| 14.4 |  | Task 2 - Configure IKE Parameters |
| 14.4.2 |  | Step 2 - Configure an IKE Phase 1 Policy |

| The second major step in configuring ISAKMP support is to define a suite of ISAKMP policies. Use the isakmp policy priority command to define an IKE policy. IKE policies define a set of parameters used during the IKE negotiation so that peering between IPSec endpoints is possible.

When the ISAKMP negotiation begins in IKE phase one main mode, ISAKMP looks for an ISAKMP policy that is the same on both peers. The peer that initiates the negotiation sends all its policies to the remote peer. The remote peer then tries to find a match with its policies. The remote peer looks for a match by comparing its own highest priority policy against the policies in its ISAKMP policy suite that it receives from the other peers. Beginning with the highest priority, the remote peer checks each policy until a match is found.

A match is made when both policies from the two peers contain the same encryption, hash, authentication, and Diffie-Hellman parameter values, and when the policy of the remote peer specifies a lifetime less than or equal to the lifetime in the policy being compared. If the lifetimes are not identical, the shorter lifetime from the policy of the remote peer is used. Assign the most secure policy the lowest priority number so that the most secure policy will find a match before any less secure policies are configured.

If no acceptable match is found, ISAKMP refuses negotiation and IPSec is not established. If a match is found, ISAKMP completes the main mode negotiation, and IPSec SAs are created during the IKE phase two quick mode.