UTT Technologies
Chapter 10 VPN
http://www.uttglobal.com
Page
13913913
2. AutoKey (IKE)
To improve security and lessen the burden on administrators, IPSec supports Internet Key
Exchange (IKE) protocol. Using IKE protocol, the two IPSec endpoints can automatically
generate and negotiate keys and security associations. This automatic key management
method is called
AutoKey (IKE)
on the UTT VPN gateway.
At present the UTT VPN gateway supports AutoKey (IKE) based on preshared keys. The
preshared key is used as a seed key to generate IPSec session keys. Both IPSec
endpoints should have the same preshared key. With
AutoKey (IKE)
management, the
key distribution is the same as that with manual key management. However, once
distributed, the two endpoints (unlike manual key) will automatically change their session
keys at the specified time interval using IKE protocol. This is done without human
intervention; therefore, using
AutoKey (IKE)
method can also reduce management cost
and burden.
Often changing keys enhance security. However, changing keys increases traffic
overhead; therefore, to avoid reducing data transmission efficiency, it is suggested that
you do not choose to change keys too often.
9.5.1.4 Creating Security Associations (SAs)
The concept of a Security Association (SA) is fundamental to IPSec. An SA is a
relationship between two IPSec endpoints that describes how the endpoints will use
security services to communicate. Each SA consists of a set of security parameters like
security protocol (ESP or AH), encryption and/or authentication algorithms, session keys,
SA lifetime, and so on. Because an IPSec SA is simplex (unidirectional) in nature, a
bidirectional communication requires at least two SAs, one in each direction.
In
Manual Key
mode, negotiations are not required because all the necessary SA
parameters are defined during the configuration of the IPSec tunnel. In this case, if the
UTT VPN gateway receives a packet matching an IPSec security policy, it will encrypt and
authenticate the packet, and then send it to the remote endpoint through the IPSec tunnel.
In
AutoKey (IKE)
mode, the basic operation of IKE can be broken down into two phases:
●
IKE Phase 1 is used to authenticate the two endpoints and negotiate the parameters
and key material required to establish a secure channel (i.e., IKE SA). The IKE SA is
then used to protect further IKE exchanges.
●
IKE Phase 2 is used to negotiate the parameters and key material required to
establish IPSec SAs. The IPSec SAs are then used to authenticate and encrypt the
user data.
1. IKE Phase 1
During IKE phase 1, one or more security proposals are exchanged and agreed upon
