北京航空航天大学学报 ›› 2007, Vol. 33 ›› Issue (01): 63-66.

• 论文 • 上一篇    下一篇

一种新的IPSEC穿越NAT方法

彭近兵, 龙翔, 高小鹏, 陈贤钦   

  1. 北京航空航天大学 计算机学院, 北京 100083
  • 收稿日期:2006-01-10 出版日期:2007-01-31 发布日期:2010-09-19
  • 作者简介:彭近兵(1968-),男,安徽庐江人,博士生,pengjinbing@les.buaa.edu.cn.

New solution for IPSEC passing through NAT

Peng Jinbing, Long Xiang, Gao Xiaopeng, Chen Xianqin   

  1. School of Computer Science and Technology, Beijing University of Aeronautics and Astronautics, Beijing 100083, China
  • Received:2006-01-10 Online:2007-01-31 Published:2010-09-19

摘要: Internet网络层安全协议(IPSEC)和网络地址翻译器(NAT)不兼容,这严重限制了 IPSEC的应用范围.解决方法必须遵循的原则是既能使IPSEC数据流穿越NAT,又不必修改路 由器和NAT,部署方便.目前存在的3种解决方法都具有局限性:"先于IPSEC进行NAT转换 "方法难以实现,"特定域IP通信(RSIP)"方法部署困难,"用户数据包(UDP)封装安 全封装协议(ESP)数据包"方法只能部分地解决IPSEC与NAT不兼容问题.在分析现有方法的 基础上,提出一种新的解决方法,即UDP封装IPSEC数据包方法.该方法通过UDP封装IPSEC数 据包,保护原始IP地址和端口号,消除了NAT对IPSEC影响.详细介绍了该方法的实现思路, 进行了可行性和优缺点分析.通过分析可知,新方法具有明显优点,能够方便、有效地解决 IPSEC和NAT兼容问题.

Abstract: The application range of IP security protocol (IPSEC) is badly restric ted due to the incompatibility of IPSEC and network address translator (NAT). Th e rule that must to be followed by the solutions for IPSEC passing through NAT i s that IPSEC pass through NAT without any changes to the routers and NAT on the Internet. There are limits to the current three solutions. It can barely be real ized to execute the NAT ahead of executing the IPSEC. It is difficult to deploy the realm specific IP(RSIP). The incompatibility of IPSEC and NAT can only be solved partially by user data packet(UDP) encapsulation of the IP enca psulating security payload(IPSEC ESP) packets. A new solution, UDP encapsulation of IPSEC packets, was developed. The new solution eliminates the impact from NA T to IPSEC by protecting the origin IP addresses and ports of the IPSEC packets through encapsulating the IPSEC packets with UDP header. The feasibility of this solution was demonstrated. The analyse shows that the new solution has evident advantages over the others and can remove the incompatibilities between IPSEC an d NAT effectively and expediently.

中图分类号: 


版权所有 © 《北京航空航天大学学报》编辑部
通讯地址:北京市海淀区学院路37号 北京航空航天大学学报编辑部 邮编:100191 E-mail:jbuaa@buaa.edu.cn
本系统由北京玛格泰克科技发展有限公司设计开发