What Is IKEv2/IPsec? The Native VPN Protocol
Detectable by ISPAvailable on SHP
IKEv2/IPsec is a native VPN protocol built into Windows, macOS, and iOS. Learn how it works, its advantages, and how to use it on SHP.
Official websitedatatracker.ietf.org/doc/html/rfc7296
Community & docswww.strongswan.org/documentation.html
DeveloperCollaborative effort of the IETF IPsec working group
First releasedStandardized December 2005 (RFC 4306); current version RFC 7296 (October 2014)
Current statusUnchanged since RFC 7296 (2014); implementations like strongSwan update regularly
LicenseThe standard is open (published RFC); the most common implementation, strongSwan, is GPLv2
Independent auditNo comprehensive third-party audit of strongSwan itself, though the standard went through years of IETF peer review
Why it was createdBuilt to give enterprises a standardized way to negotiate encryption keys over IPsec, for corporate and site-to-site networks.
How it worksTwo devices negotiate keys through the IKE exchange, then IPsec encrypts the actual traffic at the IP packet level.
Censorship resistanceWeak — uses fixed UDP ports 500 and 4500, which are easy to block
Setup time~8 min
SpeedHigh
Works on your devices
Desktop, mobile, TV boxes and routers — where this protocol runs natively vs. needs a workaround.
Desktop & Mobile
WindowsSupported
macOSSupported
iOSSupported
AndroidSupported
LinuxSupported
TV & Streaming
Apple TVSupported — .mobileconfig
Android TVSupported — Sideload APK
Fire TV StickSupported — Sideload APK
Routers
ASUSSupported
D-LinkModel-dependent
AVM FRITZ!BoxSupported
MikroTikSupported
GL.iNetModel-dependent
KeeneticSupported
Explore other protocols
WireGuard® is a registered trademark of Jason A. Donenfeld. OpenVPN® is a registered trademark of OpenVPN, Inc. All other product names, operating-system and device-brand logos, and trademarks shown above are the property of their respective owners; their use here is for identification only and does not imply any affiliation or endorsement.