<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:55" />
    <title>IPsec and IKE Terminology </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1727;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1073091"> </a><h1 class="pTitle">
IPsec and IKE Terminology

</h1>
<a name="wp1073092"> </a><p class="pBody">
The terms used in this chapter are explained in this section.

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1073094"> </a><li class="pSmartList1">Security association (SA)&#8212; An agreement between two participating peers on the entries required 
to encrypt and decrypt IP packets. Two SAs are required for each peer in each direction (inbound 
and outbound) to establish bidirectional communication between the peers. Sets of bidirectional SA 
records are stored in the SA database (SAD). IPsec uses IKE to negotiate and bring up SAs. Each 
SA record includes the following information: 
</li>
<div class="pSmartList2"><ul class="pSmartList2">
<a name="wp1073095"> </a><li class="pSmartList2">Security parameter index (SPI)&#8212;A number which, together with a destination IP address and security protocol, uniquely identifies a particular SA. When using IKE to establish the SAs, the SPI for each SA is a pseudo-randomly derived number. </li>
<a name="wp1073096"> </a><li class="pSmartList2">Peer&#8212;A switch or other device that participates in IPsec. For example, a Cisco MDS switch or other Cisco routers that support IPsec.</li>
<a name="wp1073097"> </a><li class="pSmartList2">Transform&#8212;A list of operations done to provide data authentication and data confidentiality. For example, one transform is the ESP protocol with the HMAC-MD5 authentication algorithm. </li>
<a name="wp1073098"> </a><li class="pSmartList2">Session key&#8212;The key used by the transform to provide security services.</li>
<a name="wp1073099"> </a><li class="pSmartList2">Lifetime&#8212;A lifetime counter (in seconds and bytes) is maintained from the time the SA is created. When the time limit expires the SA is no longer operational and, if required, is automatically renegotiated (rekeyed).</li>
<a name="wp1073100"> </a><li class="pSmartList2">Mode of operation&#8212;Two modes of operation are generally available for IPsec: tunnel mode and transport mode. The Cisco NX-OS implementation of IPsec only supports the tunnel mode. The IPsec tunnel mode encrypts and authenticates the IP packet, including its header. The gateways encrypt traffic on behalf of the hosts and subnets. <br />The Cisco NX-OS implementation of IPsec does not support transport mode.</li>
<a name="wp1073101"> </a><p class="pBodyAutonumRel">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> The term <em class="cEmphasis">tunnel mode</em> is different from the term <em class="cEmphasis">tunnel</em>, which is used to indicate a secure 
communication path between two peers, such as two switches connected by an FCIP link.

</p>
</ul></div>
<a name="wp1073102"> </a><li class="pSmartList1">Anti-replay&#8212;A security service where the receiver can reject old or duplicate packets to protect 
itself against replay attacks. IPsec provides this optional service by use of a sequence number 
combined with the use of data authentication. 
</li>
<a name="wp1073103"> </a><li class="pSmartList1">Data authentication&#8212;Data authentication can refer either to integrity alone or to both integrity and 
authentication (data origin authentication is dependent on data integrity).
</li>
<div class="pSmartList2"><ul class="pSmartList2">
<a name="wp1073104"> </a><li class="pSmartList2">Data integrity&#8212;Verifies that data has not been altered. </li>
<a name="wp1073105"> </a><li class="pSmartList2">Data origin authentication&#8212;Verifies that the data was actually sent by the claimed sender. </li>
</ul></div>
<a name="wp1073106"> </a><li class="pSmartList1">Data confidentiality&#8212;A security service where the protected data cannot be observed. 
</li>
<a name="wp1073107"> </a><li class="pSmartList1">Data flow&#8212;A grouping of traffic, identified by a combination of source address and mask or prefix, 
destination address mask or prefix length, IP next protocol field, and source and destination ports, 
where the protocol and port fields can have any of these values. Traffic matching a specific 
combination of these values is logically grouped together into a data flow. A data flow can represent 
a single TCP connection between two hosts, or it can represent traffic between two subnets. IPsec 
protection is applied to data flows. 
</li>
<a name="wp1073108"> </a><li class="pSmartList1">Perfect forward secrecy (PFS)&#8212;A cryptographic characteristic associated with a derived shared 
secret value. With PFS, if one key is compromised, previous and subsequent keys are not 
compromised, because subsequent keys are not derived from previous keys. 
</li>
<a name="wp1073109"> </a><li class="pSmartList1">Security Policy Database (SPD)&#8212;An ordered list of policies applied to traffic. A policy decides if 
a packet requires IPsec processing, if it should be allowed in clear text, or if it should be dropped.
</li>
<div class="pSmartList2"><ul class="pSmartList2">
<a name="wp1073110"> </a><li class="pSmartList2">The IPsec SPDs are derived from user configuration of crypto maps.</li>
<a name="wp1073111"> </a><li class="pSmartList2">The IKE SPD is configured by the user.</li>
</ul></div>
</ul></div>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
