Cisco Systems CL-28826-01 Overview of IKE and IPsec Configurations

25-2

User Guide for Cisco Security Manager 4.4

OL-28826-01

Chapter 25 Configuring IKE and IPsec Policies

Overview of IKE and IPsec Configurations

Overview of IKE and IPsec Configurations

Internet Key Exchange (IKE) is a key management protocol that is used to authenticate IPsec peers,

negotiate and distribute IPsec encryption keys, and to automatically establish IPsec security associations

(SAs).

The IKE negotiation comprises two phases. Phase 1 negotiates a security association between two IKE

peers, which enables the peers to communicate securely in Phase 2. During Phase 2 negotiation, IKE

establishes SAs for other applications, such as IPsec. Both phases use proposals when they negotiate a

connection.

An IKE proposal is a set of algorithms that two peers use to secure the IKE negotiation between them.

IKE negotiation begins by each peer agreeing on a common (shared) IKE policy. This policy states which

security parameters will be used to protect subsequent IKE negotiations. For IKE version 1 (IKEv1), IKE

proposals contain a single set of algorithms and a modulus group. You can create multiple, prioritized

policies at each peer to ensure that at least one policy matches a remote peer’s policy. Unlike IKEv1, in

an IKEv2 proposal, you can select multiple algorithms and modulus groups from which peers can choose

during the Phase 1 negotiation, potentially making it possible to create a single IKE proposal (although

you might want different proposals to give higher priority to your most desired options). You can define

several IKE proposals per VPN.

You must configure several policies to define the settings required to make successful regular IPsec

connections in a site-to-site or remote access VPN. The following procedure provides an overview of the

steps required to complete the configuration, and points to other topics that provide detailed information

for each step.