User Guide

Page 158 SonicWALL Internet Security Appliance User’s Guide
Basic VPN Terms and Concepts
• VPN Tunnel
A VPN Tunnel is a term that describes a connection between two or more private nodes
or LANs over a public network, typically the Internet. Encryption is often used to
maintain the confidentiality of private data when traveling over the Internet.
• Encryption
Encryption is a mathematical operation that transforms data from "clear text"
(something that a human or a program can interpret) to "cipher text" (something that
cannot be interpreted). Usually the mathematical operation requires that an
alphanumeric "key" be supplied along with the clear text. The key and clear text are
processed by the encryption operation, which leads to data scrambling that makes
encryption secure. Decryption is the opposite of encryption: it is a mathematical
operation that transforms cipher text to clear text.
• Key
A key is an alphanumeric string used by the encryption operation to transform clear
text into cipher text. A key is comprised of hexadecimal characters (0, 1, 2, 3, 4, 5, 6,
7, 8, 9, a, b, c, d, e, f). A valid key would be 1234567890abcdef. Keys used in VPN
communications can range in length, but typically consist of 16 or 32 characters. The
longer the key, the more difficult it is to break the encryption.
• Asymmetric vs. Symmetric Cryptography
Asymmetric and symmetric cryptography refer to the keys used to authenticate, or
encrypt and decrypt the data.
Asymmetric cryptography, or public key cryptography, uses two keys for verification.
Organizations, such as RSA Data Security and Verisign, support asymmetric
cryptography.
With symmetric cryptography, the same key is used to authenticate on both ends of
the VPN. Symmetric cryptography, or secret key cryptography, is usually faster than
asymmetric cryptography. Therefore symmetric algorithms are often used when large
quantities of data have to be exchanged. SonicWALL VPN uses Symmetric
Cryptography. As a result, the key on both ends of the VPN tunnel must match exactly.
• Security Association (SA)
A Security Association is a group of security settings related to a specific VPN tunnel.
A Security Association groups together all of the settings necessary to create a VPN
tunnel. Different SAs can be created to connect branch offices, allow secure remote
management, and pass unsupported traffic. All Security Associations (SAs) require a
specified Encryption Method, IPSec Gateway Address and Destination Network
Address. IKE includes a Shared Secret. Manual Keying includes two SPIs and an
Encryption and Authentication Key. SonicWALL PRO 300 supports up to 1,000 VPN SAs;
SonicWALL PRO 200, 100 SAs; SonicWALL PRO 100, 25 SAs; SonicWALL SOHO3, 10
SAs; and SonicWALL TELE3, 5 SAs.
integrated_manual.book Page 158 Friday, October 12, 2001 2:56 PM