F3726, F3211, F3174, R5135, R3816-HP Firewalls and UTM Devices VPN Configuration Guide-6PW100

108

167BRelationship between IKE and IPsec

Figure 74 Relationship between IKE and IPsec

724HFigure 74 illustrates the relationship between IKE and IPsec:

• IKE is an application layer protocol using UDP and functions as the signaling protocol of IPsec.

• IKE negotiates SAs for IPsec and delivers negotiated parameters and generated keys to IPsec.

• IPsec uses the SAs set up through IKE negotiation for encryption and authentication of IP packets.

168BProtocols and standards

• RFC 2408, Internet Security Association and Key Management Protocol (ISAKMP)

• RFC 2409, The Internet Key Exchange (IKE)

• R F C 2412, The OAKLEY Key Determination Protocol

37B

Configuring IKE in the Web interface

Before you configure IKE, determine the following parameters:

• The strength of the algorithms for IKE negotiation (the security protection level), including the

identity authentication method, encryption algorithm, authentication algorithm, and DH group.

Different algorithms provide different levels of protection. A stronger algorithm means more resistant

to decryption of protected data but requires more resources. Generally, the longer the key, the

stronger the algorithm.

• The pre-shared key or the PKI domain to which the certificate belongs. For more information about

PKI configuration, see "Managing certificates."

169BRecommended configuration procedure

Ste

Remarks

1. 725HConfiguring global IKE

parameters

Optional.

Configure the IKE local name and NAT keepalive interval.