61
Internet Key Exchange (IKE)
The IKE feature is designed to automatically negotiate IPsec security associations (SAs) and
enables IPsec secure communications without costly manual preconfiguration. IKE provides
also authentication of the IPsec peers and generate keys to be used by IPsec. Phase 1 is to
establish a secure and authenticated tunnel with which to communicate further IKE
negotiations. Phase 2 is to establish security associations (SA) on behalf of other protocols
like IPSec which require key and parameter negotiation.
In order for IPSec to be negotiated dynamically across an IKE connection the IPSec policy
item must be linked to IKE protection suite. An IKE protection suite defines the IPSec SA
parameters which are negotiated
To initially configure the IKE parameters for Phase 1 negotiation, you need to configure the
router as follows. NOTE: Phase 1 can support up to 3 proposals negotiated during IKE
negotiation with proposal 1 considered the first to negotiate:
ª
Configuration
ª
Packet Services Set-up
ª
IP Security Set-up
ª
IKE peer setup
ª
Peer alias
ª
Peer name
ª
Peer IP Address
ª
xxx.xxx.xxx.xxx
ª
Peer Pre Shared Key *
ª
Peer Pubic Key *
ª
IKE Phase 1 Negotiation
ª
Authentication Method
ª
Integrity
ª
Encryption
ª
DH Group
ª
Lifetime
ª
Proposal
*Note - Either Pre-Shared Key or Public Key can be used for implementation but not both.
To configure the router for IPSec to be negotiated through IKE you must defined the IKE
protection suite to be establish during Phase 2:
ª
Configuration
ª
Packet Services Set-up
ª
IP Security Set-up
ª
Protection Set-up
ª
Edit Protection Suite
ª
Suite Alias
ª
Protection Suite name
ª
SA mode
ª
IPSEC SA mode
ª
Lifetime for SA (seconds) OR
ª
Lifetime for SA (data)
ª
Lifetime value
