3Com 10014299 manual Configuring IKE

41 CONFIGURING IKE

This chapter covers the following topics:

■IKE Protocol Overview

■Configuring IKE

■Displaying and Debugging IKE

■IKE Configuration Example

■Troubleshooting IKE

IKE Protocol Overview The Internet Key Exchange (IKE) protocol , implements hybrid protocols of both Oakley and SKEME key exchanges in an ISAKMP network. This protocol defines standards for automatically authenticating IPSec peer end, negotiating security service and generating shared key, and provide services such as automatic key exchange negotiation and security association creation, thus simplifying the use and management of IPSec.

IKE has a set of self-protection mechanism, which enables to securely deliver keys, authenticate ID and establish IPSec secure association in insecure network.

After establishing security association by both parties of the security association, if the peer party is invalid and cannot operate normally (such as shut-off), the local party has no way to know about it. When the peer party restarts the machine, because there is a security association locally, the negotiation cannot be initiated, or only initiated by the peer party, or negotiated after timeout. Thus, the keepalive function of IKE will detect and delete the idle security association when the peer party was invalid and cannot operate normally.

IKE uses ISAKMP at two stages:

■The first stage is to negotiate to create a communication channel and authenticate it, as well as to provide confidentiality, message integrity and message source authentication services for further IKE communication between both parties.

■The second stage is to use the created IKE SA to create IPSec SA.

The following figure shows the relationship between IKE and IPSec.