indicates that selected traffic should be sent unencrypted. The IPSec client initiates the next step when the interesting traffic is generated.

Step 2: In this step, Internet Key Exchange or IKE Phase 1 is done. IPSec peers are authenticated to set up a secure channel between the peers to enable Internet Key Exchanges. This step also negotiates the IKE SA policy between peers to protect the IKE. A Security Association or SA is a relationship between two or more entities that describes how the entities will securely communicate with each other. This step also performs the Diffie-Hellman exchange to have matching shared secret keys (How does the Diffie-Hellman Key Exchange Protocol work?).

IKE Phase 1 can occur in two modes – main mode and aggressive mode.

Main Mode – In this mode, three two-way exchanges happen between the sender and the receiver.

• The algorithms and hashes used to secure the IKE communications are agreed upon.
• Diffie-Hellman exchange occurs to get matching secret shared keys. Random numbers are sent to the other party and signed and returned to prove their identity.
• The identity of the other side is verified. The identity is IPSec’s peer’s IP address in an encrypted form.

Aggressive Mode – In the aggressive mode, fewer exchanges take place with fewer packets. Almost everything of the proposed IKE SA values is squeezed into the first packet. The receiver sends everything back to the sender. The sender then confirms the exchange. The weakness of this mode is that both parties exchange information in an unsecured channel, so information can be sniffed. But this mode is faster than the main mode.

Step 3: The purpose of IKE Phase 2 is to negotiate the IKE SAs to set up the IPSec tunnel. It negotiates a shared secret keying material used for the IPSec security algorithms and establishes IPSec SAs. Sometimes, this phase occurs when the lifetime of IPSec SA expires, and renegotiation happens for new IPSec SA.

Step 4: After the IKE Phase 2 is complete, information is exchanged through the secure IPSec tunnel. Packets are encrypted and decrypted as per the IPSec SA.

Step 5: IPSec SAs terminate through deletion or timeout. When IPSec SAs terminate, keys are discarded. If subsequent SAs are required, new IKE Phase 2 along with new IKE Phase 1 is performed. And subsequently, new SAs and new keys are received. New SAs are established before the previous SAs expire to continue uninterruptedly.

This was a brief overview of the IPSec protocol. Interested readers who want to know more about how different cryptographic algorithms work and how they are used in various secure network protocols may want to refer to the book “Cryptography And Public Key Infrastructure.”

Security Fundamentals Practice Tests

The Security Fundamentals Practice Tests test one’s fundamental knowledge of cyber security. The practice tests are good for those who are preparing for various certification exams like the CCNA, CCNP, or CompTIA. They are also good for students and IT/security professionals who want to improve their understanding of cybersecurity.