There's IKE version 1 and there's IKE version 2,
what are the differences between them?
Find out next right here on ITProTV.
>> You're watching ITProTV.
[MUSIC]
>> We are jumping in and taking a look at Internet key exchange and
there are the two different versions that we need to be aware of, and
here to help us out to sort all that out Anthony Sequeira.
Now Anthony, I know at least at this point, I've implemented VPN tunnels
with IKE version 1, I've implemented VPN tunnels with IKE version 2.
I really have to honestly admit, I know some of the differences but
are there actually key differences that we should be focusing on?
>> Yeah, there really are Ronnie and this is getting a little nitpicky, but
I was thinking about the certification exam here I'll be honest with you.
I think we've talked about this before Ronnie,
where like IKE version 2 ends up being a requirement for certain styles of VPNs.
>> Right.
>> Off the top of my head,
I remember like the get VPN is such relatively new technology does
some super fancy stuff like that starts requiring the IKE version 2.
But from a production standpoint, the Cisco routers for
a long time now, have been pre-cooked with the IKE version 2.
So that whole issue of my goodness, we can't choose a particular
security feature, because our device doesn't support IKE version 2,
that really is an issue that has gone bye bye,
IKE version two is become ubiquitous >> Now I do know just a little bit
in terms of configuring the VPN, especially on Cisco routers,
I do know that IKE version 2, it's been a bit more
complex to configure than IKE version 1, so where are we gonna begin?
>> Yeah so let's start with IKE version 1, why don't we do that Ronnie,
and this is really gonna bring back some memories for you I'm sure.
>> Yeah.
>> Remember IKE version one, there is the phase one.
Now, one of my favorite analogies, Kevin Wallace and
I came up with this I remember together and it's always been one of
my favorite analogies is Ronnie you might have you might have watched this show.
Did you ever watch Get Smart?
>> I did.
>> About the secret agent, do you remember when he would go in the cone of
silence and it was just this silly like little plastic thing that would
lower in his office, and then it would have a tube and
it would go over to another person who had the cone on.
And it was the cone of silence, it was so ridiculous and
silly, but it always kind of reminded me of phase 1, right?
The phase 1 of IKE, and by the way, a sub protocol called IKE SA,
and as Omar Santo says in the book regarding NIST certification guide.
He said a great thing he was like and you know what people get so
caught up with IKE verse IKE SA camp and IPsec he's just go ahead and
for our purposes consider them synonymous.
So anyways, the cone of silence from Get Smart,
it really does remind me of that phase 1 what is happening here
is there is an initial secure communications channel established,
and we often call it the IKE security association.
And that is so, we now have a secured medium, so
that we can exchange the parameters, for actually securing the data,
and that's what IKE phase 2 is all about.
And we have a security association that's built there,
that we call the IPsec, Security Association.
So the initial phase 1, a secured communications channel,
so that we can securely discuss between the two systems,
how the data is gonna be secured.
Now notice in phase 1, there is a main mode that is possible with IKE v1,
and there is an aggressive mode that's possible with IKE v1.
And sure enough, the main mode, involves a lot of round trips and a lot of messages,
six messages, and the aggressive mode cuts that in half with three.
Now if you're wondering why not just always go aggressive mode,
just realize that each of the modes of phase one,
makes certain methodologies either available or unavailable.
For example, maybe you wanna do dynamic pure establishment and
dynamic, address learning and things like that,
think technologies like the DMVPN, for example.
Well then sure enough, it turns out that the main mode doesn't support that,
so there's, little nuances that we're not responsible for
between main mode and aggressive mode, I would just know of them.
And also,
take a look at the efficiency as far as the number of messages that are required.
Phase 2 is done with what's called Quick mode, it's just the three messages, and
as we said, this is gonna be for the establishment of our IPsec SA,
where we are actually protecting the data traffic, between these two systems.
So, in this very brief video we now wanna wrap it up with okay,
what's the laundry list of exciting features when it comes
to IKE version 2, and the wonderful feature list is new and
improved, built in denial of service type protections.
There's two messages used in this process, so
that is just a dramatic improvement on even the most efficient styles of IKE v1.
There's dead peer detection that is built in now, so if we have a peer that has gone
offline that can be more seamlessly and elegantly detected, and
there's unidirectional authentication, this is interesting.
So you might be doing a shared key approach in one direction, and
you want wanna do a totally different approach in the opposite direction,
regarding authentication.
>> Yeah now with that DPD that you list there, that's kind of one of the unique
features that really does stand out compared to IKE version 1.
When an IKE version 1 if it dropped off, you had to go ahead and re-initiate in
other words, send that interesting traffic before it actually came back up.
But with that DPD and actually says, hey look, I know the tunnels down and
it automatically reconnects which absolutely helps as well, because it means
we don't have to actually worry about is there traffic going through or not?
Is the tunnel up or not?
It actually just says look, I don't care if you send the the interesting traffic,
I'll go ahead and just reform that and make it work.
And also with your idea here of that unidirectional authentication,
that means it can authenticate from both sides which provides great security.
So instead of just one side actually authenticating another another side
validating, both sides get to authenticate against each other,
which is absolutely something that is gonna be much more secure than what we
would have in IKE version 1 as well.
So, with all of that information that we have there, okay?
When it comes down to security, can we safely say then, Anthony,
that IKE version 2 is gonna be more secure the IKE version 1?
>> Absolutely, it really is, again, many more protections built in,
I didn't even give you the complete list here, I mean, I could go on, and on.
For instance, there's NAT traversal, which is getting all of this to work
in a NAT environment that's built in, there's much better rekeying and
collision avoidance collision as far as security algorithms go.
So it really is just a more elegant solution, and
it's one that's gonna be the default on most of our Cisco devices today, and
obviously, that's really good news.
>> All right Anthony well, that's a great reminder for
us to actually make sure that we pay attention here,
especially the differences between using IKE version 1 and IKe version 2.
All these have actually been relatively characteristic when you actually head
towards Cisco exams when they ask about setting up tunnels, and
which one would actually give you the ability to support something or
doesn't support something, make sure you pay attention those features.
And if you choose to implement it as Anthony has said, make sure you actually
take a look more than likely IKE version two i2 s already built in with a support.
Well, that will go ahead and do it for this episode, then signing off for
ITProTV, I'm your host, Ronnie Wong.
>> And I'm Anthony Sequeira.
>> Stay tuned right here for your Cisco score show.
[MUSIC]
>> Thank you for watching ITProTV.
[MUSIC]
[BLANK_AUDIO]