IKEv2 Responder Only Mode

[fadisakkal]

Hello,

I built a handful of VPN for a company using this guide: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/212478-configure-asa-virtual-tunnel-interfaces.html 

in the IPsec profile section (2nd point) it mentions that one side needs to be in responder-only mode.

in my case I want any side to be able to initiate the tunnel. is there any reason for this specific command or I can simply drop it? 

Thanks in advance :)

[ngkin2010]

Hello,

It's not a strict IKE requirement that you may ignore it. However, defining the IKE responder and initiator may receive a little benefit that reduce the chance of 'duplicated' IKE SA created. 

Cisco has mentioned that IKE have no mechanism to check if the IKE negotiations is already exist or not, therefore, bi-directional negotiation may create duplicated IKE SA. It may consume unnecessary computing resource on both of the VPN devices. 

Reference: https://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_ikevpn/configuration/15-1mt/IKE_Responder-Only_Mode.html#GUID-ED78BA57-218F-490A-A795-903C09945D4B  (#Benefits of the IKE Responder-Only Mode Feature)