
Configuring IP Routers and Interfaces
2-25
BFE devices receive authorization and address translation services from an
Access Control Center residing on the Black network. The ACC makes access
control decisions that determine which hosts are allowed to communicate with
each other. A Key Distribution Center (KDC) residing on the Black network
provides encryption keys and key management services. A BFE device uses these
encryption keys for encrypting traffic between itself and other BFE devices.
The router-to-BFE interface is a modified version of the interface presented in the
1983 DDN X.25 Host Interface Specification. It supports data rates between 1200
b/s and 64 KB/s. In order to support BFE services, the interface must be
configured to support IP with the Revised IP Security Option (RIPSO) enabled.
All IP datagrams transmitted on the interface must contain a RIPSO security label.
The first option in each IP datagram header must be the Basic Security option.
BFE Addressing
You can enable BFE support on individual IP interfaces. When you enable BFE
support, the router uses the BFE address-resolution algorithm to map IP addresses
to their corresponding X.121 addresses.
BFE IP-to-X.121 address translation differs from standard DDN address
translation. Each physical router-to-BFE connection is identified by a BFE X.121
network address and a BFE IP address. The format of a BFE X.121 address is
zzzzzpdddbbb
where:
For instructions on using Site Manager to configure support for a BFE encryption device,
see “Configuring Blacker Front End Support” on page 2-89.
zzzzz
is zero
p
is the BCD encoding of the port ID
ddd
is the BCD encoding of the domain ID
bbb
is the BCD encoding of the BFE ID
Comentários a estes Manuais