Ike Configuration Prerequisites; Protocols And Standards; Fips Compliance; Ike Configuration Task List - HP 6125XLG Configuration Manual

PFS
The Perfect Forward Secrecy (PFS) feature is a security feature based on the DH algorithm. After PFS is
enabled, an additional DH exchange is performed in IKE phase 2 to make sure negotiated keys have no
derivative relations and a broken key brings no threats to other keys.

Protocols and standards

RFC 2408, Internet Security Association and Key Management Protocol (ISAKMP)
•
RFC 2409, The Internet Key Exchange (IKE)
•
RFC 2412, The OAKLEY Key Determination Protocol
•

FIPS compliance

The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for features,
commands, and parameters might differ in FIPS mode (see

IKE configuration prerequisites

Determine the following parameters prior to IKE configuration:
• The algorithms to be used during IKE negotiation, including the identity authentication method,
encryption algorithm, authentication algorithm, and DH group.
Different algorithms provide different levels of protection. A stronger algorithm provides more
resistance to decryption but uses more resources. Generally, an algorithm with a longer key is
stronger.
A DH group that uses more bits provides higher security but needs more time.
• The IKE-based IPsec policies for the communicating peers. If an IPsec policy does not reference any
IKE profile, the device selects an IKE profile for the IPsec policy. If no IKE profile is configured, the
globally configured IKE settings are used. For more information about IPsec, see
IKE-based IPsec

IKE configuration task list

Tasks at a glance
(Optional.)
(Optional.)
(Optional.)
(Optional.)
(Optional.)
(Optional.)
(Optional.)
policy."
Configuring an IKE profile
Configuring an IKE proposal
Configuring an IKE keychain
Configuring the global identity information
Configuring the IKE keepalive function
Configuring the IKE NAT keepalive function
Configuring IKE DPD
"Configuring
Remarks
N/A
Required when the IKE profile needs to
reference IKE proposals.
Required when pre-shared authentication is
used in IKE negotiation phase 1.
N/A
N/A
N/A
N/A
224
FIPS") and non-FIPS mode.
"Configuring an