Now it's time to get into the deployment modes that are available for IKEv2
and discuss how they're different than IKEv1's modes,
which were main mode, aggressive mode, and quick mode.
Let's jump into this content and see what IKEv2 offers us.
We're going to start talking about IKEv2 and its
modes that we have available to us.
First, we're going to talk about IKEv2's IKE_SA_INIT exchange.
Notice how I didn't mention an official mode name.
Well,
this is because IKEv2 doesn't really break down
everything into modes like IKEv1 did.
There's no more main, aggressive, and quick mode when establishing the IPsec SAs.
It's just the SA_INIT and IKE_AUTH exchanges.
These two exchanges work together similar to how main or
aggressive mode and quick mode work together in version 1 to
create our SAs and secure our connections.
Let's explore the SA_INIT exchange really quickly.
During this exchange,
similar things happen than in IKEv1 main or aggressive mode.
The proposals are set, in this case six different ones.
The proposals go over the algorithms and parameters that the two ends must the
agree on to properly initiate the SAs that are being set up.
The NAT detection and IKEv2 fragmentation payloads are sent as well.
During this exchange,
the keying material is exchanged as well so that the SAs can be
set up to securely build the phase 2 SAs.
Comparing this to main mode,
this exchange of two packets takes the place of the
main mode first two exchanges.
So the second mode is that IKE_AUTH exchange.
Not really a mode, but just an exchange.
This is where our IPsec SAs are established,
similar to quick mode in the IKEv1 process.
Remember, all these IKEv2 exchanges happen in pairs,
so the reliability factor is in place here.
This second set of messages is encrypted and authenticated over that
parent SA that I created for us in the first exchange.
These establish the first child SA,
authenticate the peers via the methods configured,
and validate the identities of them. By the end of this exchange, everything is ready to go and set up for IPsec.