Method and device of obtaining IPSec SA (Internet Protocol Security Association)

Abstract

The invention provides a method and a device of obtaining IPSec SA (Internet Protocol Security Association). The method comprises the following steps that: a VAM (Virtual Private Network Address Management) client registers with a VAM server; the VAM server issues the corresponding IPSec SA to the VAM client according to the registration information of the VAM client; the VAM client transmits a keepalive message to the VAM server; the keepalive message comprises an SPI (Security Parameter Index) of the local newest IPSec SA of the VAM client; the VAM server judges whether the SPI of the newest IPSec SA of the VAM client is equal to the SPI of the local newest IPSec SA; if the SPI of the newest IPSec SA of the VAM client is not equal to the SPI of the local newest IPSec SA, the local newest IPSec SA is issued to the VAM client. Through the method and the device, the centralized management and issuing of the IPSec SA in an ADVPN (Auto Discovery Virtual Private Network) network can be implemented, and meanwhile, the keepalive message is initiated by the VAM client, so that when the local IPSec SA of the VAM client is updated by the VAM server, the newest IPSec SA, which is issued by the VAM server, can normally pass through an NAT (Network Address Translator).

Description

technical field [0001] The present invention relates to the field of communication technology, in particular to a method and device for acquiring IPSec SA. Background technique [0002] The traditional GRE (Generic Routing Encapsulation, general routing encapsulation) tunnel is a point-to-point tunnel, and the two ends of the communication must know the public network address of the other end; and the ADVPN (Auto Discovery Virtual Private Network, automatic discovery virtual private network) is A layer-3 tunnel that provides a point-to-multipoint tunnel and can realize intercommunication between multiple branches. Therefore, in an ADVPN network, each node needs to know the public network addresses of all peers. [0003] In the ADVPN network, the public network address of the communication peer is obtained by deploying a VAM (Virtual Private Network Address Management, virtual private network address management) server. The VAM protocol is the main protocol of the ADVPN solu...

AI Technical Summary

Problems solved by technology

Therefore, when there are many nodes, the entire ADVPN network needs to establish and maintain a large number of IKE SAs and IPSEC SAs. For example, if there are 3000 branches in a network, the Hub device needs to establish and maintain 3000 IKE SAs and IPSEC SAs. Need to consume a lot of system resources

Images