|
[ Pobierz całość w formacie PDF ]
." The name was probablyinspired by science fiction.As the specification was being developed, it was named IP Version 6 (IPv6).Many people fail to appreciate the distinction between the working group and its product.Consequently,they refer to the new protocol as IPng.The inability to accommodate time-sensitive traffic (known as isochronous services)The lack of network layer security, including both authentication and encryption servicesIPv4 also suffers from other limitations that users might not appreciate.These includeThe shortage of available IPv4 addressesThe limitations that its two-level address imposes on the global scalability of the Internet and otherlarge IP networksFor all of these reasons, the IETF launched a working group to develop the next generation IP: IPv6.The Effects of IPv6When finally completed and supported in commercial products, IPv6 will have a profound effect oninternetworking.It will affect routers in four distinct ways:Individual routing table entries will increase in size.http://wwwin.cisco.com/cpress/cc/td/cpress/fund/iprf/ip2915.htm (6 of 13) [02/02/2001 11.40.50] The Future of RoutingThe overall size of routing tables will decrease due to the way routes are aggregated.Next-generation routing protocols will emerge that can work with the new address architectures.Routers will have to support many services that are not currently available at the network layer.Many of these changes are either self-explanatory or have been adequately examined in the context oftheir address architectures.The one exception is the myriad network-layer services that routers will soonbe supporting.These services fall predominantly into one of two categories: security or isochronousservices.The security protocols are embedded in a new suite of protocols known as IP Security (IPSec).Isochronous protocols are a bit less well organized, and do not enjoy the architectural context of aprotocol suite such as IPSec.Nevertheless, the various emerging Voice over IP (VoIP) technologies willbenefit tremendously from IPv6's isochronous capabilities, including its capability to deliver a specificquality of service (QoS).Note Although these services may have emanated, either directly or indirectly, from the development ofIPv6, you won't have to wait for IPv6 to use them.This is because IPv4 continues to grow and evolve,concurrent with the development of the specifications for IPv6.Therefore, IPSec will be supported byboth versions of IP, as will many of the isochronous service protocols.IPSecThe IETF has developed the IPSec architectural framework for securing transmissions over an IPnetwork.IPSec features network layer support for authentication of the originator, encryption oftransmitted data, and even protection of the header information of transmitted packets through a processknown as encapsulation.These services enable end-to-end security of data through an IP network.Although this may not seem significant, remember that IP was designed to provide best-effort delivery ofdata through a routed and connectionless network environment.Connectionless means that virtuallyevery packet could take a different route through the network.Therefore, the challenge was to develop aseries of mechanisms that would allow each router in an internetwork to support the end-to-end securityof the data in transit.The solution developed by the IETF is known as a security association (SA).An SA is a logical, simplex"path" between a source and a destination machine.This path is considered logical rather than physicalbecause it remains possible for each transmitted packet to take a different route through the network.TheSA itself is a relatively simple construct.It consists of a security parameter index (SPI), the securityprotocol being used, and the destination IP address.This construct can be supported in both IPv4 andIPv6.Its fields are added to the datagram after the IP header, but before the TCP or UDP header.Placing these fields at the beginning of the IP datagram's payload is a relatively easy way of enablingend-to-end protection of the IP data, despite its passage through an otherwise unsecured network.Equallyas important, this technique does not encumber the routers in the network.They can forwardIPSec-compliant datagrams just as they would any other IP datagram.Thus, they can contribute to theend-to-end security of an IPSec-compliant session without having to do anything but forward datagrams!This preserves their previous level of operational efficiency, while adding substantial network layersecurity.SAs can be used to support two IPSec security protocols: Authentication Header (AH) and Encapsulatinghttp://wwwin.cisco.com/cpress/cc/td/cpress/fund/iprf/ip2915.htm (7 of 13) [02/02/2001 11.40.50] The Future of RoutingSecurity Payload (ESP).It is important to note that IPSec only permits one SA per service! Therefore, ifyou want to perform both encapsulation and authentication, you would need two SAs.SAs, however, aresimplex in nature.That is, they only work in one direction.To illustrate this point, consider Figure 15-4.This figure illustrates a simplex authentication SA.The source machine is authenticated to thedestination machine, but any datagrams generated in response are not similarly authenticated.In otherwords, the destination machine is assumed to be legitimate and no authentication is performed.Figure 15-4: Simplex authentication.Assuming that the destination machine is legitimate can be a dangerous assumption.Providingbidirectional authentication is just a matter of using two unidirectional authentication SAs:One authenticates the source machine to the destination machine.The other authenticates the destination machine to the source machine.Figure 15-5 depicts this bidirectional authentication.ESP headers work the same way.They are simplex, but can be paired to provide bidirectionalencapsulation.The important thing to remember is that multiple SAs are permitted, per connection.Providing bidirectional authentication and bidirectional encapsulation on a connection would require thedefinition of four SAs.This flexibility enables a network administrator to customize the degree ofsecurity according to the users' needs.Figure 15-5: Bidirectional authentication.http://wwwin.cisco.com/cpress/cc/td/cpress/fund/iprf/ip2915.htm (8 of 13) [02/02/2001 11.40 [ Pobierz całość w formacie PDF ] |
Archiwum
|