IPsec 技术白皮书

目录 1概述·························································································································································11.1产生背景·············································································································································· 11.2技术优点·············································································································································· 12技术实现·················································································································································12.1 IPsec基本概念····································································································································· 12.1.1安全联盟··································································································································· 12.1.2安全协议··································································································································· 22.1.3安全机制··································································································································· 32.1.4封装模式··································································································································· 32.2 IKE协议··············································································································································· 42.2.1 IKE的优点································································································································· 42.2.2 IPsec与IKE的关系··················································································································· 52.2.3 IKE的安全机制·························································································································· 52.2.4 IKE协议版本····························································································································· 62.3 IKEv1协商建立IPsec SA ···················································································································· 62.3.1基本过程··································································································································· 62.3.2协商模式··································································································································· 62.3.3主模式······································································································································· 62.3.4野蛮模式··································································································································· 72.3.5国密主模式································································································································ 72.4 IKEv2协商建立IPsec SA ···················································································································· 82.4.1 IKEv2的协商过程······················································································································ 82.4.2 IKEv2引入的新特性·················································································································· 92.5 IPsec运行机制····································································································································· 92.6定义保护数据流的方法······················································································································ 112.6.1 ACL方式·································································································································· 112.6.2路由方式································································································································· 123技术特色···············································································································································13 3.1高效安全的硬件加密引擎··················································································································· 133.2高安全性的量子加密·························································································································· 143.3全面支持国密算法······························································································································ 143.4稳定可靠的智能选路·························································································································· 14 3.5自动反向路由注入······························································································································ 153.6保护IPv6路由协议···························································································································· 163.7保护SDWAN报文····························································································································· 163.8掩码过滤与流量重叠检