IPsec, a Tutorial--Part VI

IPsec Configuration Elements
There are several basic tasks that must typically be addressed when implementing IPsec. In this section we will explore basic tasks common to most of the fundamental IPsec VPN implementations, including the creation of an IPsec transform set and the successful configuration of an IPsec crypto map.

Creating an IPsec Transform
In order to implement an IPsec VPN, the administrator must first make a series of decisions that will eventually result in the creation of the IPsec transform. The IPsec transform defines a series of parameters that will be used in transforming the packet from its cleartext input form to the cipher text output. Figure 21 illustrates the IPsec transform creation decision tree.

The following list and examples use Figure 21 to illustrate the creation of a transform set within IOS:

1. An IPsec transform set defines the IPsec protocol to be used. This could be ESP, AH, or a combination of the two. In Example 1, James selects ESP and AH as his IPsec protocols.

Example 1. IPsec Protocol Definition and Availability
2. Also specified as part of the IPsec transform set is the mode of the IPsec protocol. This could be either tunnel or transport mode. As discussed previously, different modes alter the packet in different ways--specifically, as it pertains to header location and the scope of the ESP or AH protection boundary. Example 2 illustrates the configuration of the mode that IPsec is to operate in.

Example 2. IPsec Protocol Mode Definition



Page 2: next page
Page 1 | 2 | 3