---
description: IPSEC
---

# 20191029

```
GRE(Generic Routing Encapsdation)補充:
無狀態協定，不提供流量控制
GRE至少增加24bytes cost(20byte ipv4標頭+4bytes GRE header)
具備多協定特性，可以將IP以及非IP封包封裝在隧道內
*允許multicost流量和動態路由協定封包穿越隧道
安全性較弱
用ipv4作為封裝時，potocol=47
```

```
IPSEC:
數據機密性:常用加密算法 DES 3DES AES(對稱式加密方式)
數據完整性:常用算法 MD5 SHA-1
身份驗證:常用方法 pre-share預共享密碼(EX:a:cisco加密，b:cisco解密)和數字證書(數位簽章)
(前三項可任做一項，依照當下需求選擇)
防重放攻擊(replay attack):IPSec接收方可檢測並拒絕接收過時或重複的封包
```

```
tunnel模式:
*ESP:三種模式都有
*AH=authantication header:完整性身分驗證
----------------------------------
|原始IP header|TCP/UDP|原始payload|
----------------------------------
---------------------------------------------------------
|新的IP header|AH header|原始IP header|TCP/UDP|原始payload|
---------------------------------------------------------
(------------------------可被驗證-------------------------)*最常用到
-----------------------------------------------------------------------------
|新的IP header|ESP header|原始IP header|TCP/UDP|原始payload|ESP trailer|ESP驗證|
-----------------------------------------------------------------------------
             (--------------------------被驗證-------------------------)
                         (--------------------被加密-------------------)
傳輸(transport)模式:
----------------------------------
|原始IP header|TCP/UDP|原始payload|
----------------------------------
--------------------------------------------
|原始IP header|AH header|TCP/UDP|原始payload|
--------------------------------------------
------------------------------------------------------------
|原始IP header|ESP header|TCP/UDP|原始payload|ESP包尾|ESP驗證|
------------------------------------------------------------
              (----------------被驗證----------------)
                         (----------被加密-----------)
SFP+RJ45
```

```
phase 1:建立一個安全通道-「key」
phase 2:在phase 1建立的安全通道提供安全的「data」運輸
(phase 1建立的通道參數可以與第二個phase不一樣)
```

{% embed url="https://www.jannet.hk/zh-Hant/post/internet-protocol-security-ipsec/" %}

![](https://1005948644-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZgzp55XQBZ7U2SrFtZ%2F-LsLMSS52ArJ0U6KeL9H%2F-LsLMptEZz-sKTI3yIK0%2Fimage.png?alt=media\&token=4770ab56-a94e-4d27-956f-da76b61e1805)

![](https://1005948644-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZgzp55XQBZ7U2SrFtZ%2F-LsLMSS52ArJ0U6KeL9H%2F-LsLXi5udc9Zwa5lWeUU%2Fimage.png?alt=media\&token=9cc49af1-0a70-4ea5-9705-f0917850259f)

![](https://1005948644-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZgzp55XQBZ7U2SrFtZ%2F-LsLMSS52ArJ0U6KeL9H%2F-LsLZp2UjHL6tI2Zb8yX%2Fimage.png?alt=media\&token=d76e7ab7-7966-4694-a547-93f0635d8779)

![](https://1005948644-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZgzp55XQBZ7U2SrFtZ%2F-LsLMSS52ArJ0U6KeL9H%2F-LsLY-4cSxqH9s41XM9f%2Fimage.png?alt=media\&token=b1689414-ab7c-4685-b2af-dc47e64f3019)

{% embed url="https://www.jannet.hk/zh-Hant/post/gre-over-ipsec-vs-ipsec-over-gre/" %}

![](https://1005948644-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZgzp55XQBZ7U2SrFtZ%2F-LsLMSS52ArJ0U6KeL9H%2F-LsL_qtWoyJ6Y_ta3YdL%2Fimage.png?alt=media\&token=a8d509ce-b570-4706-902f-714617a6728b)

![](https://1005948644-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZgzp55XQBZ7U2SrFtZ%2F-LsLMSS52ArJ0U6KeL9H%2F-LsL_V0Hp3e9GTR9iBM7%2Fimage.png?alt=media\&token=d6d53a7b-392d-4094-9ed2-54e9a2aba09c)

![](https://1005948644-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZgzp55XQBZ7U2SrFtZ%2F-LsLMSS52ArJ0U6KeL9H%2F-LsLbE2tKbUW2trHZ4_R%2Fimage.png?alt=media\&token=18433369-bbc8-43c2-8023-d7ed3037a072)
