Function Of Ike; Relationship Between Ike And Ipsec; Ike Configuration Task List - 3Com MSR 50 Series Configuration Manual

Function of IKE

Relationship between
IKE and IPSec
IKE Configuration Task
List
above three messages. As aggressive mode exchanges less information and
features higher negotiation speed, it is better for scenarios where the requirement
for identity protection is lower. For scenarios with higher requirement for identity
protection, main mode is recommended.
IKE automatically negotiates IPSec parameters such as the keys, reducing the
■
manual configuration complexity greatly.
IKE always uses DH when establishing an SA, ensuring that each SA has a
■
unique key.
IPSec uses the sequence number, a 32-bit value in an IP header for anti-replay.
■
If the value overflows, a new SA needs to be established for anti-replay, in
which procedure IKE is required.
IKE allows for end-to-end dynamic authentication.
■
Identity authentication and management of peers influence IPSec deployment.
■
A large-scale IPSec deployment needs the certificate authority (CA) or other
institutes which manage identity data centrally.
Error! Objects cannot be created from editing field codes.-XX
Figure 554 Relationship between IKE and IPSec

Relationship between IKE and IPSec:

IKE is an application layer protocol using UDP and functions as the signaling
■
protocol of IPSec.
IKE negotiates SAs SA for IPSec and delivers negotiated parameters and
■
generated keys to IPSec.
IPSec uses the SAs set up through IKE negotiation for encryption and/or
■
authentication of IP packets.
Prior to IKE configuration, you need to:
Determine the strength of the algorithms for IKE negotiation, namely the
■
security protection level, including identity authentication method, encryption
algorithm, authentication algorithm, and DH group. Different algorithms
provide different levels of protection. A stronger algorithm means higher
hardness in decrypting the protected data but requires more resources.
Generally, the longer the key, the stronger the algorithm.
Determine the pre-shared key or the PKI domain the certificate belongs to. For
■
PKI configuration, refer to
Complete the following tasks to configure IKE:
Task
"Configuring a Name for the Local Security Gateway" on page 1904
"Configuring an IKE Proposal" on page 1904
"Configuring an IKE Peer" on page 1905
"Configuring Keepalive Timers" on page 1907

IKE Configuration Task List

"PKI Configuration" on page
1903
1829.
Description
Optional
Optional
Required
Optional