IKEv2/IPsec: How the Built-In VPN Protocol Connects, Roams and Gets Blocked

IKEv2 (Internet Key Exchange version 2) is the part of an IPsec VPN that authenticates both ends, agrees on algorithms and derives keys; IPsec ESP then encrypts every data packet. Together the pair is called IKEv2/IPsec, and it ships inside Windows, Apple devices and recent Android builds, so no separate app is needed to dial it.

Control side versus data side

The suite splits the work. IKEv2 is the control conversation: it checks identities, negotiates ciphers and produces keys. ESP (Encapsulating Security Payload) is the data path that seals every packet. IKEv2 by itself carries no user traffic at all.

The mechanics live in security associations. The IKE SA protects the management talk between client and server. Each Child SA is a pair of one-way IPsec SAs, one per direction, that moves the actual data. The protocol dates back to RFC 4306 in December 2005, was revised as RFC 5996 in 2010 and now lives in RFC 7296, an Internet Standard pushed mainly by Microsoft and Cisco. Against IKEv1, it needs four messages instead of nine to build a tunnel, and NAT traversal and liveness checks are built in rather than bolted on. The two versions do not interoperate.

Four messages to a working tunnel

The first exchange, IKE_SA_INIT, carries cipher proposals, Diffie-Hellman public values, random nonces and NAT detection hashes. A loaded server can answer with a stateless cookie and make the client repeat itself, which rejects spoofed floods before any heavy maths. IKE_AUTH follows, already encrypted: identities, proof of identity, traffic selectors and the first Child SA. After that, traffic flows.

Later, CREATE_CHILD_SA adds tunnels and rekeys old ones. When a rekey runs a fresh Diffie-Hellman exchange, old captures cannot be rebuilt from new keys, which is the whole point of perfect forward secrecy. INFORMATIONAL messages handle dead peer detection, deletions, errors and, as noted below, address updates.

Authentication comes in three flavours. Certificates are the strong route. EAP lets a user log in with a username and password while the server proves itself with a certificate. A pre-shared key handed to every user of a server is the weak spot: anyone holding it can impersonate that server.

MOBIKE: the tunnel follows your phone

Walk out of Wi-Fi range and the phone picks up a cellular IP address. Without anything extra, that breaks the security associations and the client must run the full handshake again, so apps see a drop. MOBIKE (RFC 4555, June 2006) fixes this: the client sends an UPDATE_SA_ADDRESSES notice from its new address, the server repoints the IKE SA and the IPsec SAs, and the session survives within a round trip. No new handshake, no new login. Multihoming lets a device with several addresses fall back to another one. This is why IKEv2 feels at home on phones.

Built-in clients and fixed ports

Windows, macOS, iOS, iPadOS and Android 11+ have the client in system settings: you enter a server address, remote ID and a certificate, PSK or credentials. Linux and older Android need strongSwan or Libreswan. What you lose versus a provider app is the extras: a kill switch, for instance, is what stops the leak when the tunnel dies on hotel Wi-Fi.

The exchange starts on UDP 500 and moves to UDP 4500 once NAT is detected, with ESP wrapped in UDP. Without NAT, ESP travels as IP protocol 50, which many home routers and firewalls drop. Blocking IKEv2 is trivial: the ports are fixed, the header with SPIs and exchange type goes out in the clear, and the standard has no obfuscation mode. One firewall rule dropping UDP 500 and 4500 is enough, and DPI recognises the handshake at once; the way out is a fallback such as OpenVPN over TCP 443 or a stealth protocol from the provider.

IKEv2 next to WireGuard and OpenVPN

WireGuard is leaner, uses a fixed modern cipher set and also roams well, but neither it nor IKEv2 hides from deep packet inspection. OpenVPN wins on restrictive networks where only web ports survive.

IKEv2 among VPN services

Of 543 consumer services in the VPNRadarLab database, 133 state they offer IKEv2, 105 say they do not and 305 are silent, which only means they do not publish it. The IKEv2 ranking lists all 133 with scores, prices and terms.

FAQ

What does IKEv2 mean in my phone's VPN settings?

It is the protocol type of that profile. Choose it when your provider hands you IKEv2 details.

Is IKEv2 still secure?

Yes, as long as the server offers modern cipher suites and authentication is set up properly. Outdated proposals and shared keys are what weaken it.

IKEv2 or OpenVPN?

IKEv2 on a roaming phone, OpenVPN over TCP 443 where UDP gets filtered.

Can the network tell I use IKEv2?

It sees the protocol and ports, never the contents of the tunnel.

IKEv2 in brief

A four-message key exchange plus ESP encryption, standardised in RFC 7296, built into the major operating systems and kept alive on the move by MOBIKE. Its readable header and fixed UDP ports 500 and 4500 make it simple to block, so keep a stealthier fallback for filtered networks.