Examkin

Question

Difficulty: EasyVirtual Private Networks and Remote Access Security

A network administrator is setting up an IPsec remote access VPN tunnel for mobile workers. Place the steps of the Internet Key Exchange (IKE) negotiation process in the correct chronological order from first to last.

  1. 1Negotiate IKE Phase 1 proposals, including encryption algorithms and Diffie-Hellman groups.
  2. 2Perform mutual authentication of the peers to establish the Phase 1 ISAKMP Security Association.
  3. 3Negotiate IKE Phase 2 IPsec Security Associations inside the encrypted Phase 1 tunnel.
  4. 4Establish the Phase 2 IPsec tunnel to begin transmitting encrypted application payload data.

Answer

The correct sequence begins with negotiating Phase 1 proposal parameters, followed by mutual authentication to form the Phase 1 ISAKMP SA, then negotiating Phase 2 IPsec SAs inside that protected tunnel, and concludes with establishing the Phase 2 tunnel to transmit encrypted payload data.
IPsec VPN setup requires establishing a secure management tunnel (IKE Phase 1) before negotiating parameters for actual payload encryption (IKE Phase 2). The process begins with Phase 1 parameter proposal exchange, followed by mutual peer authentication to complete the ISAKMP SA. Next, Phase 2 negotiations occur within the secure Phase 1 tunnel to create the IPsec SA, culminating in the establishment of the data tunnel for user traffic.

Step-by-Step Solution

1
Identify the initial IKE Phase 1 handshake proposal step.
The client and gateway negotiate Phase 1 parameters (encryption, hashing, DH group).
Security parameters for the control channel must be agreed upon before any secure communication can start.
2
Identify Phase 1 peer authentication.
The endpoints authenticate each other and create the ISAKMP SA.
Authenticating endpoints verifies identity and secures the Phase 1 management tunnel.
3
Identify Phase 2 IPsec SA negotiation.
Parameters for data payload protection are negotiated inside the Phase 1 channel.
Phase 2 parameters are protected by the encryption provided by the Phase 1 ISAKMP SA.
4
Identify Phase 2 data tunnel establishment.
The IPsec data tunnel opens and encrypted user traffic begins flowing.
Encrypted user payload can only traverse the network once Phase 2 SAs are fully established.

Key Concept

IPsec IKE Phase 1 and Phase 2 Negotiation Order
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic