Understanding IKEv2

Internet Key Exchange (IKE) is a key protocol within the Internet Protocol security (IPsec) protocol suite. IKEv1 can be used to set up SAs that enable secure, encrypted communications over a VPN connection. To do this, IKE uses a Diffie-Hellman key exchange to set up a shared session secret from which cryptographic keys are then derived. Public or pre-shared keys can then be used to mutually authenticate the endpoints of the VPN connection. IKEv1 is supported on Windows Vista, Windows Server 2003, and earlier versions of Windows.

IKEv2 is a newer version of IKE that is supported on Windows 7 and Windows Server 2008 R2. IKEv2 includes a number of improvements over IKEv1, including the following:

• A simplified initial exchange of messages that reduces latency and increases connection establishment speed
• Improved reliability through the use of sequence numbers, acknowledgements, and error correction
• Support for Extensible Authentication Protocol (EAP) as a method for authenticating VPN endpoints
• Backward compatibility with the ports used by IKEv1 to ensure Network Address Translation (NAT) traversal
• VPN mobility support using the MOBIKE extension
• Support for the IPv6 protocol
• Other features that provide improved speed, security, and ease of configuration when compared with IKEv1

Support for IKEv2 as a VPN tunneling protocol is new in Windows 7 and Windows Server 2008 R2, and IKEv2 is a key enabler of the new VPN Reconnect feature of these platforms. For more information on VPN Reconnect, see the section titled "Understanding VPN Reconnect" later in this tutorial.

More Info For more information concerning IKEv2, see RFC 4306 at http://www.ietf.org/rfc/rfc4306.txt.