ZyXEL Communications VSG1435-B101 - V1.10, Руководство пользователя

Страница: 263 / 412

Chapter 21 IPSec
VSG1435-B101 Series User’s Guide
263
21.4.3 IKE Phases
There are two phases to every IKE (Internet Key Exchange) negotiation – phase 1
(Authentication) and phase 2 (Key Exchange). A phase 1 exchange establishes an
IKE SA and the second one uses that SA to negotiate SAs for IPSec.
Figure 123 Two Phases to Set Up the IPSec SA
In phase 1 you must:
• Choose a negotiation mode.
• Authenticate the connection by entering a pre-shared key.
• Choose an encryption algorithm.
• Choose an authentication algorithm.
• Choose a Diffie-Hellman public-key cryptography key group (
DH1 or DH2 ) .
• Set the IKE SA lifetime. This field allows you to determine how long an IKE SA
should stay up before it times out. An IKE SA times out when the IKE SA lifetime
period expires. If an IKE SA times out when an IPSec SA is already established,
the IPSec SA stays connected.
In phase 2 you must:
• Choose an encryption algorithm.
• Choose an authentication algorithm
• Choose a Diffie-Hellman public-key cryptography key group
.
• Set the IPSec SA lifetime. This field allows you to determine how long the IPSec
SA should stay up before it times out. The ZyXEL Device automatically
renegotiates the IPSec SA if there is traffic when the IPSec SA lifetime period
expires. If an IPSec SA times out, then the IPSec router must renegotiate the
SA the next time someone attempts to send traffic.