We've seen that SAs define the keys, but how are those keys agreed upon without sending them in cleartext? This is the job of IKE (Internet Key Exchange). IKE is essentially 'TLS for IPsec'—it's the handshake that sets up the secure tunnel before the actual data (ESP) starts flowing.
IKEv1 works in two distinct phases. Phase 1 creates a secure, authenticated channel (the ISAKMP SA) that is used only for management traffic. This phase has two modes: **Main Mode** (6 packets, more secure, hides identities) and **Aggressive Mode** (3 packets, faster, but leaks the identity of the peers in cleartext).
⚠️ Aggressive Mode is a critical vulnerability. Because it sends the hashed pre-shared key (PSK) in the clear, an attacker can capture the handshake and crack the PSK offline using tools like `ike-scan` and Hashcat.
In the output above, the `-A` flag tells `ike-scan` to attempt an Aggressive Mode handshake. If the server responds, the attacker now has the hash of the PSK and can begin a brute-force attack.
Once the management tunnel is secure, IKEv1 Phase 2 (Quick Mode) negotiates the actual SAs that will be used to encrypt the user data. Phase 2 happens *inside* the protection of Phase 1. If Phase 1 is compromised, Phase 2 is also at risk.
💡 Think of Phase 1 as the 'Secure Meeting Room' where the two admins agree on the rules for the 'Secure Pipeline' (Phase 2).
| Feature | IKEv1 Main Mode | IKEv1 Aggressive Mode | IKEv2 |
|---|---|---|---|
| RTTs | 3 Round Trips | 1.5 Round Trips | 2 Round Trips |
| Identity Protection | Yes | No (Cleartext) | Yes |
| Handshake Complexity | High (Two Phases) | High (Two Phases) | Low (Single Exchange) |
| Security | Secure | Vulnerable (PSK Leak) | Modern/Secure |
IKEv2 is a complete redesign. It combines the two phases into a single exchange, significantly reducing latency. It also adds native support for Mobility and Multihoming (MOBIKE), allowing a VPN connection to stay alive even if the user's IP address changes (e.g., switching from Wi-Fi to 4G).
Even with IKEv2, if you use a weak Pre-Shared Key (PSK) like 'Company123', the entire tunnel is vulnerable to dictionary attacks.
Verify exercises to earn ★ 170 XP and unlock next lab level.