41 CONFIGURING IKE
This chapter covers the following topics:
■IKE Protocol Overview
■Configuring IKE
■Displaying and Debugging IKE
■IKE Configuration Example
■Troubleshooting IKE
IKE Protocol Overview The Internet Key Exchange (IKE) protocol , implements hybrid protocols of both
Oakley and SKEME key exchanges in an ISAKMP network. This protocol defines
standards for automatically authenticating IPSec peer end, negotiating security
service and generating shared key, and provide services such as automatic key
exchange negotiation and security association creation, thus simplifying the use
and management of IPSec.
IKE has a set of self-protection mechanism, which enables to securely deliver keys,
authenticate ID and establish IPSec secure association in insecure network.
After establishing security association by both parties of the security association, if
the peer party is invalid and cannot operate normally (such as shut-off), the local
party has no way to know about it. When the peer party restarts the machine,
because there is a security association locally, the negotiation cannot be initiated,
or only initiated by the peer party, or negotiated after timeout. Thus, the keepalive
function of IKE will detect and delete the idle security association when the peer
party was invalid and cannot operate normally.
IKE uses ISAKMP at two stages:
■The first stage is to negotiate to create a communication channel and
authenticate it, as well as to provide confidentiality, message integrity and
message source authentication services for further IKE communication
between both parties.
■The second stage is to use the created IKE SA to create IPSec SA.
The following figure shows the relationship between IKE and IPSec.