IKE operation
IKE negotiates keys and establishes SAs for IPsec in two phases:
Phase 1—The two peers establish an ISAKMP SA, a secure, authenticated channel for communication.
Phase 2—Using the ISAKMP SA established in phase 1, the two peers negotiate to establish IPsec SAs.
Figure 87: IKE exchange process in main mode
As shown in Figure 87, the main mode of IKE negotiation in phase 1 involves three pairs of messages:
SA exchange, used for negotiating the security policy.
Key exchange, used for exchanging the Diffie-Hellman public value and other values like the random number. Key data is generated in this stage.
ID and authentication data exchange, used for identity authentication and authentication of data exchanged in phase 1.