H12-721 Exam Dumps : HCNP-Security-CISN (Huawei Certified Network Professional - Constructing Infrastructure of Security Network)

Note: RD: indicates that this SA has been successfully established; ST: indicates that this end is the channel negotiation initiator; RL: indicates that this channel has been replaced by a new channel, and will be deleted after a period of time; FD: indicates that this channel has been established. A soft timeout has occurred and is still in use. It will be deleted during a hard timeout. TO: indicates that the SA has not received a keepalive message after the last keepalive timeout. If the next keepalive timeout occurs, it will not be received. To the keepalive message, this SA will be deleted.

Note: To establish a pair of IPSec, IKE V1 needs to go through two phases: "main mode + fast mode" or "barbaric mode + fast mode". The former needs to exchange at least 9 messages, and the latter requires at least 6 messages. In IKE V2, an IKE SA and a pair of IPSecs can be completed by using a total of four messages in two exchanges. If the required IPSec SA is greater than 1 pair, the first pair of SAs only needs to add 1 additional exchange, that is, 2 messages can be completed. This is much easier than IKE V1. IKE V2 defines three types of exchanges: initial exchange, creation of SA exchange, and notification exchange.