Title: What is difference between Ipsec VPN main mode and aggressive mode? [Print this page] Author: GTAC-Sophia Time: 2023-1-30 17:01 Title: What is difference between Ipsec VPN main mode and aggressive mode? The differences between Ipsec VPN main mode and aggressive modeļ¼
IKE negotiation phase 1: negotiates the isakmp sa, which is used to encrypt and protect the ipsec sa in phase 2. There are 2 mode types in the first phase: (default main mode)
(1) Main Mode: 6 isakmp packets were generated.
The first and second packets: select the authentication algorithm, encryption algorithm, and authentication algorithm for generating isakmp sa
The third and fourth packets: negotiation and exchange key - DH exchange
The fifth and sixth packets: authenticate the identities of both parties through the authentication key
(2) Aggressive Mode: 3 isakmp packets are generated.
The first and second packets: searches for the local authentication key based on the ID by receiving the peer party
The third packet: indicates that the sa intiatorinitiates identity authentication Differences between the two ipsec modes:
1. Aggressive mode negotiation is faster than main mode negotiation.
The main mode requires six messages to be exchanged, while the aggressive mode requires only three messages to be exchanged.
2. The main mode negotiation is more rigorous and secure than the aggressive mode negotiation.
The main mode encrypts the ID information in the fifth or sixth messages. While in aggressive mode, the ID information is sent to the peer side in first or second messages in plain text because the number of exchanges is limited. That is, the main mode protects the identity of the peer, while the aggressive mode does not.
3. The two modes use different methods to determine the pre-shared key.
The main mode determines the pre-shared key only based on the IP address. The aggressive mode determines the pre-shared key based on ID information (host name or IP address). If the IP addresses of both sides are not fixed (for example, ADSL dial-up), you can use the aggressive mode.
Welcome to Ruijie Community (https://community.ruijienetworks.com/)