Phase 1 Exchange (IPsec and IKE Administration Guide) (2024)

FAQs

What are the authentication methods for IKE Phase 1? ›

During IKE Phase I: The peers authenticate, either by certificates or via a pre-shared secret. (More authentication methods are available when one of the peers is a remote access client.) A Diffie-Hellman key is created.

IKE Phases

Phase 1: The two ISAKMP peers establish a secure and authenticated tunnel, which protects ISAKMP negotiation messages. This tunnel is known as the ISAKMP SA. There are two modes defined by ISAKMP: Main Mode (MM) and Aggressive Mode.

Internet Key Exchange (IKE) protocol— IPsec supports automated generation and negotiation of keys and security associations using the IKE protocol. Using IKE to negotiate VPNs between two endpoints provides more security than the manual key exchange.

The IKE phase 1 tunnel is only used for management traffic. We use this tunnel as a secure method to establish the second tunnel called the IKE phase 2 tunnel or IPsec tunnel and for management traffic like keepalives. IKE builds the tunnels for us but it doesn't authenticate or encrypt user data.

The IKE protocol uses User Datagram Protocol (UDP) packets to create an SA, generally needing four to six packets with two to three messages. An IPsec stack intercepts relevant IP packets, encrypting and decrypting them as needed.

IKE Phase supports the use of pre-shared keys or digital certificates (which use public key infrastructure, PKI) for mutual authentication of the VPN peers. Pre-shared keys are a simple solution for securing smaller networks because they don't require the support of a PKI infrastructure.

If you're looking for popular VPN protocols that are easy to configure and work well with NAT, OpenVPN may be the better choice. If you're looking for a highly scalable protocol that can establish point-to-point and site-to-site connections, IPsec may be the better choice.

IPsec usually uses port 500.

IPSec handshake

The IPSec tunnel employs a two-phase handshake. The handshake interval is determined by the tunnel's lifetime values. Phase I (Also known as IKE or Gateway): This Security Association is in charge of the external IP communication between the Harmony SASE network and the remote IP using port 500/4500.

What are the two main IPSec protocols? ›

IPsec originally defined two protocols for securing IP packets: Authentication Header (AH) and Encapsulating Security Payload (ESP). The former provides data integrity and anti-replay services, and the latter encrypts and authenticates data.

IKEv2/IPSec is lightweight and adequately secure. It's also agile, since it's one of the few protocols that can re-establish a VPN connection when you switch networks (e.g. from mobile data to Wi-Fi).

The main mode protects the identity of the peers and is more secure because more packets are exchanged when setting up the tunnel. Main mode is the recommended mode for IKE negotiation if both peers support it.

The establishment of an IPsec connection takes place in two phases, called IKE phases: In IKE Phase 1, the two endpoints authenticate one another and negotiate keying material. This results in an encrypted tunnel used by Phase 2 for negotiating the ESP security associations.

Phase 1 Security Associations are used to protect IKE messages that are exchanged between two IKE peers, or security endpoints. Phase 2 Security Associations are used to protect IP traffic, as specified by the security policy for a specific type of traffic, between two data endpoints.

Type 1 – Something You Know – includes passwords, PINs, combinations, code words, or secret handshakes. Anything that you can remember and then type, say, do, perform, or otherwise recall when needed falls into this category.

Internet Key Exchange (IKE) is the protocol used to set up a secure, authenticated communications channel between two parties.

IPSec VPN supports two main modes of authentication: pre-shared key (PSK) and public key infrastructure (PKI). PSK is a simple and common method that uses a secret password or passphrase that both devices share and use to generate encryption keys.