对IPSec VPN进行运营管理的若干问题的研究  

Research on Some Management Problems of IPSec VPN

作　　者：李云峰[1] 何剑波 饶伟 何大可[1] 

机构地区：[1]西南交通大学,成都610031 [2]迈普(四川)通信技术有限公司,成都610041

出　　处：《电信科学》2004年第11期9-12,共4页Telecommunications Science

基　　金：本文获国家"863"计划项目(No.2002AA145020)资助

摘　　要：网络管理系统是IPSec(IPsecurity,IP安全)VPN(virtualprivatenetwork,虚拟专用网络)作为一种电信运营业务的关键组成部分。VPN节点设备部署在运营商网络的边缘,这种网络模式使得对节点的管理不同于对传统网络的管理,其中,VPN业务网络拓扑的自动发现和对私有网络中的设备进行管理是两个关键的问题。本文通过在网络管理系统中指定根节点,然后利用根节点中的SA(securityassociation,安全联盟)信息来获得其他VPN节点的地址信息,从而实现VPN拓扑的自动发现;针对私有网络中的设备地址不可达的问题,本文提出了主动注册的技术,并利用主动注册同网络管理代理转发技术相结合的方法实现了对私有网络中设备的管理。Management of IPSec VPN is a key element of the carrier's service. However VPN device is located at edge of carrier's network, which make traditional network management impossible. There are two key problems, one is network finding automatically and the other is to manage devices, which located at private network. In this paper we proposed that the network management server use the SA information of VPN device to establish the VPN topology and to find the whole VPN from a base VPN device that has a public IP address. To manage the VPN device located in private network we need it to enroll itself to agent which will forward the SNMP messages come from network management server to VPN devices located in private network.

关 键 词：VPN IPS 自动发现 网络管理系统 地址 IP安全 安全联盟 电信运营业 运营管理 业务 

分 类 号：TN915.5[电子电信—通信与信息系统] TP393[电子电信—信息与通信工程]