UTT Technologies
Chapter 10 VPN
http://www.uttglobal.com
Page
18118118
●
Second exchange (message 3 and 4): A Diffie-Hellman exchange is
performed. Each endpoint exchanges a nonce (i.e., random number).
●
Third exchange (message 5 and 6): Identities of both endpoints are
exchanged and verified.
In the third exchange, identities are not transmitted in clear text. The identities are
protected by the encryption algorithm agreed upon in the first two exchanges.
In the Web UI
，
you can go to the
VPN > IPSec > IPSec Settings
page to click the
Advanced Options
hyperlink to select
Main
from the
Exchange Mode
drop-down list (section 6.1.2.2).
Aggressive Mode
Aggressive mode has two exchanges with a total of three messages between the initiator
and the responder.
●
First message: The initiator proposes the SA, initiates a Diffie-Hellman
exchange, and sends a nonce (i.e., random number) and its IKE identity.
●
Second message: The responder accepts the proposed SA, authenticates
the initiator, and sends a nonce (i.e., random number), its IKE identity, and its
certificates if it is being used.
●
Third message: The initiator authenticates the responder, confirms the
exchange, and sends its certificates if it is being used.
The weakness of using aggressive mode is that it does not provide identity protection
because the identities of both sides are exchanged in clear text. However, aggressive
mode is faster than main mode.
In the Web UI
，
you can go to the
VPN > IPSec > IPSec Settings
page to click the
Advanced Options
hyperlink to select
Aggressive
from the
Exchange Mode
drop-down list (section 6.1.2.2).
Note
If one of the two IPSec endpoints has a dynamic IP address, you must use aggressive
mode to establish an IPSec tunnel.
Diffie-Hellman Exchange
The Diffie-Hellman exchange is a public key cryptography protocol used for key exchange.
With Diffie-Hellman exchange, the two IPSec endpoints publicly exchange key material
over an insecure network channel to derive a shared secret key, which is never
exchanged over the insecure channel.
