| 14.3 |  | Task 1 - Prepare to Configure VPN Support |
| 14.3.1 |  | Step 1 - plan for IKE |

| An IKE policy defines a combination of security parameters to be used during the IKE negotiation. The administrator should determine the IKE policy, and then configure it. Planning for IKE includes the following:

- Determine IKE phase one policies for peers. An IKE policy defines a combination of security parameters to be used during the IKE negotiation. Each IKE negotiation begins by each peer agreeing on a common, or shared IKE policy. The IKE policy suites must be determined before configuration.
- Determine key distribution methods based on the numbers and locations of IPSec peers. To support IPSec peer scalability, a CA server may be the best option. For smaller VPN implementations, manual key entry can be appropriate. With either selection, IKE must be correctly configured to support the selected key distribution method.
- Identify IPSec peer router IP addresses or hostnames. The identity of the remote peer must be configured on the local device in order for correct IPSec peering.

The goal of advance planning is to minimize misconfiguration.