1- IPsec protocol

The main purpose of Phase 1 is to set up a secure encrypted channel through which the two peers can negotiate Phase 2.

• Main Mode:  ( site-2-site )

1. Propose : Asymmetrical Encryption and Authentication Algorithms
2. Initiator and responder: Diffie-Hellman key exchange process  (send Public key + Random number )

            DH use group 1,2,5,12,19,20,24 for longer/stronger/ number of bit

            Pre-shared key

            Private Keys ( exchange using PKI ) 

  3. Use the encrypted communication channel

  4. Send IKE identification to authenticate itself

• Aggressive Mode:  

1. Initiator Propose : Encryption and Authentication Algorithms  + IKE identity to authenticate itself
2. Responder Propose
3. Secure channel for negotiating the IPsec VPN phase 2

The purpose of Phase 2 negotiations is for the two peers to agree on a set of parameters that define what traffic can go through the VPN, and how to encrypt and authenticate the traffic

Generate Symmetrical Encryption Key 

        ESP Encryption Algorithm  ( 3DES/AES )

        AH  Authentication Algorithm ( MD5/SHA1/SHA2)

        VPN protocol :  ESP(+AH) or AH

        Mode the VPN use:  Tunnel or Transport Mode

PKI or  Public Key Infrastructure

Large Network

Stronger Auth Security

File ( or Transaction)  → hashed

MD5 , SHA1, SHA2

At the source:

                file / text / ....  → hashing Algo  → hashed value / string

On the other side:

            password ( or text ) → same hashing Algo → produce the same hashed value/ string

            compare the two hash

Hash lose information, and can not restore the original information

IP Address

Hostname

User FQDN

Distinguished name

IKE-ID

Policy-Based VPN

       Policy: from 

Route-Based VPN

Modem/FW using source-NAT → will modify source IP@ and Source TCP/UDP port ( upstream traffic )

Consequence the Hash is invalid!

→ Solution:

Encapsulate and de-capsulate the traffic into UDP/4500  ( instead of IKE negotiation UDP/500 )