<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:55" />
    <title>Information About IPsec Network Security </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1724;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1056837"> </a><h1 class="pTitle">
Information About IPsec Network Security

</h1>
<a name="wp1072732"> </a><p class="pBody">
IP security (IPsec) protocol is a framework of open standards that provides data confidentiality, data 
integrity, and data authentication between participating peers. It is developed by the Internet Engineering 
Task Force (IETF). IPsec provides security services at the IP layer, including protecting one or more data 
flows between a pair of hosts, between a pair of security gateways, or between a security gateway and a 
host. The overall IPsec implementation is the latest version of RFC 2401. Cisco NX-OS IPsec 
implements RFC 2402 through RFC 2410.

</p>
<a name="wp1072735"> </a><p class="pBody">
IPsec uses the Internet Key Exchange (IKE) protocol to handle protocol and algorithm negotiation and 
to generate the encryption and authentication keys used by IPsec. While IKE can be used with other 
protocols, its initial implementation is with the IPsec protocol. IKE provides authentication of the IPsec 
peers, negotiates IPsec security associations, and establishes IPsec keys. IKE uses RFCs 2408, 2409, 
2410, and 2412, and additionally implements the draft-ietf-ipsec-ikev2-16.txt draft.

</p>
<a name="wp1072736"> </a><p class="pBody">
IPsec provides security for transmission of sensitive information over unprotected networks such as the 
Internet. IPsec acts at the network layer, protecting and authenticating IP packets between participating 
IPsec devices (peers). 

</p>
<a name="wp1072737"> </a><p class="pBodyAutonumNoRule">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> IPsec is not supported by the Cisco Fabric Switch for HP c-Class BladeSystem and the Cisco Fabric 
Switch for IBM BladeCenter.

</p>
<a name="wp1072738"> </a><p class="pBody">
IPsec provides security for transmission of sensitive information over unprotected networks such as the 
Internet. IPsec acts at the network layer, protecting and authenticating IP packets between participating 
IPsec devices (peers). 

</p>
<a name="wp1072739"> </a><p class="pBody">
IPsec provides the following network security services. In general, the local security policy dictates the 
use of one or more of these services between two participating IPsec devices: 

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1072740"> </a><li class="pSmartList1">Data confidentiality&#8212;The IPsec sender can encrypt packets before transmitting them across a 
network. 
</li>
<a name="wp1072741"> </a><li class="pSmartList1">Data integrity&#8212;The IPsec receiver can authenticate packets sent by the IPsec sender to ensure that 
the data has not been altered during transmission. 
</li>
<a name="wp1072742"> </a><li class="pSmartList1">Data origin authentication&#8212;The IPsec receiver can authenticate the source of the IPsec packets sent. 
This service is dependent upon the data integrity service. 
</li>
<a name="wp1072743"> </a><li class="pSmartList1">Anti-replay protection&#8212;The IPsec receiver can detect and reject replayed packets. 
</li>
</ul></div>
<a name="wp1072744"> </a><p class="pBodyAutonumNoRule">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> The term <em class="cEmphasis">data authentication</em> is generally used to mean data integrity and data origin authentication. 
Within this chapter it also includes anti-replay services, unless otherwise specified.

</p>
<a name="wp1072745"> </a><p class="pBody">
With IPsec, data can be transmitted across a public network without fear of observation, modification, 
or spoofing. This enables applications such as Virtual Private Networks (VPNs), including intranets, 
extranets, and remote user access. 

</p>
<a name="wp1072746"> </a><p class="pBody">
IPsec as implemented in Cisco NX-OS software supports the Encapsulating Security Payload (ESP) 
protocol. This protocol encapsulates the data to be protected and provides data privacy services, optional 
data authentication, and optional anti-replay services. 

</p>
<a name="wp1072747"> </a><p class="pBodyAutonumNoRule">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> The Encapsulating Security Payload (ESP) protocol is a header inserted into an existing TCP/IP packet, 
the size of which depends on the actual encryption and authentication algorithms negotiated. To avoid 
fragmentation, the encrypted packet fits into the interface maximum transmission unit (MTU). The path 
MTU calculation for TCP takes into account the addition of ESP headers, plus the outer IP header in 
tunnel mode, for encryption. The MDS switches allow 100 bytes for packet growth for IPsec encryption.

</p>
<a name="wp1072748"> </a><p class="pBodyAutonumNoRule">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> When using IPsec and IKE, each Gigabit Ethernet interface on the IPS module (either on 14+2 LC or 
18+4 LC) must be configured in its own IP subnet. If there are multiple Gigabit Ethernet interfaces 
configured with IP address or network-mask in the same IP subnet, IKE packets may not be sent to the 
right peer and thus IPsec tunnel will not come up.

</p>
<a name="wp1078680"> </a><p class="pBody">
This section includes the following topics:

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1078683"> </a><li class="pSmartList1"><a href="ipe03.html">About IKE</a>
</li>
<a name="wp1078845"> </a><li class="pSmartList1"><a href="ipe04.html">IPsec Compatibility</a>
</li>
<a name="wp1078849"> </a><li class="pSmartList1"><a href="ipe05.html">IPsec and IKE Terminology</a>
</li>
<a name="wp1078898"> </a><li class="pSmartList1"><a href="ipe06.html">Supported IPsec Transforms and Algorithms</a>
</li>
<a name="wp1078918"> </a><li class="pSmartList1"><a href="ipe07.html">Supported IKE Transforms and Algorithms</a>
</li>
<a name="wp1078930"> </a><li class="pSmartList1"><a href="ipe08.html">About IPsec Digital Certificate Support</a>
</li>
<a name="wp1078943"> </a><li class="pSmartList1"><a href="ipe12.html">About IKE Initialization</a>
</li>
<a name="wp1078967"> </a><li class="pSmartList1"><a href="ipe13.html">About the IKE Domain</a>
</li>
<a name="wp1078971"> </a><li class="pSmartList1"><a href="ipe14.html">About IKE Tunnels</a>
</li>
<a name="wp1078976"> </a><li class="pSmartList1"><a href="ipe15.html">About IKE Policy Negotiation</a>
</li>
<a name="wp1078985"> </a><li class="pSmartList1"><a href="ipe16.html">Optional IKE Parameter Configuration</a>
</li>
<a name="wp1078998"> </a><li class="pSmartList1"><a href="ipe17.html">About Crypto IPv4-ACLs</a>
</li>
<a name="wp1079125"> </a><li class="pSmartList1"><a href="ipe20.html">About Transform Sets in IPsec</a>
</li>
<a name="wp1079129"> </a><li class="pSmartList1"><a href="ipe21.html">About Crypto Map Entries</a>
</li>
<a name="wp1079134"> </a><li class="pSmartList1"><a href="ipe23.html">About SA Lifetime Negotiation</a>
</li>
<a name="wp1079139"> </a><li class="pSmartList1"><a href="ipe24.html">About the AutoPeer Option</a>
</li>
<a name="wp1079152"> </a><li class="pSmartList1"><a href="ipe25.html">About Perfect Forward Secrecy</a>
</li>
<a name="wp1079164"> </a><li class="pSmartList1"><a href="ipe26.html">About Crypto Map Set Interface Application</a>
</li>
<a name="wp1079168"> </a><li class="pSmartList1"><a href="ipe27.html">IPsec Maintenance</a>
</li>
<a name="wp1079186"> </a><li class="pSmartList1"><a href="ipe28.html">Global Lifetime Values</a>
</li>
</ul></div>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
