Lesson 2

Planning an IPSec Implementation

12-23

■

Security Parameters Index Contains a value that, in combination with the

packet’s destination IP address and its security protocol (AH or ESP), defines the

datagram’s security association.

■

Sequence Number Contains a value that starts at 1 in the first packet using a

particular security association, and is incremented by 1 in every subsequent

packet using the same security association. This field provides IPSec’s anti-replay

service. If an IPSec system receives packets with the same sequence numbers and

the same security association, it discards the duplicates.

■

Payload Data Contains the TCP, UDP, or ICMP information carried inside the

original IP datagram.

■

Pad Length Specifies the number of bytes of padding the system added to the

Payload Data field to fill out a 32-bit word.

■

Next Header Contains a code specifying the protocol that generated the header

immediately following the ESP header, using the protocol codes specified by the

IANA. In virtually all cases, this field contains the code for the protocol that gen-

erated the datagram’s payload, which is usually TCP, UDP, or ICMP.

Note

When an IPSec system is using AH and ESP together, the Protocol field in the IP

header contains the value 51, because the AH header immediately follows the IP header. The

Next Header field in the AH header has the value 50, because the ESP header immediately

follows the AH header. Finally, the Next header field in the ESP header contains the code for

the protocol that generated the payload, which is usually TCP, UDP, or ICMP.

■

Authentication Data Contains an ICV based on the information after the ESP

header, up to and including the ESP trailer. The receiving system uses the ICV to

verify the packet’s integrity by performing the same calculation and comparing the

results with this value.

Security Parameters Index

Sequence Number

Payload Data

Next Header

Pad Length

Padding

Authentication Data

f12pm08

Figure 12-8

The ESP message format