Welcome back to the course.
In the previous module,
we talked all about IKEv1 and how it's used in our environments.
We also detailed how it works and looked at its operations from a
packet level for each of the modes available.
In this module,
we're going to continue on that conversation about IKE
and discuss the current version, IKE version 2.
Throughout this module,
we're going to be discussing several concepts with regards to IKE version 2.
First,
we'll detail the differences between IKE version 1 and IKE version 2
and talk about some of the benefits of version 2.
Then we're going to talk about the IKEv2 modes,
as well as discuss the different authentication methods that are possible.
After that,
well cover the components of IKEv2 and how they represent
the phases like we talked about in IKEv1.
We have a demo here where we can see IKEv2 in action as well.
Finally, we'll summarize what we discussed and move on into the next module.
IKE version 2 became an internet standard in 2014 when RFC 7296 was released.
It effectively made version 1 obsolete,
despite its huge user base that's still present today.
This version builds upon the previously established IKE version 1
functionality and supporting protocols and adds several enhancements
to them that we'll talk out in a minute.
IKE version 1 does have some very specific changes to the
functionality and the overall communication structure though,
and we'll cover those later on in the module too.
Most modern VPN providers and enterprise environments have
the ability to use IKEv2 in their VPNs,
and it's recommended to use it over IKEv1 unless there's a very
specific use case preventing you from doing so.
So let's compare IKEv1 and IKEv2 here for a second.
One of the major revisions to the protocol standard is the
inclusion of Extensible Authentication Protocol,
or EAP, to the authentication mechanism list.
It's very useful in environments today and benefits
organizations with its flexibility.
IKEv2 allows for something called MOBIKE,
or IKEv2 Mobility and Multihoming protocol,
which gives us the ability to change IP addresses without needing to
re-establish the SAs that were previously established.
We also gain the ability to have high availability in our
environments with IKEv2 and a more comprehensive set of traffic
selectors to determine the SA establishment.
IKEv2 also gives us a faster negotiation than IKEv1 due to its
streamlined phases and modes of operation,
which we'll discuss shortly.
Let's take a moment to talk about some of these benefits of IKEv2 in a little more detail.