<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:55" />
    <title>About IKE Policy Negotiation </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1737;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1073946"> </a><h1 class="pTitle">
About IKE Policy Negotiation

</h1>
<a name="wp1073947"> </a><p class="pBody">
To protect IKE negotiations, each IKE negotiation begins with a common (shared) IKE policy. An IKE 
policy defines a combination of security parameters to be used during the IKE negotiation. By default, 
no IKE policy is configured. You must create IKE policies at each peer. This policy states which security 
parameters will be used to protect subsequent IKE negotiations and mandates how peers are 
authenticated. You can create multiple, prioritized policies at each peer to ensure that at least one policy 
will match a remote peer&#39;s policy.

</p>
<a name="wp1073948"> </a><p class="pBody">
You can configure the policy based on the encryption algorithm (DES, 3DES, or AES), the hash 
algorithm (SHA or MD5), and the DH group (1, 2, or 5). Each policy can contain a different combination 
of parameter values. A unique priority number identifies the configured policy. This number ranges from 
1 (highest priority) to 255 (lowest priority). You can create multiple policies in a switch. If you need to 
connect to a remote peer, you must ascertain that at least one policy in the local switch contains the 
identical parameter values configured in the remote peer. If several policies have identical parameter 
configurations, the policy with the lowest number is selected.

</p>
<a name="wp1073952"> </a><p class="pBody">
<a href="ipe15.html#wp1073958">Table&#160;36-1</a> provides a list of allowed transform combinations.

</p>
<a name="wp1136627"> </a><p class="pBodyRelative">
</p><div>
<table border="2" cellpadding="2" id="wp1073958table1073953">
  <caption><a name="wp1073958"> </a><div class="pTableTitle">
Table&#160;36-1	IKE Transform Configuration Parameters&#160;

</div>
</caption>
  <tr bgcolor="#CCCCCC" align="left" valign="middle">    <th><a name="wp1073966"> </a><p class="pCellHeading">
Parameter

</p>
</th>
    <th><a name="wp1073968"> </a><p class="pCellHeading">
Accepted Values 

</p>
</th>
    <th><a name="wp1073970"> </a><p class="pCellHeading">
Keyword  

</p>
</th>
    <th><a name="wp1073972"> </a><p class="pCellHeading">
Default Value  

</p>
</th>
</tr>
  <tr align="left" valign="top">    <td><a name="wp1073974"> </a><p class="pBody">
encryption algorithm

</p>
</td>
    <td><a name="wp1073976"> </a><p class="pBody">
56-bit DES-CBC 

</p>
<a name="wp1073977"> </a><p class="pBody">
168-bit DES

</p>
<a name="wp1073978"> </a><p class="pBody">
128-bit AES

</p>
</td>
    <td><a name="wp1073980"> </a><p class="pBody">
<b class="cBold">des</b> 

</p>
<a name="wp1073981"> </a><p class="pBody">
<b class="cBold">3des
</b>
</p>
<a name="wp1073982"> </a><p class="pBody">
<b class="cBold">aes
</b>
</p>
</td>
    <td><a name="wp1073984"> </a><p class="pBody">
<b class="cBold">3des
</b>
</p>
</td>
</tr>
  <tr align="left" valign="top">    <td><a name="wp1073986"> </a><p class="pBody">
hash algorithm

</p>
</td>
    <td><a name="wp1073988"> </a><p class="pBody">
SHA-1 (HMAC variant) 

</p>
<a name="wp1073989"> </a><p class="pBody">
MD5 (HMAC variant)

</p>
</td>
    <td><a name="wp1073991"> </a><p class="pBody">
<b class="cBold">sha</b>   

</p>
<a name="wp1073992"> </a><p class="pBody">
<b class="cBold">md5
</b>
</p>
</td>
    <td><a name="wp1073994"> </a><p class="pBody">
<b class="cBold">sha
</b>
</p>
</td>
</tr>
  <tr align="left" valign="top">    <td><a name="wp1073996"> </a><p class="pBody">
authentication method

</p>
</td>
    <td><a name="wp1073998"> </a><p class="pBody">
Preshared keys

</p>
</td>
    <td><a name="wp1074000"> </a><p class="pBody">
Not configurable

</p>
</td>
    <td><a name="wp1074002"> </a><p class="pBody">
Preshared keys

</p>
</td>
</tr>
  <tr align="left" valign="top">    <td><a name="wp1074004"> </a><p class="pBody">
DH group identifier

</p>
</td>
    <td><a name="wp1074006"> </a><p class="pBody">
768-bit DH 

</p>
<a name="wp1074007"> </a><p class="pBody">
1024-bit DH

</p>
<a name="wp1074008"> </a><p class="pBody">
1536-bit DH

</p>
</td>
    <td><a name="wp1074010"> </a><p class="pBody">
<b class="cBold">1 
</b>
</p>
<a name="wp1074011"> </a><p class="pBody">
<b class="cBold">2
</b>
</p>
<a name="wp1074012"> </a><p class="pBody">
5

</p>
</td>
    <td><a name="wp1074014"> </a><p class="pBody">
<b class="cBold">1
</b>
</p>
</td>
</tr>
</table>
</div>
<p class="pBodyRelative">
</p>
<a name="wp1074016"> </a><p class="pBody">
The following table lists the supported and verified settings for IPsec and IKE encryption authentication 
algorithms on the Microsoft Windows and Linux platforms:</p><div>
<table border="2" cellpadding="2" id="wp1074019table1074017">
  <caption></caption>
  <tr bgcolor="#CCCCCC" align="left" valign="middle">    <th><a name="wp1074019"> </a><p class="pCellHeading">
Platform

</p>
</th>
    <th><a name="wp1074021"> </a><p class="pCellHeading">
IKE

</p>
</th>
    <th><a name="wp1074023"> </a><p class="pCellHeading">
IPsec

</p>
</th>
</tr>
  <tr align="left" valign="top">    <td><a name="wp1074025"> </a><p class="pBody">
Microsoft iSCSI initiator, 
Microsoft IPsec implementation 
on Microsoft Windows 2000 
platform

</p>
</td>
    <td><a name="wp1074027"> </a><p class="pBody">
3DES, SHA-1 or MD5, <br />
DH group 2 

</p>
</td>
    <td><a name="wp1074029"> </a><p class="pBody">
3DES, SHA-1

</p>
</td>
</tr>
  <tr align="left" valign="top">    <td><a name="wp1074031"> </a><p class="pBody">
Cisco iSCSI initiator,<br />
Free Swan IPsec implementation 
on Linux platform

</p>
</td>
    <td><a name="wp1074033"> </a><p class="pBody">
3DES, MD5, DH group 1

</p>
</td>
    <td><a name="wp1074035"> </a><p class="pBody">
3DES, MD5

</p>
</td>
</tr>
</table>
</div>
<p class="pBody">

</p>
<a name="wp1074036"> </a><p class="pBodyAutonumNoRule">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> When you configure the hash algorithm, the corresponding HMAC version is used as the authentication 
algorithm.

</p>
<a name="wp1074037"> </a><p class="pBody">
When the IKE negotiation begins, IKE looks for an IKE policy that is the same on both peers. The peer 
that initiates the negotiation will send all its policies to the remote peer, and the remote peer will try to 
find a match. The remote peer looks for a match by comparing its own highest priority policy against the 
other peer&#39;s received policies. The remote peer checks each of its policies in order of its priority (highest 
priority first) until a match is found.

</p>
<a name="wp1074038"> </a><p class="pBody">
A match is found when the two peers have the same encryption, hash algorithm, authentication 
algorithm, and DH group values. If a match is found, IKE completes the security negotiation and the 
IPsec SAs are created. 

</p>
<a name="wp1074039"> </a><p class="pBody">
If an acceptable match is not found, IKE refuses negotiation and the IPsec data flows will not be 
established.

</p>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
