724-746-5500 | blackbox.com
Page 99
Chapter 8: Virtual Private Networks
Extensible Authentication Protocol
The Extensible Authentication Protocol (EAP) defines message formats used in IKEv2. EAP for IKEv2 is described in IETF RFC 5106.
NOTE: EAP is a format protocol; it is not a transmission protocol. IKEv2 defines the way that it transmits the EAP format.
EAP Authentication
IKEv2 uses EAP in providing authentication and establishing keys. EAP supports authentication for the following:
• Password: A simple character string, shared by both sides of the connection. Passwords are usually generated by humans, some-
times via algorithms, sometimes not.
• Symmetric key: A complex character string, shared by both sides of the connection. Symmetric keys are usually generated by
computer-driven algorithms.
• Asymmetric key pair: A complex set of keys. The public key is available to anyone; the private key is known only to the key
owner (generally the recipient in any single exchange). An asymmetric key pair is generated by the key owner, using a
hash-encryption technique.
EAP Exchanges
An exchange pair may use a different authentication mechanism in each direction. Table 5-10 lists the expected combinations for
IKEv2 EAP key exchanges.
Table 8-10. Standard EAP Combinations for IKEv2 Authentication.
IKEv2 Initiator Sends:
IKEv2 Responder Sends:
one part of asymmetric key pair counterpart in asymmetric key pair, or password, or symmetric key
symmetric key
symmetric key
MOBIKE
The WRT4000 Series Cellular Wireless Router includes support for the IKEv2 Mobility and Multihoming Protocol (MOBIKE,
described in IETF RFC 4555). MOBIKE permits IP addresses to change dynamically—for example, as a mobile client moves during
an IKEv2 VPN connection.
When one side of the VPN connection moves, the endpoints use INFORMATIONAL exchange pairs to indicate a change in that
side’s IP address, without interrupting the connection. MOBIKE supports this by updating the information for the tunnel headers,
and leaves the information inside the tunnel unchanged.
The parties in the connection usually do not experience any interruption in service—and, if there is an interruption, the connec-
tion is re-established quickly; the call is not dropped.
CAUTION: MOBIKE does not currently support simultaneous movement of both parties in the connection. It is advised that only
one party in the VPN connection be mobile, and that the other party remain in a fixed location (such as an office).
The WRT4000 Series Cellular Wireless Router does not travel, so MOBIKE is used only for the remote device in the connection.
Sample IKEv2 Exchanges
This section provides examples of basic exchanges in IKEv2.
NOTE: Each request requires a response; so exchanges are always in pairs.
See the following:
• Overview of IKEv2 Exchanges
• Detail of IKEv2 Exchanges
