Ipsec Basic Concepts - H3C SecPath F1800-A Operation Manual

Operation Manual - VPN
H3C SecPath F1800-A Firewall
IV. IKE Negotiation Modes
As defined in RFC2409 (the Internet Key Exchange), IKE negotiation in the first stage
can use two modes, that is, main mode and aggressive mode.
In main mode, key exchange information is separated from ID and authentication
information. In this way, the exchanged ID information is protected by the
generated DH shared key. However, it takes three extra messages to complete
the process.
In aggressive mode, payloads relevant with SA, key exchange and
authentication are allowed to be transmitted in a message, which reduces the
message round-trip times but cannot provide ID protection.
Although there is limit to functions in aggressive mode, it can meet the demand in
some specific network environment. For example in remote access, the responder
(server end) has no way to learn about the address of the initiator (terminal user) in
advanced or the address of the initiator is always changing, but both parties wish to
create IKE SA through authentication via pre-shared keys.
In this case, the aggressive mode without ID protection is the unique available
exchange method. In addition, if the initiator has learnt about the responder's policy or
had a comprehensive understanding of it, aggressive mode can be adopted to create
IKE SA faster.

3.1.3 IPSec Basic Concepts

I. Security Association
IPSec provides secure communication between two ends. These two ends are called
IPSec peers.
IPSec allows systems, network subscribers or administrators to control granularity of
security services between peers. For instance, IPSec policies of a group define that
data stream from a subnet should be protected over AH and ESP and be encrypted
over Triple Data Encryption Standard (3DES) at the same time. Moreover, the policies
define that data stream from another site should be protected over ESP only and be
encrypted via DES only. IPSec can provide security protection in various levels for
different data streams based on SA.
SA is the basis and essence of IPSec. It is the standard for some elements of
communication peers.
For example, it determines:
Applied protocols (AH, ESP or both).
The working mode (transport mode or tunnel mode).
Cipher algorithm (DES and 3DES).
Shared key to protect data in stream and its life duration.
7-37
Chapter 3 IPSec Configuration