IKE (Internet Key Exchange) is a protocol used to establish a secure communication channel and define how negotiation and authentication are performed for a Security Association (SA). It is part of the IPsec protocol suite.
The IKE protocol was introduced in November 1998. Seven years later, in December 2005, its second version, IKEv2, was published. A revised and finalized specification was later published as RFC 7296, which defines the IKEv2 protocol.
How IKEv2 Differs from the First Version of IKE
The first version of IKE had several limitations. For example, if an active VPN connection switched to another network, such as from a mobile connection to Wi-Fi or vice versa, the VPN connection normally had to be re-established. This could result in a change of IP address, reduced performance, and other undesirable consequences.
IKEv2 addressed this problem with support for MOBIKE (IKEv2 Mobility and Multihoming), which allows an established VPN connection to remain active when the underlying network changes. This makes it possible to maintain the tunnel while switching between network interfaces and helps prevent interruptions and potential traffic exposure during the transition.
The second version of the protocol also introduced or improved support for technologies such as Keepalives and the Extensible Authentication Protocol (EAP). IKEv2 also uses a more streamlined exchange to establish the initial tunnel and manages Security Associations more efficiently, allowing them to be created and rekeyed more independently when necessary.
In short, IKEv2 is generally faster, more robust, and more efficient than IKEv1, while also providing better support for modern mobile and multi-network environments.
Advantages and Disadvantages of IKEv2
Advantages:
- supports strong encryption and authentication methods;
- generally provides higher performance than older VPN protocols such as PPTP and L2TP;
- maintains a stable VPN connection when switching between networks and can quickly re-establish connectivity after interruptions, reducing the risk of unprotected traffic being sent outside the VPN tunnel.
Disadvantages:
- uses UDP ports 500 and, when NAT traversal is required, UDP port 4500, which may be blocked by some firewalls or network filters;
- can be relatively complex to configure and implement on the server side, although this is generally not an issue for ordinary end users.