Huawei v200r001 user manual IKE Configuration Task List, Creating IKE Security Policy

User Manual - Configuration Guide (Volume 3)	Chapter 5
Versatile Routing Platform	Configuration of IKE
5.2 Configuring IKE

5.2.1 IKE Configuration Task List

IKE configuration task list is as follows:

zCreate IKE security policy

zSelect encryption algorithm

zSelect authentication algorithm

zConfigure pre-shared key

zSelect hashing algorithm

zSelect DH group ID

zSet IKE negotiation SA lifetime

5.2.2Creating IKE Security Policy

I.Why these policies should be created?

IKE negotiation must be protected, so each IKE negotiation begins when each terminal comes to the public (shared) IKE policy, which describes which security parameter to use to protect subsequent IKE negotiation.

When two terminals come to a policy, the security parameters of this policy are identified by SA established by each terminal, and these SAs apply to all subsequent IKE communication during negotiation. Multiple policies with priority must be created on each terminal so as to ensure that at least one policy can match that of the remote terminal.

II. Parameters to be defined in policy

zEncryption algorithm: at present, it includes only 56-bit DES-CBC (DES-Cipher Block Chaining)

zHashing algorithm: SHA-1(HMAC anamorphosis) or MD5 (HMAC anamorphosis) algorithm

zAuthentication method: RSA signature or RSA real-time encryption

zDiffie-Hellman group ID

zSA lifetime

III. How to form matched policy

When IKE negotiation begins, IKE looks for a kind of IKE policy, which is consistent at both terminals. The terminal that originates negotiation sends all its policies to the remote terminal, and the latter will try to find a matched policy by comparing its policies with highest priorities with those received from the former. When the policies from the two terminals include the same encryption, hashing, authentication and Diffie-Hellman parameters and when the specified lifetime of the policy from the remote terminal is shorter than or equal to the compared policy lifetime, the matching selection is made (if no lifetime is specified, the shorter one of the remote terminal policy will be used). If no acceptable matched policy is found, IKE refuses to negotiate and will not establish IPSec. If a matched policy is found, IKE will complete negotiation then create IPSec security tunnel.

IV. Create IKE policy

The following should be clear before IKE configuration:

5-2