IPsec, a Tutorial--Part XI

Configuring ISAKMP
In order to successfully configure two crypto endpoints to establish an ISAKMP SA, the security administrator must instruct the crypto endpoints to accept the appropriate security proposals, apply those security proposals to a crypto map, and apply that crypto map to the appropriate crypto interface or interfaces. The following provides a brief list of tasks to be executed when creating an ISAKMP policy:

1. Define the ISAKMP policy. Within the ISAKMP policy, define security parameters to be used with ISAKMP provided in the following list:
   
• Authentication Method
• Authentication Hash Algorithm
• Encryption Cipher
• Diffie-Hellman MODP Group
2. Instruct the crypto map to reference ISAKMP policies to negotiate ISAKMP SAs and IPsec SAs.
3. Apply the crypto map to the appropriate crypto interfaces. This will enable ISAKMP and IPsec SA negotiation using IKE on those crypto interfaces.

When ISAKMP policies are referenced in crypto maps, the priority keyword identifies the preference that the initiator expresses to the responder when selecting security proposals in IKE Phase I exchange. In Example 17, James requests that ISAKMP policy 20 be selected for IKE Phase I negotiation with Charlie. Charlie will try to accept ISAKMP policy 20, but, because he has no matching security proposal, he will select ISAKMP policy 10. James and Charlie will use ISAKMP policy 20 for IKE Negotiation, as illustrated in Figure 28. Example 17 provides the ISAKMP policy configuration corresponding to the exchange illustrated in Figure 28.

Page 2: next page
Page 1 | 2 | 3