Understanding IPsec SA (Security Association) Establishment
# IPsec (IP Security) provides encrypted communication over IP networks.# Security Associations (SAs) define encryption, authentication, and key parameters for IPsec tunnels.
Two IPsec SA Modes:
1## Manual Mode:
* All parameters (keys, encryption methods, authentication settings) must be manually configured.
* Keys do not change automatically, making it less secure.
2## IKE (Internet Key Exchange) Auto-Negotiation Mode:
* Uses IKE Phase 1 and Phase 2 to automatically negotiate, generate, and exchange keys.
* Keys are periodically refreshed, increasing security.
* Uses Diffie-Hellman (DH) key exchange for secure key generation.
Why is Answer D Incorrect?
# D. SAs established in both manual and IKE auto-negotiation modes can be dynamically updated.
* Incorrect: In manual mode, the IPsec SA is static and does not support dynamic updates.
* Correct behavior: Only IKE auto-negotiation mode supports dynamic re-keying and SA updates.
# Reference: Huawei HCIE-Datacom Guide - IPsec SA Modes and IKE Negotiation