# IPsec (Internet Protocol Security) **URL:** \ **Category:** Lessons Discussion\ **Created:** [December 29, 2016, 8:03pm UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281 "2016-12-29T20:03:34Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![devaprem12](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/d/4bbf92/32.png) [@devaprem12](https://forum.networklessons.com/u/devaprem12)\ **Post date:** [January 16, 2019, 6:36am UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/42 "2019-01-16T06:36:43Z")
Great Article as always If i want to know any complex topics for my daily work i always come here , short and crisp. ---
**Author:** ![vschi26](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/v/a87d85/32.png) [@vschi26](https://forum.networklessons.com/u/vschi26)\ **Post date:** [February 11, 2019, 5:47am UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/43 "2019-02-11T05:47:25Z")
Hi Rene, Thank you for such a nice article in friendly manner. I have just started reading this article and trying to understand its operational behavior. I am bit confused with the following statement: " **The IKE phase 1 tunnel is only used for management traffic. We use this tunnel as a secure method to establish the second tunnel called the IKE phase 2 tunnel or IPsec tunnel and for management traffic like keepalives.** **Once IKE phase 2 is completed, we have an IKE phase 2 tunnel (or IPsec tunnel) that we can use to protect our user data. This user data will be sent through the IKE phase 2 tunnel** My question is, are we using IKE phase 2 tunnel for both management traffic like Keepalive or user data passing through ? or only user data will pass from IKE phase2. ---
**Author:** ![thekhan2k2](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/t/94ad74/32.png) [@thekhan2k2](https://forum.networklessons.com/u/thekhan2k2)\ **Post date:** [February 11, 2019, 1:16pm UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/44 "2019-02-11T13:16:32Z")
Any help please, this MD5 thing really confuses me ? I would appreciate if you could explain a bit about MD5 as to why we are saying MD5 Authentication in Phase-1 and MD5 Hashing in Phase-2 ? Being a newbie in security world, I couldn’t figure out when we label MD5 as an authentication thing and when an integrity thing ? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [February 11, 2019, 2:57pm UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/45 "2019-02-11T14:57:35Z")
Hello Babar Sorry about the late reply. MD5 is a hashing algorithm What this means is that it is applied to a string which results in a fixed-sized (128 bit) output or hash. This is used to verify integrity of messages sent or used as authentication. When used to verify integrity, a hash is generated on a specific message and is sent with the message. When the same message arrives, the MD5 hash is operated on the message again and the result is compared with the sent hash to verify the integrity of the message. When used for authentication, the hash is applied to a key, or a password. The hash is sent to the device on the other end where it is compared with a hash of the local password. if the hashes are the same, the association is authenticated. This procedure allows passwords to be compared without having to send the unencrypted password itself over the link. Now phase 1 uses MD5 for the integrity of the original link while phase 2 uses MD5 for authentication. I hope this has been helpful! Laz ---
**Author:** ![thekhan2k2](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/t/94ad74/32.png) [@thekhan2k2](https://forum.networklessons.com/u/thekhan2k2)\ **Post date:** [February 12, 2019, 10:47am UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/46 "2019-02-12T10:47:39Z")
Thanks Lazaros, really appreciate for the clarifications ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [March 4, 2019, 3:15pm UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/47 "2019-03-04T15:15:01Z")
Hello Vimal, Phase 2 is indeed only for user traffic. Keepalives and DPD belong to phase 1. Rene ---
**Author:** ![vschi26](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/v/a87d85/32.png) [@vschi26](https://forum.networklessons.com/u/vschi26)\ **Post date:** [March 8, 2019, 8:30pm UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/48 "2019-03-08T20:30:46Z")
Thank You Rene 😀 I got it 😀 ---
**Author:** ![saif.salah.apple](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/s/71c47a/32.png) [@saif.salah.apple](https://forum.networklessons.com/u/saif.salah.apple)\ **Post date:** [March 10, 2019, 7:10pm UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/49 "2019-03-10T19:10:20Z")
dear mr. Rene kindly , in case we use ESP with preshared key with as authenticatied method with nat ,we face problem that preshared key authentication fail cause it depend on source ip address , we can use user id & FQDN to solve that rathar that ip address as identication ID , my question how can implement this option in configuration ? ---
**Author:** ![saif.salah.apple](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/s/71c47a/32.png) [@saif.salah.apple](https://forum.networklessons.com/u/saif.salah.apple)\ **Post date:** [March 11, 2019, 10:16pm UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/50 "2019-03-11T22:16:52Z")
dear mr.rene kindly ,what default configuration mode for isakmp ,main or aggressive & how i change or configure main or aggressive & what i need to prepare before that .? ---
**Author:** ![saif.salah.apple](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/s/71c47a/32.png) [@saif.salah.apple](https://forum.networklessons.com/u/saif.salah.apple)\ **Post date:** [March 11, 2019, 10:36pm UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/51 "2019-03-11T22:36:31Z")
dear mr.rene kindly, in case using NAT (PAT with ESP ,ESP intergrity fail cause we change TCP port no , so tcp chekcsum change & if not change tcp checksum we face problem of tcp verification fail , my question which configuration needed to make PAT& ESP interworking .. ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [March 28, 2019, 11:53am UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/52 "2019-03-28T11:53:31Z")
Hello Saif, > [@saif.salah.apple](#): > > what default configuration mode for isakmp ,main or aggressive What platform do you use? Main mode is usually the default. On Cisco IOS, you can configure it like this: ``` crypto isakmp peer address 192.168.1.2 set aggressive-mode password MY_PASSWORD set aggressive-mode client-endpoint user-fqdn MY_FQDN ! crypto map MY_CRYPTO_MAP 10 ipsec-isakmp set peer 192.168.1.2 set transform-set MY_TRANSFORM_SET match address MY_ACL ``` > [@saif.salah.apple](#): > > configuration needed to make PAT& ESP interworking To make ESP and NAT work, you need to use NAT-T. Rene ---
**Author:** ![saif.salah.apple](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/s/71c47a/32.png) [@saif.salah.apple](https://forum.networklessons.com/u/saif.salah.apple)\ **Post date:** [April 6, 2019, 10:50am UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/53 "2019-04-06T10:50:06Z")
you abbrevaite many in simple words ,thanks ---
**Author:** ![vuppal007](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/v/9de053/32.png) [@vuppal007](https://forum.networklessons.com/u/vuppal007)\ **Post date:** [May 3, 2019, 1:56pm UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/54 "2019-05-03T13:56:35Z")
Hello Team, I was going through some vpn concept and came across two terms route base vpn and policy based vpn. Please can you explain the difference between these two and how they relate to IPSec and SSL? Thanks in advance!! ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [May 6, 2019, 4:43am UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/55 "2019-05-06T04:43:59Z")
Hello Varun Policy-based VPNs encrypt and encapsulate a subset of traffic flowing through an interface according to a defined policy, usually implemented using an access list. The policy may dictate that only some or all of the traffic being evaluated is placed into the VPN. This type of VPN is often referred to as LAN-to-LAN within the framework of a Cisco ASA. A route based VPN on the other hand is one that employs a routed tunnel interface as the endpoint of the VPN. **All** traffic passing through a tunnel interface is placed into the VPN. Rather than relying on an explicit policy to dictate which traffic enters the VPN, static and/or dynamic IP routes are formed to direct the desired traffic through the VPN tunnel interface. I hope this has been helpful! Laz ---
**Author:** ![vuppal007](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/v/9de053/32.png) [@vuppal007](https://forum.networklessons.com/u/vuppal007)\ **Post date:** [May 6, 2019, 10:59pm UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/56 "2019-05-06T22:59:48Z")
Thanks for your prompt reply Laz but can you give an example of route based vpn? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [May 7, 2019, 2:46pm UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/57 "2019-05-07T14:46:51Z")
Hello Varun To review, a route based VPN uses a routing table entry to decide whether to route specific IP connections based on the destination address, to the VPN tunnel or not. Now until release 9.7.1 of the Cisco ASA, it was able only to configure policy based VPNs. Route based VPNs were only available in Cisco Router IOS versions. To find out more about how to configure this on a Cisco ASA, including examples, take a look at this Cisco documentation. > **[vpn-vti.pdf](https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/vpn/asa-97-vpn-config/vpn-vti.pdf)** > > 1098.93 KB For a Cisco IOS router, route based VPNs require the use of either [GRE](https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/P2P_GRE_IPSec/P2P_GRE/2_p2pGRE_Phase2.html) or a [Virtual Tunnel Interface (VTI)](https://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gtIPSctm.html). Note that unlike policy based VPNs, route based VPNs cannot be used with remote client access. They only support site to site and hub and spoke topology VPNs. I hope this has been helpful! Laz ---
**Author:** ![inonlahiani](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/i/97f17d/32.png) [@inonlahiani](https://forum.networklessons.com/u/inonlahiani)\ **Post date:** [May 26, 2019, 7:10am UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/58 "2019-05-26T07:10:37Z")
After the two parties created a shared key using DH - what is this key used for? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [May 27, 2019, 5:36am UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/59 "2019-05-27T05:36:25Z")
Hello Inon The shared key that is created using DH (which is described in Step 2 within the lesson) is then used in the authentication process. In Step 3 in the lesson, Rene states that > “…the two peers will authenticate each other using the authentication method that they agreed upon on in the negotiation.” The keys are used in this authentication process. I hope this has been helpful! Laz ---
**Author:** ![inonlahiani](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/i/97f17d/32.png) [@inonlahiani](https://forum.networklessons.com/u/inonlahiani)\ **Post date:** [May 27, 2019, 10:28am UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/60 "2019-05-27T10:28:10Z")
1. IKE RFC: (g^xy is the DH shared key) > The result of either Main Mode or Aggressive Mode is three groups of authenticated keying material: > > SKEYID\_d = prf(SKEYID, g^xy | CKY-I | CKY-R | 0) > SKEYID\_a = prf(SKEYID, SKEYID\_d | g^xy | CKY-I | CKY-R | 1) > SKEYID\_e = prf(SKEYID, SKEYID\_a | g^xy | CKY-I | CKY-R | 2) > > SKEYID\_e is the keying material used by the ISAKMP SA to protect the confidentiality of its messages. > > SKEYID\_a is the keying material used by the ISAKMP SA to authenticate its messages. > > SKEYID\_d is the keying material used to derive keys for non-ISAKMP security associations So SKEYID\_d is handed to IPsec to derive its keying material. How does IPsec derive its keying material to use after IKE Phase 2 built the IPsec tunnel so he can authenticate and encrypt user data? 1. My second question is why does Rene says that the AH header is inserted **after** the IP Header will it shows up in the middle on the picture? ---
**Author:** ![olim26m](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/o/a8b319/32.png) [@olim26m](https://forum.networklessons.com/u/olim26m)\ **Post date:** [July 27, 2019, 1:34pm UTC](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281/61 "2019-07-27T13:34:45Z")
Hi, i believe this is not true. The shared key that is created using DH is then used as a symetric key for the subsequent encryption (AES, 3DES,DES, etc.). Authentication could be configured to pre-share or RSA-sig (PKI). Please correct me if i am wrong ! Oliver [Previous page](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281.md?page=2) [Next page](https://forum.networklessons.com/t/ipsec-internet-protocol-security/1281.md?page=4)