Patton electronics IPLink Series, Руководство по настройке программного обеспечения, Страница: 295 / 331

Key Management (IKE) 295
IPLink Software Configuration Guide 26 • VPN configuration
IN MANUAL ToBerne Tunnel no
200.200.200.1 - 1111 - - AES-CBC 128
3622/unlimited 19047/unlimited
OUT MANUAL ToBerne Tunnel no
200.200.200.1 - 2222 - - AES-CBC 128
2857/unlimited 19047/unlimited
Key Management (IKE)
As briefly described in the Introduction, key management is done either by pre-shared keys or automatically
keyed IPSEC connections usgin the Internet Key Exchange (IKE / RFC 2409). IKE is based on Internet Secu-
rity Association and Key Management Protocol (ISAKMP / RFC 2408). The IKE module supports authenti-
cation using pre-shared keys. There is currently no support for authentication using Public Key Infrastructure
(PKI) and digital certificates.
IKE is used to establish a shared secret between two peers, which can be used to derive encryption and/or
authentication keys for the exchange of encrypted and or authenticated packets between the peers through an
IPSEC connection. IKE also authenticates the two peers to thwart man in the middle attacks. In addition IKE
empowers IPSEC to do replay protection to prevent re-injection of previously captured packets into the pro-
tected network. Furthermore IKE negotiates a set of cryptographic transforms used by IPSEC for encryption
and/or authentication of IP packets. IKE is also responsible for periodic establishment of new session keys for
the ISPEC security associations.
To achieve all of this, IKE is split into two phases called MAIN MODE and QUICK MODE.
In MAIN MODE, IKE mutually authenticates the peers, establishes a shared secret between them and negoti-
ates cryptographic transforms in order to create an ISAKMP security association between the two peers. The
ISAKMP security association is only used to provide a secure, authenticated and encrypted channel between
the peers, which can be used for any further communication.
In QUICK MODE, IKE negotiates all the security parameters like cryptographic transforms, SPIs and sessions
keys. They are required for establishing one or more IPSEC security association. All QUICK MODE commu-
nication is protected by a previously established ISAKMP security association.
Note The same ISAKMP security association can be used to establish multiple
quick modes.
Main differences between manual & IKE IPSEC configurations
•
For IKE connections the ACLs must allow traffic from and to UDP port 500 in plaintext, because this
port is used by IKE to negotiate security associations.
•
The ¨profile ipsec-transform¨ defines the cryptographic transforms used for the IPSEC connections, but
it is necessary also to define also a ¨profile isakmp-transform¨, that defines the cryptographic trans-
forms used to protect the negotiation of new IPSEC security associations using ISAKMP
.
•
Instead of the ¨profile ipsec-policy-manual¨, which is used to create manual keyed IPSEC connections,
you need to create a ¨profile ipsec-policy-isakmp¨, which contains all the IKE specific configuration
options.