User`s guide

Chapter 10 IPSec VPN Config Screens
LAN-Cell 2 User’s Guide
253
In transport mode, the encapsulation depends on the active protocol. With AH, the LAN-Cell
includes part of the original IP header when it encapsulates the packet. With ESP, however,
the LAN-Cell does not include the IP header when it encapsulates the packet, so it is not
possible to verify the integrity of the source IP address.
IPSec SA Proposal and Perfect Forward Secrecy
An IPSec SA proposal is similar to an IKE SA proposal (see Section on page 244), except that
you also have the choice whether or not the LAN-Cell and remote IPSec router perform a new
DH key exchange every time an IPSec SA is established. This is called Perfect Forward
Secrecy (PFS).
If you enable PFS, the LAN-Cell and remote IPSec router perform a DH key exchange every
time an IPSec SA is established, changing the root key from which encryption keys are
generated. As a result, if one encryption key is compromised, other encryption keys remain
secure.
If you do not enable PFS, the LAN-Cell and remote IPSec router use the same root key that
was generated when the IKE SA was established to generate encryption keys.
The DH key exchange is time-consuming and may be unnecessary for data that does not
require such security.
IPSec SA Using Manual Keys
You might set up an IPSec SA using manual keys when you want to establish a VPN tunnel
quickly, for example, for troubleshooting. You should only do this as a temporary solution,
however, because it is not as secure as a regular IPSec SA.
In IPSec SAs using manual keys, the LAN-Cell and remote IPSec router do not establish an
IKE SA. They only establish an IPSec SA. As a result, an IPSec SA using manual keys has
some characteristics of IKE SA and some characteristics of IPSec SA. There are also some
differences between IPSec SA using manual keys and other types of SA.
IPSec SA Proposal Using Manual Keys
In IPSec SA using manual keys, you can only specify one encryption algorithm and one
authentication algorithm. You cannot specify several proposals. There is no DH key exchange,
so you have to provide the encryption key and the authentication key the LAN-Cell and
remote IPSec router use.
" The LAN-Cell and remote IPSec router must use the same encryption key and
authentication key.
Authentication and the Security Parameter Index (SPI)
For authentication, the LAN-Cell and remote IPSec router use the SPI, instead of pre-shared
keys, ID type and content. The SPI is an identification number.