VMware VSHIELD MANAGER 4.1.0 UPDATE 1 - API Manuale Utente Scaricare il pdf (Pagina 134)

vShield Administration Guide

134 VMware, Inc.

Terminology

IPSecisaframeworkofopenstandards.TherearemanytechnicaltermsinthelogsofthevShieldEdgeand

otherVPNappliancesthatyoucanusetotroubleshoottheIPSECVPN.

 ISAKMP(InternetSecurityAssociationandKeyManagementProtocol)isaprotocoldefinedbyRFC2408

forestablishingSecurityAssociations(SA)andcryptographickeysinanInternetenvironment.ISAKMP

onlyprovidesaframeworkforauthenticationandkeyexchangeandisdesignedtobekeyexchange

independent.

 Oakleyisakey‐agreementprotocolthatallowsauthenticatedpartiestoexchangekeyingmaterialacross

aninsecureconnectionusingtheDiffie‐Hellmankeyexchangealgorithm.

 IKE(InternetKeyExchange)isacombinationofISAKMPframeworkandOakley.vSHieldEdgeprovides

IKEv2.

 Diffie‐Hellman(DH)keyexchangeisacryptographicprotocolthatallowstwopartiesthathavenoprior

knowledgeofeachothertojointlyestablishasharedsecretkeyoveraninsecurecommunicationschannel.

VSEsupportsDHgroup2(1024bits)andgroup5(1536bits).

IKE Phase 1 and Phase 2

IKEisastandardmethodusedtoarrangesecure,authenticatedcommunications.

Phase1setsupmutualauthenticationofthepeers,negotiatescryptographicparameters,andcreatessession

keys.ThePhase1parametersusedbythevShieldEdgeare:

 Mainmode

 TripleDES/AES[Configurable]

 SHA‐1

 MODPgroup2(1024bits)

 pre‐sharedsecret[Configurable]

 SAlifetimeof28800seconds(eighthours)withnokbytesrekeying

 ISAKMPaggressivemodedisabled

IKEPhase2negotiatesanIPSectunnelbycreatingkeyingmaterialfortheIPSectunneltouse(eitherbyusing

theIKEphaseonekeysasabaseorbyperforminganewkeyexchange).TheIKEPhase2parameters

supportedbyvShieldEdgeare:

 TripleDES/AES[WillmatchthePhase1setting]

 SHA‐1

 ESPtunnelmode

 MODPgroup2(1024bits)

 Perfectforwardsecrecyforrekeying

 SAlifetimeof3600seconds(onehour)withnokbytesrekeying

 SelectorsforallIPprotocols,allports,betweenthetwonetworks,usingIPv4subnets

ThevShieldEdgesupportsMainModeforPhase1andQuickModeforPhase2.

ThevShieldEdgeproposesapolicythatrequiresPSK,3DES/AES128,sha1,andDHGroup2/5.Thepeermust

acceptthispolicy;otherwise,

thenegotiationphasefails.

ThisexampleshowsanexchangeofPhase1negotiationinitiatedfromavShieldEdgetoaCiscodevice.

OTEForvShieldEdgetovShieldEdgeIPSECtunnels,youcanusethissamescenariosbysettingupthe

secondvShieldEdgeastheremotegateway.

1 2 ... 129 130 131 132 133 134 135 136 137 138 139 ... 161 162

Commenti su questo manuale

Nessun commento

VMware VSHIELD MANAGER 4.1.0 UPDATE 1 - API Manuale Utente Pagina 134

Commenti su questo manuale

Prodotti e manuali riguardandi Software di system management VMware VSHIELD MANAGER 4.1.0 UPDATE 1 - API