 |
|
|
|
|
|
IPSec Architectures and Implementation Methods
(Page 3 of 3)
“Bump In The Wire” (BITW) Architecture
In this method we add a hardware device that provides IPSec services. For example, suppose we have a company with two sites. Each has a network that connects to the Internet using a router that is not capable of IPSec functions. We can interpose a special “IPSec” device between the router and the Internet at both sites, as shown in Figure 118. These devices will then intercept outgoing datagrams and add IPSec protection to them, and strip it off incoming datagrams.
|
Just as BITS lets us add IPSec to legacy hosts, BITW can “retrofit” non-IPSec routers to provide security benefits. The disadvantages are complexity and cost.
Incidentally, even though BITS and BITW seem quite different, they are really different ways of doing the same thing. In the case of BITS we add an extra software layer that adds security to existing IP datagrams; in BITW this same job is done by distinct hardware devices. In both cases the result is the same, and the implications on the choice of IPSec mode is likewise the same.
As we will see in the next topic, the choice of architecture has an important impact on which of the two IPSec modes can be used.
|
Key Concept: Three different architectures or implementation models are defined for IPSec. The best is integrated architecture, where IPSec is built into the IP layer of devices directly. The other two are “Bump In The Stack” (BITS) and “Bump In The Wire” (BITW), which both are ways of layering IPSec underneath regular IP, using software and hardware solutions respectively.
|
| |||||||||||||||||||
Home - Table Of Contents - Contact Us
The TCP/IP Guide (http://www.TCPIPGuide.com)
Version 3.0 - Version Date: September 20, 2005
© Copyright 2001-2005 Charles M. Kozierok. All Rights Reserved.
Not responsible for any loss resulting from the use of this site.