IKEv1 vs IKEv2

[bravealikhan]

Hi,

In a company where only IKEv2 is configured to form an IPSec tunnel, Pentest Test Tool (Cisco_IKE_Benigncertain scan) gave a positive response on "x.x.x.x:500 IKE Response Leak".

Question1:

in this senario: what will happen when a Responder Router recevie a SA-Proposal of IKEv1? 

my understanding is: since IKEv1 is not configured on responder router, IKEv1's proposal will be rejcted and router will send an ICMP unreachable message back to IKEv1 Requester on UDP port 500.

Cisco_IKE_Benigncertain scan: is False Positive.

Question2:

Is there any Cisco newer IOS version which doesn't support IKEv1 / ISAKMP completely? or the config of IKEv1 remains in the IOS but it is up to use Crypto ISAKMP or Crypto IKEv2 on newer IOS ?

Thank you

[M02@rt37 · Accepted solution]

Hello @bravealikhan 

If the responder router is configured only with IKEv2, it will reject or ignore any IKEv1 SA proposals it receives. Since IKEv1 is not configured, the router will not negotiate an IKev1 tunnel. However, the routeur may respond with a notification message or simply ignore the request, depending on the platform... The router will not necessarily send an ICMP unreachable message, because UDP port 500 is still open for IKEv2 communication. Instead, it may just reject the IKEv1 proposal and close the session.

Cisco has not completely removed IKEv1 support from standard IOS versions, but in IOS XE and IOS XR, IKEv2 is the preferred protocol, and IKEv1 is disabled by default unless explicitly configured. Certain modern Cisco platforms have completely removed IKEv1 support, requiring the use of IKEv2.