Forgot password?
 Register now

Welcome to use this form to feedback your problems with Ruijie Community

The category of your feedback

Your Feedback

Your Email address (optional):

What is difference between Ipsec VPN main mode and aggressive mode? Reply

GTAC-Sophia

Level 4

Ruijie Staff

What is difference between Ipsec VPN main mode and aggressive mode?
1044 0 2023-1-30 17:01:34
Original
The differences between Ipsec VPN main mode and aggressive mode:
IKE negotiation phase 1: negotiates the isakmp sa, which is used to encrypt and protect the ipsec sa in phase 2. There are 2 mode types in the first phase: (default main mode)
(1) Main Mode: 6 isakmp packets were generated.
The first and second packets: select the authentication algorithm, encryption algorithm, and authentication algorithm for generating isakmp sa
The third and fourth packets: negotiation and exchange key - DH exchange
The fifth and sixth packets: authenticate the identities of both parties through the authentication key
(2) Aggressive Mode: 3 isakmp packets are generated.
The first and second packets: searches for the local authentication key based on the ID by receiving the peer party
The third packet: indicates that the sa intiatorinitiates identity authentication
Differences between the two ipsec modes:
1. Aggressive mode negotiation is faster than main mode negotiation.
The main mode requires six messages to be exchanged, while the aggressive mode requires only three messages to be exchanged.
2. The main mode negotiation is more rigorous and secure than the aggressive mode negotiation.
The main mode encrypts the ID information in the fifth or sixth messages. While in aggressive mode, the ID information is sent to the peer side in first or second messages in plain text because the number of exchanges is limited. That is, the main mode protects the identity of the peer, while the aggressive mode does not.
3. The two modes use different methods to determine the pre-shared key.
The main mode determines the pre-shared key only based on the IP address. The aggressive mode determines the pre-shared key based on ID information (host name or IP address). If the IP addresses of both sides are not fixed (for example, ADSL dial-up), you can use the aggressive mode.
RG-EG105G-P

Technical Introduction Router
There are no replies.
Releated Posts
Product Model

Share this topic to

Cancel

This site contains user submitted content, comments and opinions and is for informational purposes only. Ruijie may provide or recommend responses as a possible solution based on the information provided; every potential issue may involve several factors not detailed in the conversations captured in an electronic forum and Ruijie can therefore provide no guarantee as to the efficacy of any proposed solutions on the community forums. Ruijie disclaims any and all liability for the acts, omissions and conduct of any third parties in connection with or related to your use of the site. All postings and use of the content on this site are subject to the Ruijie Community Terms of Use.

More ways to get help: Visit Support Videos, call us via Service Hotline, Facebook or Live Chat.

©2000-2023 Ruijie Networks Co,Ltd