• Performs the mutual authentication of two IKE endpoints.
• Configures settings like IP/mask, DNS, and so on.
• Sets up the piggyback of a child SA. Negotiates IP flow and security settings for the IPsec SA.”
It also says:
“By default, a piggyback child (IPsec) SA is negotiated along with the IKEv2 SA during IKE_AUTH. If additional IPsec SAs are needed … they are negotiated during subsequent CREATE_CHILD_SA exchanges.”
Why the other options are wrong:
A. IKE_SA_INIT is incorrect because this exchange negotiates the security settings to protect the IKE traffic, not the first CHILD_SA.
B. INFORMATIONAL is incorrect because it is used to convey control messages between IKE endpoints.
C. CREATE_CHILD_SA is incorrect for the first CHILD_SA, because it is used to create new additional child SAs or rekey existing ones after the initial exchange.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit