> # About IKE Policy Negotiation

> To protect IKE negotiations, each IKE negotiation begins with a common (shared) IKE policy. An IKE policy defines a combination of security parameters to be used during the IKE negotiation. By default, no IKE policy is configured. You must create IKE policies at each peer. This policy states which security parameters will be used to protect subsequent IKE negotiations and mandates how peers are authenticated. You can create multiple, prioritized policies at each peer to ensure that at least one policy will match a remote peer's policy.

> You can configure the policy based on the encryption algorithm (DES, 3DES, or AES), the hash algorithm (SHA or MD5), and the DH group (1, 2, or 5). Each policy can contain a different combination of parameter values. A unique priority number identifies the configured policy. This number ranges from 1 (highest priority) to 255 (lowest priority). You can create multiple policies in a switch. If you need to connect to a remote peer, you must ascertain that at least one policy in the local switch contains the identical parameter values configured in the remote peer. If several policies have identical parameter configurations, the policy with the lowest number is selected.

> Table 36-1 provides a list of allowed transform combinations.

> Table 36-1 IKE Transform Configuration Parameters
> Parameter | Accepted Values | Keyword | Default Value
> --- | --- | --- | ---
> encryption algorithm | 56-bit DES-CBC 168-bit DES 128-bit AES | des 3des aes | 3des
> hash algorithm | SHA-1 (HMAC variant) MD5 (HMAC variant) | sha md5 | sha
> authentication method | Preshared keys | Not configurable | Preshared keys
> DH group identifier | 768-bit DH 1024-bit DH 1536-bit DH | 1 2 5 | 1

> The following table lists the supported and verified settings for IPsec and IKE encryption authentication algorithms on the Microsoft Windows and Linux platforms:

> Platform | IKE | IPsec
> --- | --- | ---
> Microsoft iSCSI initiator, Microsoft IPsec implementation on Microsoft Windows 2000 platform | 3DES, SHA-1 or MD5, DH group 2 | 3DES, SHA-1
> Cisco iSCSI initiator, Free Swan IPsec implementation on Linux platform | 3DES, MD5, DH group 1 | 3DES, MD5

> Note When you configure the hash algorithm, the corresponding HMAC version is used as the authentication algorithm.

> When the IKE negotiation begins, IKE looks for an IKE policy that is the same on both peers. The peer that initiates the negotiation will send all its policies to the remote peer, and the remote peer will try to find a match. The remote peer looks for a match by comparing its own highest priority policy against the other peer's received policies. The remote peer checks each of its policies in order of its priority (highest priority first) until a match is found.

> A match is found when the two peers have the same encryption, hash algorithm, authentication algorithm, and DH group values. If a match is found, IKE completes the security negotiation and the IPsec SAs are created.

> If an acceptable match is not found, IKE refuses negotiation and the IPsec data flows will not be established.

> Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.