cisco ccna forum

cisco ccna forum.. Integrity: confirms that the contents of the packet have not been tampered with by an intermediate device; uses the HMAC function derived from the hash function to verify the origin of each packet and to check that the packet has not been tampered with (for a definition of HMAC, see the section on "Integrity: HMAC Functions" later).. Anti-replay protection: confirms that each packet is unique and not a duplicate to prevent someone from using a copy of a legitimate packet to launch a denial-of-service attack; uses protected sequence numbers to detect and discard duplicate packets.Chapter 24 Introduction to WAN 663IPSec provides the following services: authentication of peers using pre-shared keys or certificates (RSA signatures), use of encryption to ensure confidentiality, use of HMAC functions to ensure packet integrity, use of unique sequence numbers in packets to provide anti-replay protection o, etc.IPSec componentsThe next few subsections discuss the components of IPSec, including keys, encryption algorithms, HMAC functions, and protocols. Only a brief description of these components is given here.Confidentiality: Keys and EncryptionKeys are used to protect information. While you use passwords to protect user accounts and PINs to protect bank cards, keys are used to protect information. Keys are used for two purposes: for encryption and decryption; for authentication and to ensure the integrity of information. In general, the longer the key, the more difficult it is to decipher (find the key by reverse engineering) through a man-in-the-middle attack (MTM).There are two approaches to implementing encryption solutions: symmetric and asymmetric encryption algorithms. Symmetric encryption algorithms refer to the use of the same key for encryption and decryption; it uses a relatively simple algorithm and is very fast for encryption and decryption, so it is often used when encrypting large amounts of data. However, the problem with symmetric encryption algorithms is that the key needs to be shared between the peers in some way. In order to share the keys securely, there are two methods.. Out-of-band pre-shared keys: this method does not scale well when hundreds of keys need to be managed.