So we know that IKE helps us with authentication and SA establishment,
but what helps IKE with that?
This is a great question that can be broken down into
one answer with three protocols, ISAKMP,
OAKLEY, and SKEME.
Now, these three protocols will be discussed in a minute,
but remember,
IKE is the way we establish our connection to be able
to securely connect to our peers.
We'll save some of that discussion for later on in the course.
For now though, let's talk about the protocols that IKE is known for.
First up in this list is ISAKMP,
aka Internet Security Association and Key Management Protocol.
That's kind of a mouthful, so I like sticking with ISAKMP.
This protocol gives us the procedures and formats to establish SAs.
It's also used to modify, delete, and negotiate them.
What's cool about this is that it combines authentication,
key management, and security associations for us.
In short, ISAKMP helps build our SAs.
There are other use cases for ISAKMP as well,
but for the purposes of this course,
we'll only be talking about it with regards to IPsec.
In many devices,
the ISAKMP parameters are actually something that we can
configure to get IPsec working as we want it.
We'll see that here in a little bit.
OAKLEY and SKEME are the two other protocols that help us
in IKE and are mentioned in the IKE RFC.
OAKLEY gives us the various key exchange mechanisms and
services provided by those mechanisms.
It's used to come up with the ability to exchange the key
material over an insecure connection.
This uses the Diffie-Hellman algorithm to accomplish this.
It's interesting that this can be done without any sort of encryption, isn't it?
Now,
SKEME is another one of these protocols that help us by
giving us a versatile key exchange technique.
This gives us the anonymity that we need,
as well as the verification that is coming from a reputable source.
IKE uses a combination of these two protocols plus ISAKMP to obtain the keying material.