# IKEv1 Only Gateway Detection

- **URL:** https://hackindex.io/services/ike/vulnerability-discovery/ike-ikev1-only
- **Path:** IKE > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/ike/vulnerability-discovery.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-30

IKEv2 was standardised in RFC 4306 (2005) and revised in RFC 7296 (2014). It removes Aggressive Mode entirely, improves cryptographic negotiation, and eliminates several attack surfaces that exist in IKEv1. A gateway that supports only IKEv1 is running a deprecated protocol with a larger attack surface than necessary.

Confirming IKEv1-only support is a standalone finding, and it also gates the rest of the IKEv1 attack chain: Aggressive Mode, PSK cracking, and weak cipher exploitation all require IKEv1 to be in play.

## Probe for IKEv2 Support

Send an IKEv2 probe and record whether the gateway responds:

```bash
sudo ike-scan --ikev2 $TARGET_IP
# 10.10.10.5	IKEv2 SA_INIT returned
# 	HDR=(...) SA=(...) KE=(...) Ni=(...)
```

A gateway that supports IKEv2 returns an `IKEv2 SA_INIT returned` response.

A gateway that does not support IKEv2 returns no response, a timeout, or an INVALID_MAJOR_VERSION notify:

```
10.10.10.5	Notify message 6 (INVALID_MAJOR_VERSION)
```

Or simply:

```
Ending ike-scan 1.9.4: 1 hosts scanned in 10.412 seconds (0.10 hosts/sec); 0 returned handshake; 0 returned notify
```

No response to an IKEv2 probe while IKEv1 responds confirms IKEv1-only operation.

## Confirm IKEv1 Is Active

Confirm IKEv1 is responding alongside the negative IKEv2 result:

```bash
sudo ike-scan $TARGET_IP
# 10.10.10.5	Main Mode Handshake returned
# 	SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 ...)
```

The combination of IKEv1 responding and IKEv2 not responding is the confirmed finding.

## Check Nmap for Additional Confirmation

Nmap's `ike-version` NSE script can also distinguish versions:

```bash
sudo nmap -sU -p 500 --script ike-version $TARGET_IP
# 500/udp open  isakmp
# | ike-version:
# |   vendor_id: Cisco Systems
# |   IKEv1 supported: Yes
# |_  IKEv2 supported: No
```

Not all gateways respond to the NSE script reliably: use ike-scan as the primary tool and Nmap as confirmation.

## What IKEv1-Only Means

A confirmed IKEv1-only gateway is exposed to:

- Aggressive Mode PSK hash capture: IKEv2 has no Aggressive Mode
- Weak cipher negotiation including DES and DH group 1/2: IKEv2 deprecates these by requirement
- Information disclosure via version fingerprinting: IKEv1 gateways are more likely to be older hardware with known CVEs

Document this finding alongside the transform set results from [IKE Transform Set Enumeration](https://hackindex.io/services/ike/enumeration/ike-transform-set-enumeration) and proceed to [IKEv1 Aggressive Mode Enabled](https://hackindex.io/services/ike/vulnerability-discovery/ike-aggressive-mode-enabled) to check the full IKEv1 attack surface.

## References

- [RFC 7296: IKEv2](https://www.rfc-editor.org/rfc/rfc7296) - IKEv2 specification, section 1.5 covers IKEv1/IKEv2 differences
- [Nmap NSE: ike-version](https://nmap.org/nsedoc/scripts/ike-version.html) - Script documentation for IKE version and vendor detection via Nmap