GB/T 32922-2023Information security technology—Baseline and implementation guide of IPSec VPN securing access (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules for Standardization Documents" drafting.

This document replaces GB/T 32922-2016 "Information Security Technology IPSec VPN Secure Access Basic Requirements and Implementation Guidelines", and Compared with GB/T 32922-2016, except for structural adjustment and editorial changes, the main technical changes are as follows:

--- Added IPSecVPN security access point to multipoint scenario (see 5.1.2);

---Changed the schematic diagram of IPSecVPN secure access scenario (see Chapter 5, Chapter 5 of the 2016 edition);

---Changed the requirements for using the IPSecVPN gateway password algorithm (see 6.1.1, 6.1.1 of the 2016 edition);

---Changed the description of IPSecVPN gateway VPN functional requirements (see 6.1.2, 6.1.2 of the 2016 edition);

---Changed the description of IPSecVPN gateway reliability function requirements (see 6.1.2, 6.1.2 of the 2016 edition);

--- Added the description of IPSecVPN gateway supporting dynamic route selection in branch multi-exit scenarios (see 6.1.2);

---Changed the description of IPSecVPN gateway interworking compatibility function requirements (see 6.1.2, 6.1.2 of the 2016 edition);

---Changed the description of the IPSecVPN gateway IPv6 compatibility function requirements (see 6.1.2, 6.1.2 of the 2016 edition);

--- Added description of IPSecVPN gateway usability function requirements (see 6.1.2);

---Changed the description of the functional requirements for IPSecVPN gateway certificate authentication (see 6.1.2, 6.1.2 of the 2016 edition);

---Changed the performance requirements of IPSecVPN gateway products (see 6.1.3, 6.1.3 of the 2016 edition);

---Changed the technical requirements of IPSecVPN client, merging subchapters of software and hardware requirements (see 6.2, 6.2 of the 2016 edition);

--- Changed the requirements of IPSec security protocol type in IPSecVPN gateway and client functional requirements (see 6.1.2 and 6.2, 6.1.2 and 6.2 of the 2016 edition);

---Changed the IPSecVPN gateway and client device management requirements (see 6.3.1, 6.3.1 of the 2016 edition);

--- Changed the description of IPSecVPN gateway and client certificate management requirements (see 6.3.2, 6.3.2 of the 2016 edition);

--- Added "password requirements" (see 6.4);

--- Changed the relevant description of the implementation guide (see Chapter 7, Chapter 7 of the 2016 edition);

--- Changed the description of typical application scenarios (see Appendix A, Appendix A of the 2016 edition);

--- Added the appendix "Common IPSec VPN functions" (see Appendix B), and adjusted the original Appendix B to Appendix C;

--- Deleted the transport mode IPSec6over4 tunnel scenario (see Appendix C.2 of the 2016 edition).

1 Scope

This document specifies the basic aspects of gateway, client, security management and password application in the process of IPSecVPN secure access application. This requirement provides typical scenarios and implementation process guidelines for implementing secure access using IPSec VPN technology.

This document is applicable to institutions that use IPSecVPN technology to carry out secure access applications, and guides their development based on IPSecVPN technology. Requirement analysis, scheme design, scheme verification, configuration implementation, and operation management of secure access platforms or systems.

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text. Among them, dated references For documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document.

GB/T 15843 (all parts) Information technology security technology entity authentication

GB/T 19713 Information Technology Security Technology Public Key Infrastructure Online Certificate Status Protocol

GB/T 20518 Information Security Technology Public Key Infrastructure Digital Certificate Format

GB/T 25069 Information Security Technical Terms

GB/T 32915 Information Security Technology Binary Sequence Randomness Detection Method

GB/T 36968 Information Security Technology IPSecVPN Technical Specification

GB/T 37092 Information Security Technology Cryptographic Module Security Requirements

GB/T 38636 Information Security Technology Transport Layer Cryptography Protocol (TLCP)

GM/T 0023 IPSecVPN Gateway Product Specification

GM/T 0050 Cryptography Device Management Device Management Technical Specifications

GM/T 0062 Random Number Testing Requirements for Cryptographic Products

GM/T 0089 Simple Certificate Enrollment Protocol Specification

3 Terms and Definitions

GB/T 25069, GB/T 36968 and the following terms and definitions apply to this document.

3.2 VPN

A technique that uses cryptography to build a secure channel in a communication network. [Source: GB/T 36968-2018, 3.7]