ipsec site to site

ipsec site to site

1. ike v1

   • ike phase 1 tunnel
   • ike phase 2 tunnel
     • uses transform set

2. ike v2

   • ike tunnel
   • child tunnel or esp tunnel
     • Dead peer detection and NAT-T integrated into the protocol also has less overhead
       • also more resilient to DOS attack
         • pre-share keys can be different on each end
     • uses ipsec propsal (same as transform set really)

3. ipsec wizard

   • configure address of peer
     • select ike v1 or ike v2, both ends have to be the same
       • set up the crypto ACL
         • Set up authentication methods, either certificate (RSA) or pre-share key
           • Set up IKE policy(isakmp) and ipsec proposal (transform set)
             • the next screen asks about bypassing access lists, bypassing NAT translation and enabling perfect forward secrecy

4. ISAKMP phase 1

   • negotiates and builds the tunnel that will enable the negotiation and creation of the ipsec tunnel
   • Peer that initiates sends all its isakmp policies to the remote peer. The remote peer compares policies in priority order until it finds a match
     • note remote peer lifetime can be less than or equal to the lifetime of the initiator policy
       • 1 day by default
     • Hagle, Hashing, authentication, group, lifetime, encryption
     • Diffie Hellman Key exchange takes place
       • Authentication of the peers takes place
         • phase 1 tunnel is built
   • main mode or aggressive mode
     • aggressive mode is faster but less secure, only 2 exhchanges totalling 3 messages. Does not protect identities
     • main mode is more secure, 3 exchanges totalling 6 messages. provides identity protection
   • uses port 500 or 4500 with NAT-T

5. isakmp phase 2

   • quick mode
   • uses the phase 1 tunnel to create an ipsec tunnel
     • ipsec tunnel uses port 50 and 51, 50 for esp, ah not really used.
     • transform sets are exchanged and compared, each crypto map can have up to 6 transform sets to compare
       • ipsec tunnel is created