TechClick

Phase 1: IKE Negotiation

Internet Key Exchange (IKE) establishes a secure authenticated communication channel between peers. It negotiates parameters like Encryption (AES), Hash (SHA), and Diffie-Hellman Group to create a bidirectional security association (IKE SA).

Phase 2: IPsec Tunnel

Using the secure channel from Phase 1, IPsec negotiates the encryption and authentication for the actual data traffic. This creates two unidirectional Security Associations (IPsec SAs) for inbound and outbound traffic.

Routing & Policies

Tunnel Interface: A logical interface that handles encapsulation/decapsulation.
Static Routes: Directs traffic destined for the remote LAN (10.2.0.0/24) into the tunnel interface.
Security Policy: Explicitly allows traffic to pass between the Trust zone (LAN) and the VPN zone (Tunnel).