7
IPsec VPN
123
IKE authentication
IKE
provides
a
way
to
securely
establish
communications
between
the
two
ends
of
an
IPsec
tunnel.
Before
examining
IKE
in
detail,
the
alternative
of
manually
setting
up
a
tunnel
is
discussed.
Manual keying without IKE
Without
IKE,
the
“simplest”
way
of
configuring
the
algorithms
used
by
an
IPsec
tunnel
is
by
using
manual
keying
.
This
is
a
method
where
the
encryption
and
authentication
keys
as
well
as
some
other
parameters
are
directly
configured
on
both
sides
of
the
VPN
tunnel.
Manual
keying
is
supported
by
the
SEG
but
only
for
ESP
with
tunnel
mode.
However,
it
has
a
number
of
limitations,
such
as
having
to
always
use
the
same
encryption/authentication
keys,
no
anti
‐
replay
services.
There
is
also
no
way
of
assuring
that
the
remote
host/security
gateway
really
is
the
one
it
says
it
is.
The
vulnerability
of
manual
keying
to
“replay
attacks”
means
that
a
malicious
entity
with
access
to
the
encrypted
traffic
can
record
packets,
store
them,
and
send
them
to
its
destination
at
a
later
time.
The
destination
VPN
endpoint
will
have
no
way
of
telling
if
this
packet
is
a
“replayed”
packet
or
not.
Using
IKE
eliminates
this
vulnerability.
PSK-based authentication
Using
a
Pre
‐
shared
Key
(PSK)
is
a
method
where
the
endpoints
of
the
VPN
“share”
a
secret
key.
This
is
a
service
provided
by
IKE,
and
thus
has
all
the
advantages
that
come
with
it,
making
it
far
more
flexible
than
manual
keying.
PSK advantages
Pre
‐
Shared
Keying
has
a
lot
of
advantages
over
manual
keying.
These
include
endpoint
authentication,
which
is
what
the
PSKs
are
really
for.
It
also
includes
all
the
benefits
of
using
IKE.
Instead
of
using
a
fixed
set
of
encryption
keys,
session
keys
will
be
used
for
a
limited
period
of
time,
where
after
a
new
set
of
session
keys
are
used.
PSK disadvantages
One
thing
that
has
to
be
considered
when
using
PSKs
is
key
distribution.
How
are
the
Pre
‐
Shared
Keys
distributed
to
remote
VPN
end
points?
This
is
a
major
issue,
since
the
security
of
a
PSK
system
is
based
on
the
PSKs
being
kept
secret.
Should
one
PSK
be
compromised,
the
configuration
will
need
to
be
changed
to
use
a
new
PSK.
Certificate-based authentication
Each
VPN
gateway
has
its
own
certificate,
and
one
or
more
trusted
root
certificates.
The
authentication
is
based
on
several
things:
•
That
each
endpoint
has
the
private
key
corresponding
to
the
public
key
found
in
its
certificate,
and
that
nobody
else
has
access
to
the
private
key.
•
That
the
certificate
has
been
signed
by
someone
that
the
remote
endpoint
trusts.
