Configuring IPsec Dynamic Security Associations

Dynamic SAs require you to configure the IKE protocol, which manages the negotiation and exchange of encryption keys. Configuring a dynamic SA involves setting up an IKE IPsec tunnel, which can be activated either on completion of the configuration or when the traffic flow starts. To establish an IKE IPsec tunnel, two phases of negotiation are required:

• In Phase 1, the participants establish a secure channel to negotiate the IPsec SAs.
• In Phase 2, the participants negotiate the IPsec SAs for encrypting and authenticating the exchanges of user data.

To configure an IPsec dynamic SA, you must complete the following tasks in the Services Routers at both tunnel endpoints:

• Configuring an IKE Proposal
• Configuring an IKE Policy
• Configuring an IPsec Proposal
• Configuring an IPsec Policy
• Configuring IPsec Rules
• Configuring IPsec Services Interfaces
• Configuring Service Sets