| 14.1 |  | The PIX Security Appliance Enables a Secure VPN |
| 14.1.4 |  | Overview of IPSec |

| The PIX Security Appliance uses the open IPSec protocol to enable secure VPNs. IPSec is a highly scalable set of security protocols and algorithms used to secure data at the network layer. IPSec conforms to open standards published by the Internet Engineering Task Force (IETF) and documented RFCs and IETF draft papers.

IPSec acts at the network layer, where it protects and authenticates IP packets between a PIX Security Appliance and other participating IPSec devices. These other devices can be PIX Security Appliances, Cisco routers, the Cisco VPN Client, and other IPSec-compliant products.

IPSec consists of two protocols that may be used in conjunction. The first protocol is Encapsulating Security Payload (ESP). It encapsulates the data, but does not provide protection to the outer headers. ESP encrypts the payload for data confidentiality, authenticity, and integrity. The second protocol is Authentication Header (AH). The AH protocol verifies the authenticity and integrity of the IP datagram by including a keyed Message Authentication Code in the header.

IPSec works by encrypting data with algorithms or shared secret keys that change the Layer 3 payload bit pattern to create a cipher. The IPSec peer knows the method to reverse or decipher the encrypted data. The PIX Security Appliance uses Internet Security Association and Key Management Protocol (ISAKMP) to negotiates IPSec security associations and enables IPSec secure communications. Pre-shared keys and digital certificates can be used to authenticate IPSec VPN peers. There are also different methods of encrypting data, such as DES, 3DES, and AES.