Question

Difficulty: EasyRemote Access and Site-to-Site VPN Concepts

Match each VPN framework element on the left with its primary functional purpose on the right.

  • Diffie-Hellman (DH) GroupEnables two peer devices to securely derive a shared secret key over an unsecure network.
  • Encapsulating Security Payload (ESP)Provides data confidentiality through encryption along with data integrity and authentication.
  • Authentication Header (AH)Provides data integrity and origin authentication for IP packets without providing confidentiality.
  • Internet Key Exchange (IKE)Establishes a secure control channel and negotiates Security Associations (SAs).

Answer

Diffie-Hellman (DH) Group pairs with deriving shared secret keys over unsecure networks; Encapsulating Security Payload (ESP) pairs with providing confidentiality through encryption along with integrity; Authentication Header (AH) pairs with providing data integrity without confidentiality; Internet Key Exchange (IKE) pairs with establishing control channels and negotiating SAs.
Each IPsec component performs a distinct function: Diffie-Hellman derives shared secret keys over an untrusted link, ESP delivers packet encryption and integrity, AH delivers authentication without confidentiality, and IKE manages negotiation and Security Associations.

Step-by-Step Solution

1
Identify the key exchange method
Diffie-Hellman allows peer routers to compute a shared secret key over an unsecure medium.
Symmetric encryption key material must be securely established before encrypting tunnel data.
2
Differentiate between IPsec data encapsulation protocols
ESP provides payload encryption (confidentiality) plus authentication. AH provides authentication only, leaving payload plaintext.
AH lacks an encryption algorithm, whereas ESP encapsulates and encrypts payload data.
3
Identify the management and SA negotiation protocol
IKE negotiates security parameters and manages Security Associations (SAs).
IKE handles control plane negotiation prior to data plane forwarding.

Key Concept

IPsec Protocol Framework Components
Rate this question