| 14.3 |  | Task 1 - Prepare to Configure VPN Support |
| 14.3.2 |  | Step 2 - determine the IKE phase one policy parameters |

| An IKE policy defines a combination of security parameters to be used during the IKE negotiation. IKE policies make up a protection suite that enables IPSec peers to establish IKE sessions and SAs. Create IKE policies for a purpose IKE negotiations must be protected, so each IKE negotiation begins with both peers agreeing on a common, shared IKE policy. This policy states which security parameters will be used to protect subsequent IKE negotiations.

After the two peers agree upon a policy, an SA established at each peer identifies the security parameters of the policy. These SAs apply to all subsequent IKE traffic during the negotiation.

The administrator can create multiple, prioritized policies at each peer to have policies that will match the policies of the various remote peers.

Define IKE policy parameters
Administrators can select specific values for each IKE parameter following the IKE standard. Select a value based on the security level that is desired and the type of IPSec peer to which the network will connect.

There are five parameters which must be defined in each IKE policy. They are Encryption Algorithm, Hash Algorithm, Authentication Method, Key Exchange, and IKE SA lifetime. They are outlined in Figure which lists the accepted values and the default values for each parameter. Figure shows the relative strength of each value.