I've been building IPsec VPNs for years but to be honest I've never fully grasped the technical difference between IKE and ISAKMP. I often see the two terms used interchangeably (probably incorrectly).

I understand the two basic phases of IPsec and that ISAKMP seems to deal primarily with phase one. For instance, the IOS command "show crypto isakmp sa" displays IPsec phase one information. But there's no equivalent command for IKE.

up vote 54 down vote accepted

ISAKMP is part of IKE. (IKE has ISAKMP, SKEME and OAKLEY). IKE establishs the shared security policy and authenticated keys. ISAKMP is the protocol that specifies the mechanics of the key exchange.

The confusion, (for me,) is that in the Cisco IOS ISAKMP/IKE are used to refer to the same thing. By which I mean, my understanding is that Cisco's IKE only implements/uses ISAKMP. So one configures IKE, and then conceptually inside that, one configures ISAKMP.

Please check whether this helps, I know that I am late :)

Yes, this is from the Wikipedia article, Internet Security Association and Key Management Protocol, but I didn't see any references so far to Wiki/RFC here in discussion.

ISAKMP defines the procedures for authenticating a communicating peer, creation and management of Security Associations, key generation techniques and threat mitigation (e.g. denial of service and replay attacks). As a framework, ISAKMP is typically utilized by IKE for key exchange, although other methods have been implemented such as Kerberized Internet Negotiation of Keys. A Preliminary SA is formed using this protocol; later a fresh keying is done.

ISAKMP defines procedures and packet formats to establish, negotiate, modify and delete Security Associations. SAs contain all the information required for execution of various network security services, such as the IP layer services (such as header authentication and payload encapsulation), transport or application layer services or self-protection of negotiation traffic. ISAKMP defines payloads for exchanging key generation and authentication data. These formats provide a consistent framework for transferring key and authentication data which is independent of the key generation technique, encryption algorithm and authentication mechanism.

ISAKMP is distinct from key exchange protocols in order to cleanly separate the details of security association management (and key management) from the details of key exchange. There may be many different key exchange protocols, each with different security properties. However, a common framework is required for agreeing to the format of SA attributes and for negotiating, modifying and deleting SAs. ISAKMP serves as this common framework.

ISAKMP can be implemented over any transport protocol. All implementations must include send and receive capability for ISAKMP using UDP on port 500.

  • You should edit to use the quote feature, and you should credit the source. – Ron Maupin Nov 8 '15 at 4:53
  • It appears that this answer is primarly copied from another source and that you forgot to attribute the original source. I have fixed this to the best of my ability, but please verify my changes are correct and make sure to do this yourself in the future. – YLearn Nov 8 '15 at 5:30
  • You should attribute the source, and provide a link, if possible. I fixed your edit of @YLearn's edit to add the link back. – Ron Maupin Nov 8 '15 at 7:07
  • guys, i didn't so far see any reference to wiki or any detailed explanation in the above discussions while I was going through the post to find the difference between IKE/ISAKMP. Hence thought of putting it here and this is not to take any credit :) :) :) – Feroze K.M Nov 8 '15 at 7:17
  • It's poor form to quote someone's work without giving credit. The fair use doctrine allows you to quote someone's work, but you need to give credit where credit is due, otherwise, in some contexts, it's called plagiarism. We were just trying to improve your answer (and to be fair to the original author). – Ron Maupin Nov 8 '15 at 8:12

Practically speaking - IKE, Internet Key Exchange (IKE), is synonymous with Internet Security Association Key Management Protocol (ISAKMP).

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.