Virtual vpn in the cloud

Ikelifetime and lifetime:
These parameters indicate the period after which the 
keying channel of connection and particular instance of a connection i.e., a set of 
encryption and authentication keys is to be renegotiated respectively.
•
Authby
: This option denotes the key distribution mechanism used to authenticate 
the peer-to-peer gateways. 
Authby = secret/psk
can be used to denote pre-shared 
keying.
 
•
Keyexchange
: The protocol used for 
keyexchange=ikev2
to initialize the connection 
due to ikev2’s support and enhanced functionalities. 
•
Dead peer detection: 
The 
dpdaction
, 
dpdtimeout
and 
dpddelay
options are specified 
to detect activity 
 
4.3.2
 
Validation and verification of tunnel authenticity 
Detailed description on the communication and tunnel establishment by various 
parameters is mentioned in [29]. Following commands are executed to validate the 
establish the tunnel and verify its authenticity: 
 
•
sudo ipsec up  
 

---

24 
Figure 9: Security associations across tenant 1 and 2 
 
Figure 10: Security associations across tenant 2 and 1 
Figures 9 and 10 display the Security Association built across both the peer gateways 
where 
No
denotes Nonce, 
KE
stands for Key Exchange, 
TSi
and 
TSr
for Traffic Selector 
Initiator and Traffic Selector Responder respectively. Sending a 
CREATE_CHILD_SA
request creates a 
CHILD_SA
. The initiating peer sends SA request in 
SA
paylod, a nonce, 
a Diffie-Hellman value in 
KE
payload and the proposed traffic selectors in the 
TSi
and 
TSr
payloads. Now, the responding peer accepts the 
SA
in the 
SA
payload, a nonce value 
in KE payload and traffic selectors in the 
TSi
and 
TSr
payloads. 
•