Peer Authentication

Peer Authentication

Would-be IPSec peers must authenticate themselves to each other before IKE can proceed. IKE Phase One has three methods to authenticate IPSec peers in Cisco products. The two peers must negotiate a common authentication protocol from the following choices:

• Preshared keys—A key value entered into each peer manually (out of band) and used to authenticate the peer.

• RSA signatures—Uses a digital certificate authenticated by an RSA signature.

• RSA encrypted nonces—Uses RSA encryption to encrypt a nonce value (a random number generated by the peer) and other values.

A common value used by all authentication methods to help identify the peer is the peer identity (ID). Some ID values include the peer’s IP address or their FQDN, such as ian.testco.com.