ccna book cisco press

ccna book cisco press.ESP achieves confidentiality by encrypting the load, and it supports a variety of symmetric encryption algorithms. If you select ESP as the IPSec protocol, you must also select an encryption algorithm. o The default algorithm for IPSec is 56-bit DES° Cisco products also support stronger encryption using 3DES, AES, and SEAL.ESP can also provide integrity and authentication. The load is first encrypted, and then the encrypted load is sent using a hashing algorithm (HMAGMD5 or HMAC-SHA.1). The hash provides authentication and data integrity for the data load.As an optional feature, the ESP can also be protected against replay (anti-replay). Anti-replay protection verifies that each packet is unique and has not been copied, and this protection ensures that hackers cannot intercept packets and insert altered packets into the data stream. Anti-replay works by tracking the packet sequence number and using a sliding window at the destination.When a connection is established between the source and the destination, the counters at both ends are initialized to 0. Each time a packet is sent, the source appends a sequence number to the packet and the destination uses a sliding window to determine the expected sequence number. The destination verifies that the packet's sequence number is not copied and that it is received in the correct order.For example, if the sliding window at the destination is set to I, the destination expects to receive a packet with a sequence number of 1. If a replayed packet is detected, for example if the destination receives a second packet with sequence number 1, an error message is sent and the replayed packet is discarded and a log is kept of this event.Anti-replay is typically used in ESP, but AH also supports anti-replay.8.3 IPSecVPN Components and Operations 2318.3.2.4 ESP Encryption and AuthenticationRaw data is well protected by ESP because the complete raw IP datagram and the ESP append tail are encrypted. Using ESP authentication, the encrypted IP datagram and the additional tail as well as the ESP header are processed by the hashing process. Finally, a new IP header is appended to the authenticated load and the packet is transmitted over the Internet using the new IP address.If both authentication and encryption are selected, encryption is performed first. One reason for this processing sequence is that it helps the receiving device to quickly detect and discard replayed or forged packets. Before decrypting the packet, the receiver can authenticate the incoming packet. This allows for quick detection of problems and reduces the impact of potential DoS attacks. Again, ESP provides confidentiality through encryption and integrity through authentication.