IPSEC Main Mode with PSK

[Paul Masterton]

Hi all,

I think a quick question for you...

Am I right in thinking I can run IPSEC in main mode if I know the IP address of all my L2L VPN end points? (They all have static IPs) I can disable aggressive mode in IOS in this scenario?

I would only need aggressive mode if I wanted PSK and remote access type VPNs on the same router because the client addresses will no be dynamic?

Thanks!

P

[Javier Portuguez]

Hi P,

Yes if you are connecting IPsec clients with PSK then Aggresive mode needs to be enabled.

Thanks.

Portu.

[Andrew Phirsov]

Am I right in thinking I can run IPSEC in main mode if I know the IP  address of all my L2L VPN end points? (They all have static IPs) I can  disable aggressive mode in IOS in this scenario?

That's right as long as devices ip addresses are used as peers IKE IDs. I mean if you have static ip addresses but use FQDNs as IKE IDs the tunnel won't establish. So with PSK and FQDN as peer identities even in site-to-site VPN you'd have to use aggressive mode too.

[Javier Portuguez]

Nice Andrew