IP Security | Storage Networking Protocol Fundamentals (Vol 2)

Security for IP-based communication is provided via many mechanisms. Central to these is the IP Security (IPsec) suite of protocols and algorithms. The IPsec suite is defined in many IETF RFCs. Each IPsec RFC falls into one of the following seven categories:

Architecture
Encapsulating Security Payload
Authentication Header
Encryption Algorithms
Authentication Algorithms
Key Management Protocols
Domain of Interpretation

The primary IPsec RFCs include the following:

2401 Security Architecture for the Internet Protocol
2406 IP Encapsulating Security Payload (ESP)
2402 IP Authentication Header (AH)
2409 Internet Key Exchange (IKE)
2408 Internet Security Association and Key Management Protocol (ISAKMP)
2407 IP Security Domain of Interpretation (DOI) for ISAKMP

The IPsec suite provides the following services:

Access control
Data origin authentication
Connectionless data integrity
Anti-replay protection
Data confidentiality
Limited traffic flow confidentiality

IPsec is implemented at the OSI Network Layer between two peer devices, so all IP-based ULPs can be protected. IPsec supports two modes of operation: transport and tunnel. In transport mode, a security association (SA) is established between two end nodes. In tunnel mode, an SA is established between two gateway devices or between an end node and a gateway device. A security association is a unidirectional tunnel identified by a Security Parameter Index (SPI), the protocol used (ESP) and the destination IP address. Two SAs must be established (one in each direction) for successful communication to occur.

IP routers and switches also support Access Control Lists (ACL). An ACL permits or denies protocol actions based on a highly granular permissions list applied to the ingress or egress traffic of a specified interface or group of interfaces. An ACL can be applied to inter-VLAN traffic or intra-VLAN traffic. Inter-VLAN traffic is filtered by applying an ACL to a router interface. This is sometimes called a Router ACL (RACL). Intra-VLAN traffic is filtered by applying an ACL to all non-ISL switch ports in a given VLAN. An intra-VLAN ACL is sometimes called a VLAN ACL (VACL).