What's the difference between IKE and ISAKMP?

Question

I've been building IPsec VPNs for years but to be honest I've never fully grasped the technical difference between IKE and ISAKMP. I often see the two terms used interchangeably (probably incorrectly).

I understand the two basic phases of IPsec and that ISAKMP seems to deal primarily with phase one. For instance, the IOS command "show crypto isakmp sa" displays IPsec phase one information. But there's no equivalent command for IKE.

Craig Constantine · Accepted Answer

ISAKMP is part of IKE. (IKE has ISAKMP, SKEME and OAKLEY). IKE establishs the shared security policy and authenticated keys. ISAKMP is the protocol that specifies the mechanics of the key exchange.

The confusion, (for me,) is that in the Cisco IOS ISAKMP/IKE are used to refer to the same thing. By which I mean, my understanding is that Cisco's IKE only implements/uses ISAKMP. So one configures IKE, and then conceptually inside that, one configures ISAKMP.

Jim Forristal · Answer

Internet Security Association Key Management Protocol (ISAKMP) is a framework for authentication and key exchange between two peers to establish, modify, and tear down SAs. It is designed to support many different kinds of key exchanges. ISAKMP uses UDP port 500 for communication between peers.
IKE is the implementation of ISAKMP using the Oakley and Skeme key exchange techniques. Oakley provides perfect forward secrecy (PFS) for keys, identity protection, and authentication; Skeme provides anonymity, repudiability, and quick key refreshment. For Cisco platforms, IKE is analogous to ISAKMP, and the two terms are used interchangeably.  This confused me for years as well!
Short answer: ISAKMP = IKE, in Cisco-speak.

Ronnie Royston · Answer

Practically speaking - IKE, Internet Key Exchange (IKE), is synonymous with Internet Security Association Key Management Protocol (ISAKMP).

Feroze K.M · Answer

Please check whether this helps, I know that I am late :)

Yes, this is from the Wikipedia article, Internet Security Association and Key Management Protocol, but I didn't see any references so far to Wiki/RFC here in discussion.

ISAKMP defines the procedures for authenticating a communicating peer,
  creation and management of Security Associations, key generation
  techniques and threat mitigation (e.g. denial of service and replay
  attacks). As a framework, ISAKMP is typically utilized by IKE for key
  exchange, although other methods have been implemented such as
  Kerberized Internet Negotiation of Keys. A Preliminary SA is formed
  using this protocol; later a fresh keying is done.
  
  ISAKMP defines procedures and packet formats to establish, negotiate,
  modify and delete Security Associations. SAs contain all the
  information required for execution of various network security
  services, such as the IP layer services (such as header authentication
  and payload encapsulation), transport or application layer services or
  self-protection of negotiation traffic. ISAKMP defines payloads for
  exchanging key generation and authentication data. These formats
  provide a consistent framework for transferring key and authentication
  data which is independent of the key generation technique, encryption
  algorithm and authentication mechanism.
  
  ISAKMP is distinct from key exchange protocols in order to cleanly
  separate the details of security association management (and key
  management) from the details of key exchange. There may be many
  different key exchange protocols, each with different security
  properties. However, a common framework is required for agreeing to
  the format of SA attributes and for negotiating, modifying and
  deleting SAs. ISAKMP serves as this common framework.
  
  ISAKMP can be implemented over any transport protocol. All
  implementations must include send and receive capability for ISAKMP
  using UDP on port 500.

What's the difference between IKE and ISAKMP?

4 Answers

Add your own answers!

Ask a Question