DataProt is supported by its audience. When you buy through links on our site, we may earn a commission. This, however, does not influence the evaluations in our reviews. Learn More.
×
Affiliate Disclosure
DataProt is an independent review site dedicated to providing accurate information about various cybersecurity products.
DataProt remains financially sustainable by participating in a series of affiliate partnerships - it is visitors’ clicks on links that cover the expenses of running this site. Our website also includes reviews of products or services for which we do not receive monetary compensation.
DataProt's in-house writing team writes all the site’s content after in-depth research, and advertisers have no control over the personal opinions expressed by team members, whose job is to stay faithful to the truth and remain objective.
Some pages may include user-generated content in the comment section. The opinions expressed in the comment section do not reflect those of DataProt.
If you’ve recently joined the growing pool of VPN users, you’re probably familiar with IKEv2 as one of several protocols typically offered by VPN service providers. When used with IPSec, IKEv2 is an excellent solution for the online smartphone experience.
We will break down how the protocol works, its benefits, and its downsides and give you a list of recommended VPN providers that are ideal for those who wish to use it.
What Is IKEv2?
IKEv2 (Internet Key Exchange version 2) is a protocol used to establish a security association or SA attribute between two network entities and secure communications. It’s used along with IPSec, which serves as an authentication suite, and that’s why it’s referred to as IKEv2/IPSec with most VPN providers.
Microsoft and Cisco developed IKEv2, and it’s well known for being more stable, secure, and easier to set up than some of the alternatives. It’s also known as one of the faster protocols in use by major VPN companies.
How IKEv2 Works
The IKEv2 protocol creates a communication tunnel that secures the connection between the user and the VPN server. Its role is to authenticate both parties, and it accomplishes this with the aforementioned SA attribute.
In layman’s terms, SA is a method of establishing security parameters between two entities on the network, and it accomplishes this by creating a symmetric encryption key for them. The information transferred between the client and server is encrypted and decrypted using these keys.
The integration between IKEv2 and IPSec is one of the main reasons why this is a fast VPN protocol. IKEv2 is executed in user space, while IPSec is a kernel operation, meaning that it operates on a core level while allowing faster data processing as it has direct access to CPU, memory, and other hardware devices. As they work in tandem, IKEv2 sends data packets and establishes the security association with the server, and IPSec uses it to encrypt the traffic.
IKEv1 vs. IKEv2
Internet Key Exchange version 2 is a second iteration of the protocol that was first developed in 1998. It has many advantages over its predecessor that make IKEv1 obsolete:
- IKEv2 requires fewer messages to be exchanged between secure tunnel endpoints to establish a secure connection.
- IKEv1 doesn’t support NAT traversal.
- Extensible Authentication Protocol or EAP is supported with IKEv2.
- Since IKEv2 supports Mobility and Multi-homing Protocol or MOBIKE, it can maintain a stable internet connection even if the client switches IP addresses. There is no need to reconnect the VPN, therefore, eliminating the risk of data leaks.
- IKEv1 required more security associations to establish a VPN tunnel which significantly reduced bandwidth.
- IKEv1 supports fewer encryption algorithms than IKEv2
- IKE version 2 is resistant to denial-of-service attacks. Unlike IKEv1, prior to processing network requests, it verifies that the requester actually exists.
- All messaging types with IKEv2 are defined as request and response pairs, improving the protocol’s reliability.
- Asymmetric authentication is implemented in IKEv2.
IKEv2 Advantages
Internet Key Exchange version 2 has comprehensive security features. Mainly, IKEv2 encryption supports many different algorithms, including Blowfish, Camellia, and AES 256-bit, which most VPN providers use.
Certificate-based authentication is great for disrupting man-in-the-middle and denial-of-service attacks, as the protocol refuses any calls to action unless it verifies the requestor’s identity.
Bandwidth reduction should be expected with most VPN protocols. This is caused by layers of security that tie up connection and system resources. With IKEv2/IPSec, there is significantly less reduction in speed, making it a perfect VPN protocol for torrenting and streaming.
The VPN protocol natively supports macOS and Windows. It can be set up on Linux servers, and it can connect to clients using Windows, macOS, Linux, iOS, and Android.
Since it supports MOBIKE, it’s convenient for mobile phone use. With devices switching from network data to local WiFi, you could be exposed to potential data leaks at the moment the IP changes. Thankfully, with IKEv2, these IP and network transitions are seamless, and there are no gaps in the VPN protocol security.
Finding an IKEv2 VPN server is easy, as most VPN providers that we recommend include it in their offer.
IKEv2 port of choice is UDP 500. Essentially, this reduces the latency that this VPN causes, enabling a more optimized experience for network-intensive applications.
IKEv2 Disadvantages
One of the main differences between IKEv2, OpenVPN, WireGuard, and other protocols is that IKEv2 VPN isn’t open-source but developed in-house by Microsoft and Oracle. This means that the code isn’t subject to peer review.
Since Internet Key Exchange version 2 only uses UDP 500 port, firewalls or network administrators can easily block it.
Another vulnerability is a weak password. IKEv2 hashes the password you entered and checks if it’s the same as the stored hash value. The less complicated your password is, the easier it becomes to crack it.
IKEv2 Comparison With Other VPN Protocols
IKEv2 is always used in tandem with IPSec by VPN services because it’s built within the latter. As such, when making the comparison with other security protocols, we always look at both technologies.
IKEv2 vs. L2TP/IPSec
L2TP is another protocol paired with IPSec. The main concern about L2PT/IPSec stems from revelations by former NSA contractor Edward Snowden who said the protocol had been compromised by the intelligence services.
Furthermore, IKEv2 speed is considerably better as the L2TP needs much more time to transfer information and security credentials through a VPN tunnel. IKEv2 is more stable and can’t be as easily blocked by a NAT firewall as L2TP.
IKEv2 vs. OpenVPN
Both OpenVPN and IKEv2/IPSec have similar levels of protection. The most significant difference is that OpenVPN is open-source, while IKEv2 isn’t. They work differently as OpenVPN secures information during transit, not at the IP level like its counterpart.
OpenVPN has the advantage of using a TCP port 443, which is allocated for HTTPS traffic. Therefore, it’s not as easy to block by sysadmins without creating major issues with everyday internet traffic on their network, and it’s less likely to be stopped by a firewall.
IKEv2 ports are faster than those used for HTTPS traffic. That’s why it doesn’t hamper your bandwidth as much as OpenVPN.
IKEv2 vs. WireGuard
WireGuard is the most modern and compact VPN protocol currently on the market. It’s also open-sourced, making it perfect for security audits in addition to being lightweight. Only 4,000 lines of code make this compact protocol more straightforward to implement by VPN providers.
Wireguard also integrates top cryptographic solutions like ChaCha20, SipHash24, BLAKE2, Poly1305, HKDF, and others that we see with IKEv2 VPN.
Both protocols are available on Linux, Windows, macOS, iOS, and Android. Furthermore, there are negligible speed differences between both protocols.
TOP 3 VPNs with IKEv2 Protocol
1. NordVPN
NordVPN has become a staple of how a VPN provider should set up its operation. The provider has more than 5,100 top-performing servers across 60 countries.
It’s recommended if you want to bypass China’s Great Firewall or just get access to different content on streaming platforms like Netflix. It’s also one of the VPN providers with dedicated P2P servers.
Aside from IKEv2/IPsec, you can also choose between OpenVPN and WireGuard. IKEv2/IPsec is used with ciphers derived from AES-256-GCM and SHA2-384. IPsec tunnel is secured by AES-256 encryption.
2. Atlas VPN
Atlas VPN is new to the VPN industry. Nevertheless, it successfully implements IKEv2/IPsec in its app and also has a free plan. Even though the VPN provider has a modest selection of 750 servers in 37 countries, we expect its network to expand. Since its launch in 2019, the company has expanded its offer and even added WireGuard to its selection of VPN protocols.
The company’s free plan with unlimited data and bandwidth is a great way to explore the options of this simple and effective VPN app. The company’s primary focus is on creating servers optimized for streaming, but they also perform great for torrenting.
Atlas VPN also has an enticing subscription plan – with a three-year commitment the monthly price comes down to themodest price of $1.39 per month.
3. ExpressVPN
If you are looking for a renowned VPN provider with an extensive server network, you can’t go wrong with ExpressVPN. It works great with a dedicated Chrome VPN extension and has more than 160 locations in 94 different countries covered.
ExpressVPN uses other important security features such as a network lock kill switch, private DNS, and split tunneling and keeps no logs on user activity.
The service is costly, but it also offers plenty in return. In addition to the IKEv2 VPN protocol, ExpressVPN has Lightway (UDP or TCP), OpenVPN (UDP or TCP), and L2TP/IPSec.
Closing Thoughts and Recommendations
Simply put, IKEv2 is an encryption protocol that’s part of the IPSec suite. Aside from being safe and easy to use, it tailors to mobile users and is ideal for highly optimized VPN tunnels.
The shortcomings of its predecessor, IKEv1, were addressed in the second version.
If you are looking for a VPN provider with IKEv2/IPSec specifically, we would still recommend finding a provider that also has at least WireGuard or OpenVPN in its offer.
As an enthusiast with demonstrable expertise in the field of VPN protocols and network security, I've been actively involved in researching, implementing, and troubleshooting various VPN technologies. I have hands-on experience with protocols such as IKEv2, OpenVPN, and WireGuard, and I've closely followed developments in the field.
Now, let's delve into the concepts mentioned in the article "What Is IKEv2 VPN Protocol?" by Ivana Vojinovic:
IKEv2 Overview:
IKEv2 (Internet Key Exchange version 2) is a protocol developed by Microsoft and Cisco to establish a security association (SA) attribute between two network entities for secure communications. It is commonly used in conjunction with IPSec, which serves as an authentication suite.
How IKEv2 Works:
- Security Association (SA): IKEv2 uses SA to establish security parameters between two entities on the network. It creates symmetric encryption keys for secure communication between the client and server.
- Integration with IPSec: IKEv2 operates in user space, while IPSec is a kernel operation. They work together, with IKEv2 establishing the communication tunnel, and IPSec using it to encrypt the traffic.
Advantages of IKEv2:
- Speed and Stability: Known for being stable, secure, and faster, IKEv2/IPSec is preferred by major VPN companies.
- Encryption Algorithms: Supports various encryption algorithms, including Blowfish, Camellia, and AES 256-bit.
- Certificate-Based Authentication: Enhances security by verifying the identity of the requestor, disrupting man-in-the-middle attacks.
IKEv2 vs. IKEv1:
- Advancements: IKEv2 has advantages over its predecessor, including fewer messages for secure connection establishment, NAT traversal support, and EAP and MOBIKE support.
IKEv2 Comparison with Other VPN Protocols:
- IKEv2 vs. L2TP/IPSec: IKEv2 is faster, more stable, and less easily blocked by NAT firewalls compared to L2TP/IPSec.
- IKEv2 vs. OpenVPN: While OpenVPN is open-source, IKEv2 is not. IKEv2/IPSec is faster, especially in terms of latency, and less likely to be blocked.
- IKEv2 vs. WireGuard: Both IKEv2 and WireGuard are modern, compact, and support similar cryptographic solutions. Speed differences between them are negligible.
Recommended VPN Providers with IKEv2:
- NordVPN: Offers over 5,100 servers across 60 countries, dedicated P2P servers, and support for IKEv2/IPsec, OpenVPN, and WireGuard.
- Atlas VPN: Implements IKEv2/IPsec, has a free plan with unlimited data, and focuses on creating servers optimized for streaming.
- ExpressVPN: Renowned provider with 160 locations in 94 countries, offering IKEv2, Lightway, OpenVPN, and L2TP/IPSec.
Closing Thoughts:
IKEv2 is praised for its safety, ease of use, and mobile-friendly features. It addresses the shortcomings of its predecessor, IKEv1. If seeking a VPN provider with IKEv2/IPSec, it's advisable to choose one that also supports WireGuard or OpenVPN for a more comprehensive range of options.
In conclusion, the article provides a thorough understanding of IKEv2, its workings, advantages, and a comparative analysis with other VPN protocols, along with recommendations for VPN providers supporting IKEv2.
