I know that IKEv2 is getting popular but still IKEv1 has a huge presence in production networks. There are many reasons but I’m not going to focus on them. I would rather focus on one issue I see from time to time: ikev1 and an aggressive mode. Just to remind you, there are two modes of ikev1: aggressive and main. The first one is much faster, only three messages are exchanged, but it isn’t secure as the main mode (with six messages). The main problem with the aggressive mode is the first two messages contain data which may help to perform attack on your VPN. For this test I set up VPN on ASA with ‘aggressive mode’ enabled: ciscoasa# sh run crypto crypto ipsec ikev1 transform-set TS esp-3des esp-md5-hmac crypto map MAPA 10 match address ACL crypto map MAPA 10 set peer 192.168.111.128 crypto map MAPA 10 set ikev1 transform-set TS crypto map MAPA interface inside crypto ikev1 enable inside crypto ikev1 policy 10 authentication pre-share encryption 3des hash md5...
