Hi Jason,
Basically, the phase 1 SA is for securing the pre-shared key and phase 2 policies negotiations. First the phase 1 policies are negotiated and the channel is made secure based on the phase 1 policies like encryption and hash algorithms. The phase 1 negotiation in a Site-Site scenario happnes in Main mode. In main mode a total of six packets are exchanged, 3 from each end. These packets contain different phase 1 policies like encryption algorithm, hash algorithm, diffie hellman key size, lifetime and whether nat-t is being used or not. Once these packets have been exchanged, the channel is secure using the phase 1 encryption policy. Aftre this the pre-shared key is exchanged and the phase 1 comes up. Now the phase policies are supposed to be negotiated. This negotiation happens in a secure manner using the phase channel provided by the phase 1. Once the phase 2 policies have been negotiated, the channel is made secure using the phase 2 encryption policy. All the data flowing across then is encrypted using the phase 2 policy. Please be informed that the phase 1 and phase 2 policies can be different. Its just that those have to be same on either end.
HTH,
Please let me know if you need further information.
Please do rate if it helps.
Regards,
Kamal
