H3C Technologies H3C WX3000E Series Wireless Switches - Manual (Page 362)

348
Both AH and ESP provide authentication services, but the authentication service provided by AH is
stronger. In practice, you can choose either or both security protocols. When both AH and ESP are used,
an IP packet is encapsulated first by ESP and then by AH.
Figure 146 shows the format of IPsec packets.
Security association
A security association is an agreement negotiated between two communicating parties called IPsec
peers. It comprises a set of parameters for data protection, including security protocols, encapsulation
mode, authentication and encryption algorithms, and shared keys and their lifetime. SAs can be set up
manually or through IKE. The WX series access controllers support setting up SAs only through IKE.
An SA is unidirectional. At least two SAs are needed to protect data flows in a bidirectional
communication. If two peers want to use both AH and ESP to protect data flows between them, they
construct an independent SA for each protocol.
An SA is uniquely identified by a triplet, which consists of the security parameter index (SPI), destination
IP address, and security protocol identifier (AH or ESP).
An SPI is a 32-bit number for uniquely identifying an SA. It is transmitted in the AH/ESP header. A
manually configured SA requires an SPI to be specified manually for it; an IKE created SA will have an
SPI generated at random.
A manually configured SA never ages out. An IKE created SA has a specified period of lifetime, which
comes in two types:
• Time-based lifetime, which defines how long the SA can be valid after it is created.
• Traffic-based lifetime, which defines the maximum traffic that the SA can process.
The SA becomes invalid when either of the lifetime timers expires. Before the SA expires, IKE negotiates
a new SA, which takes over immediately after its creation.
Encapsulation modes
IPsec supports the following IP packet encapsulation modes:
• Tunnel mode—IPsec protects the entire IP packet, including both the IP header and the payload. It
uses the entire IP packet to calculate an AH or ESP header, and then encapsulates the original IP
packet and the AH or ESP header with a new IP header. If you use ESP, an ESP trailer is also
encapsulated. Tunnel mode is typically used for protecting gateway-to-gateway communications.
IPsec between AC and AP supports only the tunnel mode.
• Transport mode—IPsec protects only the IP payload. It uses only the IP payload to calculate the AH
or ESP header, and inserts the calculated header between the original IP header and payload. If
you use ESP, an ESP trailer is also encapsulated. The transport mode is typically used for protecting
host-to-host or host-to-gateway communications.
Figure 146 shows how the security protocols encapsulate an IP packet in different encapsulation modes.
Figure 146 Encapsulation by security protocols in different modes