IKEv2 was able to have some authentication enhancements
come to fruition as it was created.
In this clip,
we're going to discuss some of these and detail the authentication
methods that are possible within the IKEv2 protocol.
It gives us so much more flexibility in the authentication
and allows us to better control our infrastructure's
connectivity to remote sites and users.
Interestingly enough,
the two ends of the link don't need to negotiate and
agree upon the authentication method,
so you can essentially have different authentication mechanisms on both sides,
and the link still works.
Looking at the authentication methods available to IKEv2,
we'll start with the classic pre-shared key.
This is exactly like we discussed in version 1 where we're able to
authenticate via a shared password or key with the remote end.
This still poses the risk that you have to find some way to get
that key to the remote device in a secure way.
IKEv2 can also use certificates and the public key
infrastructure to get the authentication,
so you can better secure the connection.
This is similar to the ability to do so in IKEv1,
so we won't cover this in detail again.
Just know that you can use certificates to authenticate your peers and have the
ability to set those expiration dates that we like to set.
Elliptic Curve Digital Signature Algorithm is another new
authentication mechanism that's allowed for in IKEv2.
This was something that was truly available in version 1,
but not until after on in the development of it.
Since it was built into the IKEv2 protocol,
it's been much more widely adopted for use within enterprise environments,
particularly ones requiring special authentication security.
I'm mentioning this one in here despite the fact that digital signatures were
already available to be used for authentication in both IKEv1 and v2 because
it's an important addition to the abilities.
ECDSA improves communications efficiency and allows for
a quicker computation of the keys.
This makes for a very nice choice when wanting to use
digital signatures or public keys.
Now let's talk about EAP.
The Extensible Authentication Protocol allows us to have a very
flexible authentication method available to us.
It's an authentication framework that actually provides us with many
different ways to authenticate users or peers.
One cool thing about this being built into the IKEv2 suite is that
it's able to be expanded without having to redefine the suite or
the authentication methods at all.
You may know EAP as a method of authentication for network
access control solutions like 802.1x.
It's essentially the same thing here,
only with IKE instead of the leading NAC solution.
With EAP, we can use asymmetric key pairs,
passwords, and symmetric keys to authenticate the peers.
This also has the ability to use a different
authentication technique in each direction, as discussed earlier.