Pre-shared key exchange in IPsec Phase 1

[rakesh24csco]

Hi,

I have some queries:

1. I wanna understand when Pre-shared key is really exchanged in IPsec phase-1? Please explain it in the Main Mode and Aggressive Mode messages flow, be specific to the messages while explaining.

2. Which particular parameter specifies (in terms of IPsec messages) whether it is a new tunnel negotiation or an existing tunnel re-negotiation? 

Thanks,

Rakesh Kumar

[Philip D'Ath]

Are you referring to IKEv1 or IKEv2, as they are completely different?

[rakesh24csco]

You are welcome to explain for both.

[Philip D'Ath]

This is a detailed debug of IKEv1 with good explanations.

https://supportforums.cisco.com/document/53656/understanding-asa-ipsec-and-ike-debugs-ikev1-main-mode

This is the message flow for IKEv2:

http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/115936-understanding-ikev2-packet-exch-debug.html

[rakesh24csco]

For IKEv1, is it MM5 and MM6 for sharing pre-shared key?

[Philip D'Ath]

That is my understanding.