ccna book by todd lammle pdf

ccna book by todd lammle pdf.Newer CiscoIOS releases support more advanced DH groups.The DH group selected must be strong enough (that is, have sufficient cipher length) to protect the IPSec key during negotiation. For example, DH group 1 can only support DES and 3DES encryption, but not AES. the VPN peer negotiates which DH group to use during tunnel establishment.8.3.2 IPSec Security Protocols8.3.2.1 IPSec Framework ProtocolIPSec is a framework of open standards. IPSec articulates a messaging approach to securing communications, but is based on algorithms that are already in existence. The two main protocols of the IPSec framework are AH and ESPOIPSec protocol is the first component of the framework. The choice of AH or ESP determines the type of other components available.The IP protocol type for the Authentication Header (AH) -------------AH is 51. AH is the appropriate choice when confidentiality of data is not required or allowed. It provides data authentication and integrity functions for IP packets transmitted between two systems. It ensures that the source of the data is R1 or R2, and verifies that the data has not been modified during transmission. AH does not provide data confidentiality (encryption) of packets, and all text is transmitted unencrypted. Ifonly the AH protocol is used, it provides weak protection.EncapsulatingSecurity Payload (ESP) ----------------ESP has an IP protocol type of 50 and can provide confidentiality and authentication. It encrypts IP packets to achieve confidentiality. IP packet encryption hides the data load and the true source and destination identifiers. ESP authenticates internal 1P packets and ESP headers. Authentication provides authenticity of the data source and data integrity. Although both encryption and authentication are optional in ESP, at least one of the two needs to be selected.8.3.2.2AH