Site-to-Site IPsec Fundamentals
Understanding IKE phases and IPsec tunnel negotiation.
IPsec site-to-site tunnels are established in two phases. IKE Phase 1 negotiates a secure channel between the two peers themselves.
IKE Phase 2 uses that secure channel to negotiate the actual IPsec Security Associations (SAs) that will protect user traffic.
- Encryption algorithm (e.g. AES-256)
- Hash algorithm (e.g. SHA-256)
- Diffie-Hellman group
- Security association lifetime
These Phase 1 parameters must match on both peers or the tunnel will fail to negotiate.