CCNA Complete Guide 2nd Edition.pdf - Cisco Learning Home

- IPsec-based VPN is comprised of 2 parts – Internet Key Exchange (IKE) protocol and IPsec
security protocols – Authentication Header (AH) and Encapsulating Security Payload (ESP).
Below describes the flow of IPsec events:
i) IKE Phase 1: IKE Security Negotiation – IKE negotiates how to protect IKE by
establishing an authenticated and secure channel between 2 IKE peers called the
IKE Security Association. IKE Phase 1 is consists of Main Mode or Aggressive Mode.
The peer that initiates the session will propose or offer at least one or more configured
ISAKMP policies which specify a combination of encryption algorithm, hash algorithm,
authentication type, Diffie-Hellman group, and the lifetime. The remote peer will then try
to find a matching configured policy that has the same parameters as the one being sent
by its peer. If no matching policy is found, IKE will terminate the negotiation. If a policy
is mutually agreed upon, IKE will complete the negotiation process and an ISAKMP SA
will be created. Additionally, peers in an IPsec session must authenticate themselves
among each other during IKE Phase 1 Main Mode exchange before IKE can proceed.
ii) IKE Phase 2: IPsec Security Negotiation – IKE negotiates how to protect IPsec by
negotiating the IPsec security associations (SAs) and generating the keys for IPsec.
IKE Phase 2 negotiation is done in only 1 mode – Quick Mode. The peer that initiates
the session will propose or offer at least one or more configured transforms which specify
a combination of authentication and/or encryption algorithm. The remote peer will then
try to find a matching configured transform that has the same parameters as the one being
sent by its peer. If no matching transform is found, IKE will terminate negotiation and an
IPsec VPN will not be established. If a policy is mutually agreed upon, IKE will complete
the negotiation process and an IPsec SA will be created.
iii) IPsec transfers the actual data in the VPN tunnel using the authentication and encryption
methods agreed upon the IKE negotiation process.
- Internet Key Exchange (IKE) allows 2 VPN endpoints verify the identity of each other
(using pre-shared keys or RSA) in IKE Phase 1, and negotiate the methods (security policies) for
secured data transmission in IKE Phase 2. IKE manages VPN connections by defining a set of
Security Associations (SAs) for each connection. Each SA has its own SAID.
- In a VPN, before a communication path is considered secure, the VPN endpoints must be
authenticated. IPsec uses the following authentication methods to authenticate peers:
Pre-Shared Keys Secret key values that are manually configured on each peer.
RSA signatures Use the exchange of digital certificates to authenticate the peers.
- IKE is a hybrid protocol that uses part of Oakley and part of SKEME inside the ISAKMP
framework; hence IKE is formerly known as ISAKMP/Oakley. IKE typically uses ISAKMP for
key exchange and establishment of SAs, although other methods can be used.
- IKE establishes both ISAKMP and IPsec SAs for an IPsec VPN session. IKE first negotiates an
ISAKMP SA with the peer. It is possible to configure multiple policy statements with different
parameters, and then allow the peers to negotiate and establish a mutual agreement.
- An IPsec SA defines the security algorithms or parameters associated with particular connection
– the IPsec protocol (AH, ESP, or both), the session keys used for data encryption, etc.
IPsec SAs are unidirectional (simplex); hence there is always more than 1 IPsec SA per IPsec
connection. In cases where only either AH or ESP is used, 2 SAs will be created for each
connection – one for each the incoming and outgoing traffic. In cases where AH and ESP are
used in conjunction, 4 SAs will be created.
296
Copyright © 2008 Yap Chin Hoong
yapchinhoong@hotmail.com