Main Mode
Main mode has three two-way exchanges
between the peers to create the secure connection and develop the common SAs,
while protecting the identities of the IPSec peers.
-
First exchange The security algorithms and hash methods to
be used to secure the IKE exchanges are agreed on to create the common IKE SA
for each peer.
-
Second exchange A DH exchange is performed to generate
shared secret keying material to be used by each peer to generate shared secret
keys. Nonces, pseudorandom numbers, are sent to the other
peer, signed, and returned to prove their identity.
-
Third exchange The peer’s identity is verified using the
peer’s IP address or fully qualified domain name (FQDN), such as www.ciscoarticles.com , in encrypted
form.
The resulting IKE SA in each peer is bidirectional and
specifies IKE exchange choices for the authentication method, encryption and
hash algorithms, DH group, the lifetime of the IKE SA in seconds or kilobytes,
and the shared secret key values for the encryption algorithms.
Sections
Comments (0 posted)
Syndication
