ccna book chapter 1

ccna book chapter 1.AH achieves authenticity by applying a one-way hash function using a key to the packet to create a hash or message digest. The hash is transmitted in conjunction with the text. The receiver applies the same one-way hash function to the received packet and compares the result with the value of the message digest provided by the sender, thus detecting whether the packet has changed during transmission. Since one-way hashing also contains a shared key between the two systems, it ensures authenticity.AH acts on the entire packet except for any variable IP header fields that would change in transmission. For example, the Time to Live (TimetoLive,TTL) field, which is modified by the router along the transmission path, is a variable field.The sequence of AH processing is as follows.Step 1 Hash the IP header and data load using the shared key. Step 2 The hash constructs a new AH header that is inserted into the original datapacket.Step 3 The new packet is transmitted to the IPSec peer router.Step 4 The peer router uses a shared key to hash the IP header and data load, takes out the transmitted hash from the AH header, and compares the two230 Chapter 8 Implementing a Virtual Private Networkhashes. The hash values must match exactly. If one bit of the transmitted packet changes, the hash output of the received packet will change and the AH header will not match. The AH supports the HMAC-MD5 and HMAC-SHA-I algorithms. AH may encounter problems in environments where NAT is used.8.3.2.3 ESP