NEC ZA-SA3500G, Руководство по эксплуатации функций

Страница: 105 / 359

| Function Specification 105
■ IKEv2
[IKEv2 overview]
IKEv2 features will be outlined for those using IKEv1. IKEv2 is not compatible with IKEv1 and the terms used are
different.

ISAKMP-SA, IPsec-SA equivalent functions are KE-SA and Child-SA respectively.

Hash algorithm is equivalent to authentication algorithm and a pseudo-random number algorithm.

The concept of main mode and aggressive mode is removed and operation is shared.

Phase1-ID, Phase2-ID are also shared, and only a pair of local-ID and remote-ID are obtained.
[Key Management Method]
IKEv2 requires a pre-shared key for the device and a pre-shared key setting for the remote device.
*In the case of IKEV1, use a common pre-shared key on local device and the remote device.
[IKEv2 Sequence]
● IKE_SA_INIT exchange ： IKE_SA negotiation and private key sharing
● IKE_AUTH exchange ： Peer authentication CHILD_SA negotiation
[Connection method]
To create an IPsec tunnel, continuous and on-demand connection can be selected.
By associating with
“ Rekey ” setting, the following three setting patterns can be set from Web setting:
IKE_SA_INIT Exchange (request)
User Traffic
Protected with
IKE_SA
Protect with
CHILD_SA
IKE_SA_INIT Exchange
(response)
IKE_AUTH Exchange
(request)
IKE_AUTH Exchange
(response)
Initiator Responder