中国科技大学薛开平网络安全协议chap7资料.pptVIP

* * * IPSec在网络层上提供安全服务：定义了两个协议AH和ESP； IPSec在IP层提供安全服务，使得系统可以选择所需要的安全协议，确定该服务所用的算法，并提供安全服务所需任何加密密钥。 * * * * * * * * 属于某个转发等价类 * * * * The “Forwarding Equivalence Class” is an important concept in MPLS. An FEC is any subset of packets that are treated the same way by a router. By “treated” this can mean, forwarded out the same interface with the same next hop and label. It can also mean given the same class of service, output on same queue, given same drop preference, and any other option available to the network operator. When a packet enters the MPLS network at the ingress node, the packet is mapped into an FEC. The mapping can also be done on a wide variety of parameters, address prefix (or host), source/destination address pair, or ingress interface. This greater flexibility adds functionality to MPLS that is not available in traditional IP routing. FECs also allow for greater scalability in MPLS. In Ipsilon’s implementation of IP Switching or in MPOA, their equivalent to an FEC maps to a data flow (source/destination address pair, or source/destination address plus port no.). The limited flexibility and large numbers of (short lived) flows in the Internet limits the applicability of both IP Switching and MPOA. With MPLS, the aggregation of flows into FECs of variable granularity provides scalability that meets the demands of the public Internet as well as enterprise applications. In the current Label Distribution Protocol specification, only three types of FECs are specified: - IP Address Prefix - Router ID - Flow (port, dest-addr, src-addr etc.) The spec. states that new elements can be added as required. * Both methods are supported, even in the same network at the same time For any single adjacency, LDP negotiation must agree on a common method * * * * * * * MPLS头标格式及位置 工作原理 工作原理 转发等价类 Forwarding Equivalence Classes 转发等价类（FEC）：所有在MPLS网络中需要做相同转发处理、相同路由处理的分组。 FEC = “A subset of packets that are all treated the same way by a router” The concept of FE