I'm a newbie in networking, still struggling to understand some concepts. I was reading a text describes security association (SA) in VPN.
Whenever router R1 needs to construct an IPsec datagram for forwarding over this SA, it accesses this state information to determine how it should authenticate and encrypt the datagram. Similarly, router R2 will maintain the same state information for this SA and will use this information to authenticate and decrypt any IPsec datagram that arrives from the SA
so I have three questions:
How does an SA get established between two routers? how can router R2 magically know the state information originates in R1?diddon't they need something like TCP connection to communicate?
Do routers need to be pre-configured to provided VPN services? There is some commercial company provides VPN services, do these companies own these routers, therefore, they can configure the router to maintain state information?
If a hacker captures a datagram between R1 and R2, the hacker can only know this datagram is from a router's interface(e.g 18.104.22.168) not the original host (e.g 172.16.1) which generated the datagram. is it correct?