Tp-Link TL-ER6020 Инструкция по эксплуатации онлайн [88/168] 39132

-83-

3.5 VPN

VPN (Virtual Private Network) is a private network established via the public network, generally via the

Internet. However, the private network is a logical network without any physical network lines, so it is

called Virtual Private Network.

With the wide application of the Internet, more and more data are needed to be shared through the

Internet. Connecting the local network to the Internet directly, though can allow the data exchange, will

cause the private data to be exposed to all the users on the Internet. The VPN (Virtual Private Network)

technology is developed and used to establish the private network through the public network, which

can guarantee a secured data exchange.

VPN adopts the tunneling technology to establish a private connection between two endpoints. It is a

connection secured by encrypting the data and using point-to-point authentication. The following

diagram is a typical VPN topology.

Figure 3-57 VPN – Network Topology

As the packets are encapsulated and de-encapsulated in the Router, the tunneling topology

implemented by encapsulating packets is transparent to users. The tunneling protocols supported by

TL-ER6020 contain Layer 3 IPsec and Layer 2 L2TP/PPTP.

3.5.1 IKE

In the IPsec VPN, to ensure a secure communication, the two peers should encapsulate and

de-encapsulate the packets using the information both known. Therefore the two peers need to

negotiate a security key for communication with IKE (Internet Key Exchange) protocols.

Actually IKE is a hybrid protocol based on three underlying security protocols, ISAKMP (Internet

Security Association and Key Management Protocol), Oakley Key Determination Protocol, and

SKEME Security Key Exchange Protocol. ISAKMP provides a framework for Key Exchange and SA

(Security Association) negotiation. Oakley describes a series of key exchange modes. SKEME

describes another key exchange mode different from those described by Oakley.

IKE consists of two phases. Phase 1 is used to negotiate the parameters, key exchange algorithm and

encryption to establish an ISAKMP SA for securely exchanging more information in Phase 2. During

phase 2, the IKE peers use the ISAKMP SA established in Phase 1 to negotiate the parameters for

security protocols in IPsec and create IPsec SA to secure the transmission data.