how security association (SA) is established?

Question

I'm a newbie in networking, still struggling to understand some concepts. I was reading a text describes security association (SA) in VPN.

Whenever router R1 needs to construct an IPsec datagram for forwarding over this SA, it accesses this state information to determine how it should authenticate and encrypt the datagram. Similarly, router R2 will maintain the same state information for this SA and will use this information to authenticate and decrypt any IPsec datagram that arrives from the SA

so I have three questions:

1. How does an SA get established between two routers? how can router R2 magically know the state information originates in R1?diddon't they need something like TCP connection to communicate?

2. Do routers need to be pre-configured to provided VPN services? There is some commercial company provides VPN services, do these companies own these routers, therefore, they can configure the router to maintain state information?

3. If a hacker captures a datagram between R1 and R2, the hacker can only know this datagram is from a router's interface(e.g 200.168.1.100) not the original host (e.g 172.16.1) which generated the datagram. is it correct?

Answer 1

1. Yes, access list is created to determine the interesting traffic. If there is match, then it goes through phases to establish VPN session between peers. Only after the VPN connection is established, the traffic passes through.
2. Yes, routers need to be pre-configured to have same policy, pre shared key(or certificate) for remote peers, mirrored local and remote networks pointing to each other.(172.16.1.0/24 <-> 172.16.2.0/24)
3. Yes, if the VPN connection uses the tunnel mode then originating IP addresses are encrypted as well, the default for site-to-site VPNs