Huawei v200r001 user manual Configuration of IKE, II. IKE features

User Manual - Configuration Guide (Volume 3)	Chapter 5
Versatile Routing Platform	Configuration of IKE

Chapter 5 Configuration of IKE

5.1Brief Introduction to IKE Protocol

I.IKE

IKE, an Internet key exchange protocol, implements hybrid protocol of both Oakley and SKEME key exchanges in ISAKMP network. This protocol defines standards for automatically authenticating IPSec peer end, negotiating security service and generating shared key, and provide services such as automatic key exchange negotiation and security association creation, thus simplifying the use and management of IPSec.

IKE has a set of self-protection mechanism, which enables to securely deliver keys, authenticate ID and establish IPSec secure association in insecure network.

IKE uses ISAKMP at two stages:

z The first stage is to negotiate to create a communication channel and authenticate

it, as well as to provide confidentiality, message integrity and message source authentication services for further IKE communication between both parties.

z The second stage is to use the created IKE SA to create IPSec SA. The following figure shows the relationship between IKE and IPSec.

IKE

SA negotiation

IKE

Router

TCP/UDP

IPSec

SASA

IP

Encrypted IP message

Router B

TCP/UD

P

IPSec

Figure SC-5-1Diagram of relationship between IKE and IPSec

II. IKE features

zAvoid specifying manually all IPSec security parameters in password mapping of both communication ends.

zAllow specifying the lifetime of IPSec SA

zAllow exchanging ciphering key during IPSec session

zAllow IPSec to provide anti-replay service

zAllow manageable and scalable IPSec to implement certificate authorization support.

zAllow dynamic end-to-end authentication.

5-1