Skip to content
HackIndex logo

HackIndex

IKEv1 Only Gateway Detection

3 min read Mar 30, 2026

IKEv2 was standardised in RFC 4306 (2005) and revised in RFC 7296 (2014). It removes Aggressive Mode entirely, improves cryptographic negotiation, and eliminates several attack surfaces that exist in IKEv1. A gateway that supports only IKEv1 is running a deprecated protocol with a larger attack surface than necessary.

Confirming IKEv1-only support is a standalone finding, and it also gates the rest of the IKEv1 attack chain — Aggressive Mode, PSK cracking, and weak cipher exploitation all require IKEv1 to be in play.

Probe for IKEv2 Support

Send an IKEv2 probe and record whether the gateway responds:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan --ikev2 $TARGET_IP 
10.10.10.5	IKEv2 SA_INIT returned
	HDR=(...) SA=(...) KE=(...) Ni=(...)
Explain command
--ikev2 Use IKE version 2 for the scan instead of the default IKEv1.
$TARGET_IP Target IP address to probe for IKEv2 VPN services.

A gateway that supports IKEv2 returns an IKEv2 SA_INIT returned response.

A gateway that does not support IKEv2 returns no response, a timeout, or an INVALID_MAJOR_VERSION notify:

10.10.10.5	Notify message 6 (INVALID_MAJOR_VERSION)

Or simply:

Ending ike-scan 1.9.4: 1 hosts scanned in 10.412 seconds (0.10 hosts/sec); 0 returned handshake; 0 returned notify

No response to an IKEv2 probe while IKEv1 responds confirms IKEv1-only operation.

Confirm IKEv1 Is Active

Confirm IKEv1 is responding alongside the negative IKEv2 result:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan $TARGET_IP 
10.10.10.5	Main Mode Handshake returned
	SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 ...)

The combination of IKEv1 responding and IKEv2 not responding is the confirmed finding.

Check Nmap for Additional Confirmation

Nmap's ike-version NSE script can also distinguish versions:

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sU -p 500 --script ike-version $TARGET_IP 
500/udp open  isakmp
| ike-version:
|   vendor_id: Cisco Systems
|   IKEv1 supported: Yes
|_  IKEv2 supported: No
Explain command
-sU Performs a UDP scan instead of the default TCP scan.
-p 500 Scans only port 500, commonly used by IKE/IPsec.
--script ike-version Runs NSE script to detect IKE version and gather VPN info.
$TARGET_IP Placeholder for the target host IP address.

Not all gateways respond to the NSE script reliably — use ike-scan as the primary tool and Nmap as confirmation.

What IKEv1-Only Means

A confirmed IKEv1-only gateway is exposed to:

  • Aggressive Mode PSK hash capture — IKEv2 has no Aggressive Mode

  • Weak cipher negotiation including DES and DH group 1/2 — IKEv2 deprecates these by requirement

  • Information disclosure via version fingerprinting — IKEv1 gateways are more likely to be older hardware with known CVEs

Document this finding alongside the transform set results from IKE Transform Set Enumeration and proceed to IKEv1 Aggressive Mode Enabled to check the full IKEv1 attack surface.

References