In IKE, what is negotiated during Phase 2?

• A. IPsec SAs are negotiated
• B. Establish a secure channel in Phase 1
• C. Phase 2 defines encryption algorithms for the VPN
• D. Phase 2 negotiates user authentication

Answer: (A)

During IKE, Phase 2 is focused on setting up the data-protection for the VPN by negotiating IPsec SAs, known as Child SAs. The secure channel established in Phase 1 (the IKE SA) is used to protect this negotiation, and in Phase 2 the peers agree on the specific parameters that will protect the traffic between them: the encryption and integrity algorithms, keys, lifetimes, and the traffic selectors for the tunnel. In short, Phase 2 defines and establishes the actual IPsec SAs that will guard the data flow, which is why this choice is the best fit. Phase 1’s job was to authenticate and create a secure control channel, not to set up the data-plane protections.