Question regarding IPSEC

[Efraim]

Hello,

I read this explanation about IPSEC and I have two questions :)

First: if we using Aggressive Mode in phase 2, a potential hacker will see who formed the IPSEC SA. How critical is it? 

Second: I know that in IPSEC there are 2 tunnel types - Tunnel Mode (default mode) and Transport mode. Can I say that it is part of IKE phase 1 > Encryption? or does it belong to IKE phase 2? In none of the explanation about IKE phase 1 & 2 I couldn't find any information about that.

Thank you! 

[Rob Ingram]

Hi,
The IKE SA is very important. Aggressive mode is rarely used, only in legacy remote access VPNs. If using IKEv1 then Main Mode would likely be used. Aggressive mode can be disabled on the ASA/router. You can use IKEv2 instead of IKEv1, which is more secure and does not use aggressive mode or main mode.

The tunnel types are part of the IPSec SA (Phase 2). For example, on a Cisco IOS Router the tunnel mode is defined under the IPSec transform set, which is used to define the encryption/hashing algorithms used for the IPSec SA.

HTH