Configuring Ike; Overview; Ike Negotiation Process - HP MSR2000 Configuration Manual

Configuring IKE

Unless otherwise specified, the term "IKE" in this chapter refers to IKEv1.
Support for features, commands, and parameters might differ in FIPS mode and non-FIPS mode. For
more information about FIPS mode, see "Configuring FIPS."

Overview

Built on a framework defined by ISAKMP, Internet Key Exchange (IKE) provides automatic key negotiation
and SA establishment services for IPsec, dramatically simplifying the configuration and maintenance of
IPsec.
IKE is not intended solely for IPsec, but it is widely used for IPsec. This chapter describes how to use IKE
for IPsec.
IKE provides the following benefits for IPsec:
• Automatically negotiates IPsec parameters.
Performs DH exchanges to calculate shared keys, making sure each SA has a key that is
•
independent of other keys.
Automatically negotiates SAs when the sequence number in the AH or ESP header overflows,
•
making sure IPsec can provide the anti-replay service by using the sequence number.
As shown in
to protect IP packets.
Figure 49 Relationship between IKE and IPsec

IKE negotiation process

IKE negotiates keys and SAs for IPsec in two phases:
1. Phase 1—The two peers establish an IKE SA, a secure, authenticated channel for communication.
In this phase, two modes are available: main mode and aggressive mode.
Figure 49, IKE negotiates SAs for IPsec and transfers the SAs to IPsec, and IPsec uses the SAs
179