ccna book free

ccna book free.8.4.3 Task 2 - Configuring IKE8.4.3.1 EKE Parameters for ISAKMPThe second major task in configuring CiscoIOS ISAKMP support is to define parameters in the IKE policy. IKE uses these parameters in negotiation to establish an ISAKMP peer relationship between two IPSec endpoints.Multiple ISAKMP policies can be configured on each participating IPSec peer. When you configure a policy, you must assign a unique priority value to each policy. Use the command crypto isakmp policy priority,where priority is a number that uniquely identifies the IKE policy and assigns a priority to the policy. An integer from 1.10000 can be used, with 1 representing the highest priority and 10000 representing the lowest priority. Assigns the least available value to the most secure policy.The command crypto isakmp policy activates the ISAKMP policy configuration command mode. Set ISAKMP parameters in this mode. If no command is explicitly configured, the default values are used. For example, if the command hash is not explicitly configured, IKE will use the default value SHAo8.4.3.2 Negotiating the ISAKMP PolicyBoth endpoints MUST negotiate the ISAKMP policy before agreeing on the SA to be used for IPSec.When ISAKMP negotiation is started in IKE phase 1 master mode, the peer initiating the negotiation sends all its policies to the remote peer.The remote peer uses its own policies to try to find a match. The remote peer uses its own highest priority policy to compare the policies received from the other peerreceived from another peer to find a match. The remote peer checks all of its own policies in order of priority (higher priority first) until it finds