IPsec

Question 1

IKE - Internet Key Exchange

Answer 1

IKE helps IPsec securely exchange cryptographic keys between distant devices.

Key Management can be preconfigured with Internet Security Association and Key Management Protocol(ISAKMP) or with a manual key configuration.

IKE and ISAKMP are often used interchangeably.

Question 2

What does IKE - Internet Key Exchange protect

Answer 2

The IKE tunnel protects the SA negotiations.
After the SAs are in place, IPsec protects the data that the devices exchange.

Question 3

Phase 1 of IKE - Internet Key Exchange

Answer 3

Authenticates and protects the identities of the IPSec peers

Negotiates a matching IKE SA policy between peers to protect the IKE exchange

Performs an authenticated Diffie-Hellman exchange with the end result of having matching shared secret keys

Sets up a secure tunnel to negotiate IKE phase 2 parameters

Question 4

Where does Internet Key Exchange occur in

Answer 4

Main Mode & Aggressive mode.

The difference between the two is that Main mode requires the exchange of 6 messages while Aggressive mode requires only 3 exchanges.

Question 5

Phase 2 of IKE - Internet Key Exchange

Answer 5

Negotiates IPSec SA parameters protected by an existing IKE SA

Establishes IPSec security associations

Periodically renegotiates IPSec SAs to ensure security

Optionally performs an additional Diffie-Hellman exchange

Question 6

Security Associations (SAs)

Answer 6

SAs is a relationship between the sender and a receiver that describes how the peers will use IPsec security services to protect network traffic.

Question 7

What does Security Associations contain

Answer 7

All the security parameters needed to securely transport packets between the peers or hosts.

Question 8

Parameters of Security Associations

Answer 8

Security Parameter Index (SPI) - is a number to identify the SA

IP Destination Address- the address of the destination device

Security Protocol: AH or ESP

Question 9

Ipsec Transmission

Answer 9

if u care go tested and skipping

Question 10

Verify IPsec statements

Answer 10

ref image

Question 11

View Policy statement

Answer 11

RouterA# show crypto isakmp policy

Question 12

View Crypto IPsec SA statement

Answer 12

RouterA# show crypto ipsec sa

Question 13

View Configured Crypto Maps statement

Answer 13

RouterA# show crypto map