IKE Protocol have 2 modes, that modes have different structure. Does IKEv2 protocol have two modes like IKE.
1 Answers
No, IKEv2 has nothing analogous to 'main mode' and 'aggressive mode', and they eliminated the initial 'quick mode',
When IKEv1 was originally written, they wanted a strong separation between IKE and IPsec; they had a vision where IKE might be used for things other than IPsec (other "Domains of Interpretation"). So, they completely isolated the "negotiate IKE SAs" and "negotiate IPsec SAs" into two separate series of exchanges.
In addition, they weren't sure if it would be better to minimize the number of round trip messages, or to provide identity protection; hence they designed two different modes (which would allow implementers to select the trade-off).
When they designed IKEv2, they rethought both these options. They realized that no one really used IKE for anything other than IPsec, and that forcing implementers to support different options was the Wrong Thing. Hence, they tried to combine the IKE SA and initial IPsec SA negotiation into a single set of exchanges (reducing the number of round trips, hence getting most of the benefit of "aggressive mode"), while retaining the identity protection (and DoS resistance) of main mode.
- 1,073
- 9
- 20
- 154,064
- 12
- 239
- 382