IP安全协议与网络地址转换间的不兼容问题  

Incompatible Issues Between IPSec and NAT

作　　者：邢飞[1] 伍卫国[1] 刘轶[1] 钱德沛[1] 

机构地区：[1]西安交通大学计算机科学与技术系,西安710049

出　　处：《计算机工程》2003年第19期92-94,共3页Computer Engineering

基　　金：国家"863"计划资助项目(2001AA112120)

摘　　要：IP安全协议(IPSec)业已成为当前构筑基于IP技术的虚拟专用网(VPN)的主流技术,然而已广泛使用的网络地址转换(NAT)技术正成为阻碍基于IPSec的VPN发展的主要障碍。该文对IPSec和NAT/NAPT之间的不兼容问题进行了详尽分析,介绍TRealm-Specific IP(RSIP)和UDP封装法两种解决方案,并对二者进行了比较,最后给出UDP封装法更利于解决该问题的结论。IPSec has become a main tunneling technology in creating virtual private networks (VPN). However, it is shown that widespread network address translation (NAT) devices are becoming major barriers to the deployment of IPSec-based VPNs. In this paper, the incompatibility between IPSee and NAT/NAPT is clarified in detail, then two plausible solutions, RSFP and UDP encapsulation are introduced. After comparing these two proposals, a conclusion is drawn that the latter proposal will be a feasible and promising candidate to resolve the problem between IPSec and NAT.

关 键 词：IP安全协议 网络地址转换 RSIP UDP封装 虚拟专用网 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]