IKE policies

A IKE policy is a key management policy that

  • defines security parameters and algorithms used to authenticate IPsec peers,

  • negotiates and distributes IPsec encryption keys, and

  • establishes secure communications by negotiating security associations in IPsec VPNs.

  • The Internet Key Exchange (IKE) protocol manages authentication, key negotiation, and automatic establishment of IPsec security associations (SAs).

  • IKE negotiation occurs in two phases:

    • Phase 1 negotiates a security association between two IKE peers, enabling secure communication in Phase 2.

    • Phase 2 establishes SAs for applications, such as IPsec.

  • Both phases use proposals to negotiate connections. An IKE proposal is a set of algorithms that two peers use to secure negotiation.

  • IKE negotiation starts with peers agreeing on a shared IKE policy, which defines the security parameters to protect future negotiations.

  • For IKEv1, proposals include a single set of algorithms and a modulus group; multiple, prioritized policies can be created to match remote peers.

  • For IKEv2, you can select multiple algorithms and modulus groups in one policy.

  • Peers choose proposals during Phase 1 negotiation, enabling creation of a single IKE proposal but consideration of multiple prioritized options.

  • For IKEv2, the policy object does not specify authentication; other policies must define authentication requirements.

  • An IKE policy is required when you configure a site-to-site IPsec VPN. .