| 14.1 |  | The PIX Security Appliance Enables a Secure VPN |
| 14.1.5 |  | IPSec standards supported by the PIX Security Appliance |

| As discussed in the router VPN modules, VPN technology has many acronyms and intricate terms. It is necessary to understand the following VPN and IPSec terms to properly configure a PIX VPN solution. IPSec IPSec is a framework of open standards that provides data confidentiality, data integrity, and data authentication between participating peers at the IP layer. IPSec can be used to protect one or more data flows between IPSec peers. IPSec is documented in a series of Internet RFCs. The overall IPSec implementation is guided by Security Architecture for the Internet Protocol, RFC 2401. IPSec consists of two main protocols:

1. Authentication Header (AH) is a security protocol that provides authentication and optional replay-detection services. AH acts as a digital signature to ensure that tampering has not occurred with the data in the IP packet. AH does not provide data encryption and decryption services. AH can be used either by itself or with Encapsulating Security Payload (ESP).
2. Encapsulating Security Payload (ESP) is a security protocol that provides data confidentiality and protection with optional authentication and replay-detection services. The PIX Security Appliance uses ESP to encrypt the data payload of IP packets. ESP can be used either by itself or in conjunction with AH.

ISAKMP
Internet Security Association and Key Management Protocol (ISAKMP) is a protocol framework that defines payload formats, the mechanics of implementing a key exchange protocol, and the negotiation of a security association (SA).

IKE
Internet Key Exchange (IKE) is a hybrid protocol that implements Oakley key exchange and Skeme key exchange inside of the ISAKMP framework.

SA
The concept of a security association (SA) is fundamental to IPSec. An SA is a connection between IPSec peers that determines the IPSec services available between the peers, similar to a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port. Each IPSec peer maintains an SA database in memory containing SA parameters. SAs are uniquely identified by the IPSec peer address, security protocol, and security parameter index (SPI). Administrators will need to configure SA parameters and monitor SAs on the PIX Security Appliance.

DES
Data Encryption Standard is used to encrypt and decrypt packet data. Both IPSec and IKE use DES. DES uses a 56-bit key to ensure high performance encryption.

3DES
3DES is a variant of DES, which iterates three times with three separate keys, effectively doubling the strength of DES. 3DES is used by IPSec to encrypt and decrypt data traffic. 3DES uses a 168-bit key, ensuring strong encryption.

Diffie-Hellman
Diffie-Hellman (D-H) is a public-key cryptography algorithm. It enables two parties to establish a shared secret key over an insecure communications channel. D-H is used within IKE to establish session keys. The PIX Security Appliance supports 768-bit and 1024-bit D-H groups. The 1024-bit group is more secure.

MD5
MD5 is an algorithm used to authenticate and provide integrity of packet data by hashing the message digest. A hash is a one-way encryption algorithm that takes an input message of arbitrary length and produces a fixed-length output message. If a message has been altered, an MD5 hash will not be equal on both sides of the tunnel, alerting administrators to a message being corrupted. IKE, AH, and ESP can use MD5 for authentication.

SHA-1
SHA-1 is a secure hash algorithm used to authenticate packet data. The PIX Security Appliance uses the SHA-1 Hash-based Message Authentication Code (HMAC) variant, which provides an additional level of hashing. IKE, AH, and ESP can use SHA-1 for authentication.

RSA Signatures
RSA is a public-key cryptographic system used for authentication. Public-key cryptography works by sharing only a public key but retaining a private key that can decipher the encryption of the public key. The public key can decipher information encrypted by the private key to provide for authentication of the sender.

CA
The certificate authority (CA) is basically a trusted repository for public encryption keys enabling large-scale deployment of public-key cryptography. CA support on the PIX Security Appliance enables the IPSec-protected network to scale by providing the equivalent of a digital identification card to each device. When two IPSec peers wish to communicate, they exchange digital certificates to prove their identities. This removes the need to manually exchange public keys with each peer or to manually specify a shared key at each peer. The digital certificates are obtained from a CA. CA support on the PIX Security Appliance uses RSA signatures to authenticate the CA exchange.

| Web Links http://www.ietf.org/html.charters/ipsec-charter.html