Digi 90000566_H manual Isakmp options, Mode=isakmp, Sharedkey=ascii keyhex key

set vpn

[isakmp options]

To configure an ISAKMP tunnel, you must configure the settings to match those on the remote VPN server.

mode=isakmp

Indicates that the settings are for a VPN ISAKMP tunnel. ISAKMP tunnels specify a list of proposals, or security policies, in order to negotiate a set of security settings from the remote VPN endpoint.

shared_key={ascii keyhex key}

A key that secures the VPN tunnel. The key can be either an ASCII value using alphanumeric characters or a hexadecimal value prefixed by 0x.

To specify security proposals for VPN ISAKAMP tunnels, see "IKE/ISAKMP SA Phase 2 options" on page 239.

IKE/ISAKMP SA Phase 1 and Phase 2 options

Internet Key Exchange (IKE) negotiates the IPSec security associations (SA). This process requires that the IPSec systems first authenticate themselves to each other and establish ISAKMP (IKE) shared keys. The SAs are relationships between two or more entities or peers that describe how the entities or peers will use security services to communicate securely.

IKE negotiations are handled using two different phases.

•Phase 1 is responsible for creating an authenticated and secure channel between the two peers. Typically, phase one is completed using a Diffie-Hellman exchange using cryptography.

•Phase 2 is then responsible for negotiating the final SAs and generating the required keys and key material for IPSec. This is completed by negotiating one or more sets of security policies, or proposals, between the two peers until a given set is agreed upon by both peers.

Default Security Policies

The security policies that are negotiated and used in securing the SAs include the encryption algorithm, authentication algorithm, and the SA lifetime in seconds. By default, the Digi Cellular Family device includes the following set of defaults. If these settings do not match the VPN and IKE SA configuration of the remote peers or if further policies are required, select Use the following policies to negotiate Internet Key Exchange (IKE) security settings and add one or more security policies.

Encryption	Authentication	SA Lifetime
3-DES (192-bit)	SHA1	86400 seconds

Chapter 2 Command Descriptions 237