AAA—authentication, authorization, and accounting. Framework of security services that provides the method for identifying users
(authentication), for remote access control (authorization), and for collecting and sending security server information used
for billing, auditing, and reporting (accounting).
aggressive mode (AM)—Mode during Internet Key Exchange negotiation. Compared to main mode (MM), AM eliminates several steps, which makes it faster
but less secure than MM. Cisco IOS software will respond in aggressive mode to an Internet Key Exchange (IKE) peer that initiates
aggressive mode.
AV pair—attribute-value pair.
IKE—Internet Key Exchange. Hybrid protocol that implements Oakley key exchange and Skeme key exchange inside the ISAKMP framework.
Although IKE can be used with other protocols, its initial implementation was with IPsec. IKE provides authentication of the
IPsec peers, negotiates IPsec keys, and negotiates IPsec security associations.
IPsec—IP Security Protocol. Framework of open standards that provides data confidentiality, data integrity, and data authentication
between participating peers. IPsec provides these security services at the IP layer. IPsec uses IKE to handle negotiation
of protocols and algorithms based on local policy and to generate the encryption and authentication keys to be used by IPsec.
IPsec can be used to protect one or more data flows between a pair of hosts, between a pair of security gateways, or between
a security gateway and a host.
ISAKMP—Internet Security Association Key Management Protocol. Protocol framework that defines payload formats, the mechanics of
implementing a key exchange protocol, and the negotiation of a security association.
MM—main mode. Mode that is slower than aggressive mode but more secure and more flexible than aggressive mode because it can
offer an IKE peer more security proposals. The default action for IKE authentication (Rivest, Shamir, and Adelman signature
(rsa-sig), RSA encryption (rsa-encr), or preshared) is to initiate main mode.
policy push—Allows administrators to push policies that enforce security to the Cisco Easy VPN (software) Client and related firewall
software.
reverse route injection (RRI)—Simplified network design for VPNs on which there is a requirement for redundancy or load balancing. RRI works with both
dynamic and static crypto maps.
In the dynamic case, as remote peers establish IPsec security associations with an RRI enabled device, a static route is
created for each subnet or host protected by that remote peer. For static crypto maps, a static route is created for each
destination of an extended access-list rule.
SA—security association. Description of how two or more entities will utilize security services to communicate securely. For
example, an IPsec SA defines the encryption algorithm (if used), the authentication algorithm, and the shared session key
to be used during the IPsec connection.
Both IPsec and IKE require and use SAs to identify the parameters of their connections. IKE can negotiate and establish its
own SA. The IPsec SA is established either by IKE or by manual user configuration.
VPN—Virtual Private Network. Framework that consists of multiple peers transmitting private data securely to one another over
an otherwise public infrastructure. In this framework, inbound and outbound network traffic is protected using protocols that
tunnel and encrypt all data. This framework permits networks to extend beyond their local topology, while remote users are
provided with the appearance and functionality of a direct network connection.
Feedback