Internet Key Exchange (IKE)

Internet Key Exchange (IKE) is a key management protocol that

  • authenticates IPsec peers

  • negotiates and distributes IPsec encryption keys, and

  • automatically establishes IPsec security associations (SAs).

IKE negotiation phases and policies

The IKE negotiation comprises two phases:

  • Phase 1 negotiates a security association between two IKE peers, which enables the peers to communicate securely in Phase 2.

  • During Phase 2 negotiation, IKE establishes SAs for other applications, such as IPsec.

Each phase uses proposals to negotiate a connection.

An IKE policy is a set of algorithms that two peers use to secure the IKE negotiation between them. IKE negotiation begins when each peer agrees on a common IKE policy. This policy defines security parameters to protect subsequent IKE negotiations. IKEv1 policies contain a single set of algorithms and a modulus group. In an IKEv2 policy, you can select multiple algorithms and modulus groups for peers to choose from during the Phase 1 negotiation. You may create a single IKE policy, or create multiple policies to give higher priority to preferred options. For site-to-site VPNs, you can create an IKE policy. IKEv1 and IKEv2 each support a maximum of 20 IKE policies, each with a different set of values. Assign a unique priority to each policy that you create. A lower priority number indocates a higher priority for the policy.

To define an IKE policy, specify:

  • A unique priority (1 to 65,543, with 1 being the highest priority).

  • An encryption method for the IKE negotiation to protect the data and ensure privacy.

  • A Hashed Message Authentication Codes (HMAC) method (called integrity algorithm in IKEv2) to verify the sender's identity, and to confirm that the message is unchanged during transit.

  • For IKEv2, a separate pseudorandom function (PRF) used as the algorithm to derive keying material and hashing operations required for the IKEv2 tunnel encryption. The options are the same as those used for the hash algorithm.

  • A Diffie-Hellman group to determine the strength of the encryption key determination algorithm. The device uses this algorithm to derive the encryption and hash keys.

  • An authentication method, to ensure the identity of the peers.

  • A limit to the time the device uses an encryption key before replacing it.

When IKE negotiation begins, the initiating peer sends all its policies to the remote peer. The remote peer searches for a match with its own policies, in priority order. IKE policies match if both peers use the same encryption, hash (integrity and PRF for IKEv2), authentication, and Diffie-Hellman values. The SA lifetime must be less than or equal to the lifetime in the policy sent. If the lifetimes are not identical, the shorter value from the remote peer policy applies. By default, the Cloud-Delivered Firewall Management Center deploys an IKEv1 policy with the lowest priority for all VPN endpoints to ensure a successful negotiation.