VPN的NAT穿透研究及系统设计  

Research on VPN's NAT Traversal and System Design

作　　者：李建[1] 王坤[1] 曹进可[1] 谢培泰[1] 

机构地区：[1]国家数字交换系统工程技术研究中心,郑州450002

出　　处：《计算机工程与应用》2003年第4期183-185,188,共4页Computer Engineering and Applications

摘　　要：IPSec体系结构保证数据在网络中安全地传输。在通过网络时,一些NAT设备如防火墙对数据包头所做的改动,会产生一些问题。文章讨论了VPN和防火墙穿透的不兼容性,及进行防火墙穿透设计的要求,并设计了一种方案,使初始IKE协商和随后的认证/加密通信在IPSecAH/ESPSA中正常工作。IPSec architecture is based on the concept of keeping data secure while it is being transported across a network.Therefore there are problems when packet headers changes while in transmit across the network,by virtue of NAT devices such as firewalls.This paper discusses the incompatibilities between VPN and NAT,and the requirements for firewall traversal.Then a solution is proposed to make both initial IKE negotiations and subsequent authenticated/encrypted communications across IPSec AH/ESP SAs work.

关 键 词：VPN NAT 穿透 系统设计 网络地址翻译 Internet 网络安全 防火墙 IPSEC协议 

分 类 号：TP393.4[自动化与计算机技术—计算机应用技术]