IPsec, a Tutorial--Part VII

Manual Keying
The above example relies on IKE/SAKMP to establish a secure channel over which to exchange security parameters when building IPsec SAs. One of the parameters exchanged over IKE is the shared secret key that will be used in IPsec transforms. In instances in which IKE is unavailable, manual keying can be used. Such instances would include the creation of an IPsec tunnel to another vendor endpoint that does not support IKE but does support IPsec.

NOTE:
All Cisco IOS and Cisco VPN appliances support IKE and ISAKMP protocols.

Using manual keys does not scale very well in large networks due to the exponential increase in administrative overhead with the addition of each IPsec tunnel. Likewise, in manual keying, keys must be refreshed manually, unlike dynamically derived Diffie-Hellman keys using PFS.

NOTE:
PFS is a means by which to improve the freshness of IPsec shared secret keys generated using Diffie-Hellman. PFS is discussed in greater detail later in this chapter.

Most important, many hardware-based VPN accelerators do not support the use of manual keying. Therefore, network administrators should carefully balance the need for IPsec performance against costs of upgrading tunnel endpoints and modifying configurations to support IKE. Example 4 and 5 illustrate configuration objectives required to create manual keys between James and Charlie.

Once James applies the crypto map to his interface, the SA is established. In this configuration, he does not need to exchange information via IKE, as the session-keys are manually established. Example 5 shows the IPsec SA establishment debugging output from James' application of his IPsec policy attachment to his outbound interface.

Page 2: next page
Page 1 | 2 | 3