 modes of operation RipEX2 only offers Tunnel mode. In Tunnel mode, the entire

IP packet is encrypted and authenticated. It is then encapsulated into a new IP packet (ESP – Encap-

sulating Security Payloads) with a new IP header.

Symmetrical cryptography is used to encrypt the packets. The symmetric keys must be safely delivered

to the peer. In order to maintain a secure connection, symmetric keys must be regularly exchanged.

The protocol used for secure key exchange is IKE (Internet Key Exchange). Both IKE version 1 and

the newer version 2 are available in RipEX2.

IKE protocol communication with the peer is established using UDP frames on port 500. However, if

NAT-T (NAT Traversal) or MOBIKE (MOBile IKE) are active, the UDP port 4500 is used instead.

Note

NAT-T is automatically recognized by IPsec implementation in RipEX2.

The IPsec tunnel is provided by Security Association (SA). There are 2 types of SA:

• IKE SA: IKE Security Association providing SA keys exchange with the peer.

• CHILD SA: IPsec Security Association providing packet encryption.

Every IPsec tunnel contains 1 IKE SA and at least 1 CHILD SA.

Link partner (peer) secure authentication is assured using Pre-Shared Key (PSK) authentication

method: Both link partners share the same key (password).

As and when the CHILD SA expires, new keys are generated and exchanged using IKE SA.

As and when the IKE SA version IKEv1 expires - new authentication and key exchange occurs and a

new IKE SA is created. Any CHILD SA belonging to this IKE SA is re-created as well.

As and when the IKE SA version IKEv2 expires one of two different scenarios might occur:

• If the re-authentication is required - the behavior is similar to IKEv1 (see above).

• It the re-authentication is not required - only new IKE SA keys are generated and exchanged.

Settings