Enterasys Networks CSX6000 - Manual (Page 239)

Central Site Remote Access Switch 239
C ONFIGURING E NCRYPTION
Encryption Background Information
A UTOMATED K EY E XCHANGE
The CyberSWITCH’s automated key exchange uses a proprietary protocol defined for use with
Cabletron remote access products. This proprietary protocol exchanges information during ECP
(Encryption Control Protocol) negotiation to produce proper keys.
To use automated key exchange, the feature must be enabled for each device, and the DES/RSA
resource must be properly configured and installed on the CyberSWITCH.
When a PPP call to a particular device is initiated or received, the CyberSWITCH will attempt to
use ECP to negotiate encryption (if it is enabled for this device). If ECP negotiation succeeds, then
data transmitted over the PPP link will be encrypted using 56-bit session keys. The CyberSWITCH
will encrypt outgoing plain text using the encryption key, and decrypt incoming enciphered data
using the decryption key. If ECP negotiation fails, then the CyberSWITCH will bring down the call.
When encryption is enabled, an unsecure PPP session will not be allowed.
I NTERACTION WITH O THER F EATURES
IP F ILTERS
You can use IP Filters to automatically discard or forward IP datagrams based on the contents of
various fields within the IP datagram. You can also use
ESP Tunnel Mode to allow IP datagrams to
tunnel through IP filters. To assure the proper filtering, you must understand whether an IP filter
is applied to the encapsulated datagram or the unencapsulated datagram.
When an ESP datagram is simply passing through a node to be routed from a previous hop to the
next hop, any IP filters will be applied only to the encapsulated datagram. The original source and
destination, protocol, and any other information from the original datagram will not be used in any
filtering logic.
On the source gateway, the original datagram will tunnel through any output filters. However, on
the destination gateway, input filters will be applied first to the ESP and then to the original
datagram. The ESP datagram will be filtered by an output filter on the source gateway and an input
filter on the destination gateway. Global filters on both gateways apply to both the ESP and the
original datagram.
The following tables list which filters are applicable to the different datagrams:
Original Datagram Input filters Global filters Output filters
source gateway no yes no
intermediate node no no no
destination gateway yes yes no
ESP Datagram Input filters Global filters Output filters
source gateway no yes yes
intermediate node yes yes yes
destination gateway yes yes no