What You Need To Know About Ipsec Vpn; Ike Sa (Ike Phase 1) Overview; Figure 103 Vpn: Ike Sa And Ipsec Sa - ZyXEL Communications ZyXEL NBG420N User Manual

Chapter 15 IPSec VPN

15.1.2 What You Need To Know About IPSec VPN

A VPN tunnel is usually established in two phases. Each phase establishes a security
association (SA), a contract indicating what security parameters the NBG420N and the remote
IPSec router will use. The first phase establishes an Internet Key Exchange (IKE) SA between
the NBG420N and remote IPSec router. The second phase uses the IKE SA to securely
establish an IPSec SA through which the NBG420N and remote IPSec router can send data
between computers on the local network and remote network. The following figure illustrates
this.

Figure 103 VPN: IKE SA and IPSec SA

In this example, a computer in network A is exchanging data with a computer in network B.
Inside networks A and B, the data is transmitted the same way data is normally transmitted in
the networks. Between routers X and Y, the data is protected by tunneling, encryption,
authentication, and other security features of the IPSec SA. The IPSec SA is established
securely using the IKE SA that routers X and Y established first.

15.1.3 IKE SA (IKE Phase 1) Overview

The IKE SA provides a secure connection between the NBG420N and remote IPSec router.
It takes several steps to establish an IKE SA. The negotiation mode determines the number of
steps to use. There are two negotiation modes--main mode and aggressive mode. Main mode
provides better security, while aggressive mode is faster.
Note: Both routers must use the same negotiation mode.
These modes are discussed in more detail in
used in various examples in the rest of this section.
15.1.3.1 IP Addresses of the NBG420N and Remote IPSec Router
In the NBG420N, you have to specify the IP addresses of the NBG420N and the remote IPSec
router to establish an IKE SA.
You can usually provide a static IP address or a domain name for the NBG420N. Sometimes,
your NBG420N might also offer another alternative, such as using the IP address of a port or
interface.
166
Negotiation Mode on page 187. Main mode is
NBG420N User's Guide