【摘要】 对适用于IPv6网络的包过滤防火墙的分组过滤模式与IPsec加密数据流之间的兼容性问题进行了分析 .针对网关防火墙不能对抗大量已取得了目标主机部分信任的“伪信任”主机所发出的具有攻击性的加密数据包 ,为IPv6逐跳选项扩展报头定义了一种新的选项———端口通告 ,有效地使网关防火墙能够对加密数据流进行分组过滤 ,并分析了亟待解决的问题更多还原

【Abstract】 This paper analyzes compatibility of the group filtering mode of firewall and IPsec encrypted datastream in the IPv6 network. Because the gateway firewall can′t deal with aggressive encrypted packets sent by half trust hosts, this paper defines a new option for the IPv6 hop-by-hop option--port announce, which can make gateway effectively filter the encrypted packets. Then some problems to be solved are studied.更多还原