January 2021
Intermediate to advanced
547 pages
12h 4m
Chinese
Content preview from 网络安全评估（第三版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
320
｜
第
10
章
字节
位
版本
服务类型
总长度
认证
标识 分段偏移
生存周期
协议
=
51
源地址
目标地址
下一个头 头长 保留
序号
安全参数检索（
SPI
）
完整性测试值（
ICV
）
序号
加密的数据
安全参数检索（
SPI
）
IP
头
AH
头
ESP
头
图 10-2：IPsec 数据报格式（隧道模式）
ISAKMP
、
IKE
与
IKEv2
Internet
安全关联与密钥管理协议（
Internet Security Association and Key
Management Protocol
，
ISAKMP
）可以通过
UDP 500
端口进行访问，并为
IPsec VPN
隧道提供了
IKE
支持。如图
10-1
所示，
IKE
通过两个阶段定义
IPsec SA
：第一阶段对端点进行认证，并建立一个
ISAKMP SA
（用于对第二
阶段交互的消息进行保护），第二阶段建立一个
IPsec SA
（用于对数据进行
加密）。在一些实现中，采用一种名为
XAUTH
的机制引入了一个额外的阶段，
用于支持用户认证。
VPN
服务评估
｜
321
IKE
中存在一些可利用的安全漏洞，在
IKEv2
标准
注
4
中进行了修补，
IKEv2
将两个阶段压缩为单独的一组消息。图
10-3
展示了
IKE
、
IKEv2
、
XAUTH
、
AH
和
ESP
之间的关系。
主模式 积极模式
快速模式
（任意）
（任意）
阶段
阶段
图
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.