ccna book download

ccna book download.8.3.3 Internet Key Exchange8.3.3.1 Security FederationAn IPSecVPN solution negotiates key exchange parameters, establishes a shared key, authenticates peers, and negotiates encryption parameters. The parameters negotiated between the two devices are referred to as a SecurityAssociation (SA).Security AssociationsSAs are a fundamental component of IPSec. SAs are maintained in the SA Database (SADB), which is created by each device. VPNs use SA entries to define IPSec encryption parameters as well as key exchange parameters.All cryptosystems, including Caesar ciphers, Virginia ciphers, Enigma machines, and up to contemporary encryption algorithms, are232 Chapter 8 Implementing a Virtual Private Networkmust address key management issues. Diffie-Hellman (DH) is used to create shared keys. However, IPSec uses the Internet KeyExchange (IKE) protocol to establish the key exchange process. Instead of transmitting keys directly over the network, IKE calculates the shared key based on the exchange of a series of data packets. This makes it impossible for a third party to decrypt the key even if it captures all of the exchanged data used to calculate the key. IKE sits on the UDP layer and uses UDP port 500 to exchange IKE information between security gateways. Packets on UDP port 500 must be allowed on all IP interfaces involved in connecting to a secure gateway peer.IKE is defined in RFC 2409. It is a hybrid protocol that combines the Internet Security Association and Key Management Protocol (ISAKMP) and the Oakley and Skeme key exchange methods. ISAKMP defines the message format, the mechanism of the key exchange protocol, and the negotiation process to establish an SAO for IPSecISAKMP does not define how keys are managed or shared between two IPSec peers. Oakley and Skeme define five key groups. Of these groups, Cisco routers support Group I (768-bit keys), Group 2 (1024-bit keys), and Group 5 (1536-bit keys).IKE combines these protocols to establish secure IPSec connections between devices, and it establishes SAs that are appropriate for each peero each peer