HPE FlexNetwork 5510 HI Series Security Configuration Guide

309
Configuring IKEv2
Overview
Internet Key Exchange version 2 (IKEv2) is an enhanced version of IKEv1. The same as IKEv1,
IKEv2 has a set of self-protection mechanisms and can be used on insecure networks for reliable
identity authentication, key distribution, and IPsec SA negotiation. IKEv2 provides stronger
protection against attacks and higher key exchange ability and needs fewer message exchanges
than IKEv1.
IKEv2 negotiation process
Compared with IKEv1, IKEv2 simplifies the negotiation process and is much more efficient.
IKEv2 defines three types of exchanges: initial exchanges, CREATE_CHILD_SA exchange, and
INFORMATIONAL exchange.
As shown in Figure 92, IKEv2 uses two exchanges during the initial exchange process:
IKE_SA_INIT and IKE_AUTH, each with two messages.
• IKE_SA_INIT exchange—Negotiates IKE SA parameters and exchanges keys.
• IKE_AUTH exchange—Authenticates the identity of the peer and establishes IPsec SAs.
After the four-message initial exchanges, IKEv2 sets up one IKE SA and one pair of IPsec SAs. For
IKEv1 to set up one IKE SA and one pair of IPsec SAs, it must go through two phases that use a
minimum of six messages.
To set up one more pair of IPsec SAs within the IKE SA, IKEv2 goes on to perform an additional
two-message exchange—the CREATE_CHILD_SA exchange. One CREATE_CHILD_SA exchange
creates one pair of IPsec SAs. IKEv2 also uses the CREATE_CHILD_SA exchange to rekey IKE
SAs and Child SAs.
IKEv2 uses the INFORMATIONAL exchange to convey control messages about errors and
notifications.
Figure 92 IKEv2 Initial exchange process
Initiator ' s policy and key
information
Peer
1
Peer 2
Confirmed policy and
key information
Initiator's identity
,
authentication data
, and
IPsec transform sets
Responder's identity,
authentication data, and
IPsec transform sets
Authenticate the identity
Negotiate IPsec SAs
Negotiate algorithms
Generate the key
Perform ID and exchange
authentication and
negotiate IPsec SAs
Search for a
matched policy
and generate
the key
Receive the
policy and
generate the key
Send the local
IKE policy and
key info
Perform ID and exchange
authentication and
negotiate IPsec SAs
ID exchange and
authentication
IPsec SA setup
SA exchange
Key exchange

HPE FlexNetwork 5510 HI Series Specifications

General

Brand	HPE
Model	FlexNetwork 5510 HI Series
Category	Switch
Language	English