ccna network

ccna network.Traffic-based Survival Period: defines the maximum amount of traffic an SA is allowed to handle.The SA will expire when the specified time or traffic is reached. Before the SA expires, IKE will create a new SA for IPSec negotiation so that the new SA is ready before the old SA expires. The old SA continues to be used to protect traffic until the new SA is negotiated and ready. As soon as the new SA is negotiated, the new SA is used to protect the traffic.IKE provides the means by which IPSec can securely authenticate identities, distribute keys, and establish IPSec SAs over insecure networks. the protocol is built on the protocols defined by the ISAKMPCInternet SecurityAssociationandKey ManagementProtocol,.358 . Cisco Networking Lab CCNA Lab Guide (2nd Edition)Internet Security Association and Key Management Protocol) defined by the framework. IKE negotiation uses the UDP packet format and the default port is 500. IKE performs key negotiation for IPSec in two phases and establishes SAo. Phase 1: Let the IKE peers authenticate each other and determine the session key, that is, establish an ISAKMPSAo Phase 1 has 2 methods of IKE exchange, MainMode and Aggressive Mode.. Phase 2: Negotiate a specific SA for IPSec,establish the IPSec SA for the final secure transmission of IP data.19.3.5 IPSec Operation StepsThe goal of IPSec is to protect communication data with the necessary security services, and its operation can be divided into the following five steps.Define the stream of interest: apply ACLs to match the stream of interest. There are 3 types of packet processing: applying IPSec, bypassing IPSec to send in plaintext, or discarding. Discard is when data is found to be defined as encrypted in the policy, but it is not actually encrypted, then the packet is discarded.