ccna book exam

ccna book exam.The first exchangeThe first exchange between the initiator and the responder establishes the basic security policy. The peers negotiate to determine the security used to secure the IKE communicationthe algorithms and hashes. In contrast to negotiating each protocol separately, these protocols are divided into groups called IKE policy sets (IKEpolicyset).IKEpolicy sets are exchanged first.The initiator first sends a proposal for the encryption and authentication scheme to be used. The responder looks for a matching ISAKMP policy. The responder selects a proposal that is most applicable to the security situation in which it finds itself and sends this proposal to the initiator. If a matching policy is found between the peers, IKE phase 1 continues. If none is found, the tunnel is removed.8.3 IPSec VPN Components and Operations 233The policy set number is only locally meaningful at the VPN device. The policy set numbers do not have to match between two VPN peers. In a point-to-point application, only one IKE policy set may need to be defined per endpoint. In a star (hub.and.spoke) environment, the central site may require multiple IKE policy sets to satisfy all remote peers.Second ExchangeThe second exchange creates and exchanges DH public keys between two endpoints. DH allows two parties that do not know each other in advance to establish a shared key over an insecure communication channel.The two peers run the DH key exchange protocol to obtain the keyingmaterial needed for the various encryption and hashing algorithms that IKE and IPSec eventually agree upon. Using the DH algorithm, each peer can generate a shared secret without actually exchanging secrets. o All subsequent negotiations use the DH-generated secret key for encryption.