IPsec

[cool rohan]

The IP Security Protocol (IPsec)

IPsec requires the negotiation of a unique SA for each direction of the IPsec tunnel and for each protocol used (AH, ESP, or combination thereof).

I don't understand the meaning of this line. 

Ipsec requires the negotiation of a unique SA for each direction of the IPsec tunnel this is understand

But the second one

Ipsec requires the negotiation of a unique SA for each protocol used(AH,ESP). this i don't understand.

Can anybody please explain?

[Aditya Ganjoo · Accepted solution]

Hi,

A separate pair of IPSec SAs are set up for AH and ESP transform. Each IPSec peer agrees to set up SAs consisting of policy parameters to be used during the IPSec session. The SAs are unidirectional for IPSec so that peer 1 will offer peer 2 a policy. If peer 2 accepts this policy, it will send that policy back to peer 1. This establishes two one-way SAs between the peers. Two-way communication consists of two SAs, one for each direction.

For more information check this:

http://www.ciscopress.com/articles/article.asp?p=24833&seqNum=7

Regards,

Aditya

Please rate helpful and mark correct answers

[Karsten Iwen · Accepted solution]

Also important to mention: Practically, AH is non-existent in VPNs; only ESP is used today. But when learning, of course it's still useful to also look at AH to get a better understanding.