thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Advanced

Internet Key Exchange (IKE)

Protocol that negotiates IPsec security associations and keys, using UDP 500 and UDP 4500 for NAT traversal.

Definition

IKEv2 (RFC 7296) authenticates peers with certificates, pre-shared keys, or EAP and performs Diffie-Hellman key exchange. IKEv1 used Phase 1 (ISAKMP SA, main or aggressive mode) and Phase 2 (quick mode). IKEv2 is simpler, more efficient, and supports MOBIKE for mobile clients.

Example

show crypto ikev2 sa on a Cisco router displays established IKEv2 security associations.

Exam tip

IKE Phase 1 builds the management tunnel; Phase 2 builds IPsec SAs. Aggressive mode in IKEv1 exposes identity.

Related terms