IKEv2/IPsec explained

IKEv2 and IPsec are two things people say as one word. IPsec is the framework that encrypts and authenticates IP packets, defined across a family of RFCs. IKEv2 is the protocol that negotiates the keys IPsec then uses. You never run one without the other, which is why the pairing is treated as a single name.

Why it matters despite being old

It is built in. Windows, macOS, iOS and Android all implement IKEv2/IPsec in the operating system, which means:

• No third-party app is required.
• The tunnel can be configured by a device management profile, which is how organisations deploy it to thousands of devices.
• It works before any application starts, including at boot and at the login screen.

WireGuard and OpenVPN both need software installed. On a managed fleet, that difference decides the protocol.

MOBIKE, the feature that made it a phone protocol

RFC 4555 defines the mobility and multihoming extension. It lets an established IPsec security association survive a change of address: the client tells the server it has moved, and the tunnel continues.

That is why an IKEv2 tunnel on an iPhone survives walking out of Wi-Fi onto cellular without a visible reconnection, and why Apple's own always-on VPN implementations use it.

WireGuard achieves the same outcome by being stateless. IKEv2 achieves it by having an explicit protocol message for the situation. Both work; the mechanisms are quite different.

The negotiation

IKEv2 establishes two things in sequence. IKE_SA_INIT negotiates the cryptographic parameters and performs a Diffie-Hellman exchange. IKE_AUTH authenticates both peers and creates the first child security association, which is what actually carries traffic.

Authentication can be certificates, a preshared key, or EAP, which is what allows username-and-password logins against a directory server. That EAP support is another reason enterprises like it.

Where it runs into trouble

NAT. IPsec's ESP protocol is not TCP or UDP, so address translation devices cannot rewrite ports for it. The workaround is NAT traversal, which encapsulates ESP inside UDP port 4500. It works and adds overhead, and it is why an IPsec connection sometimes fails behind an unusual router.

Fixed ports. IKEv2 uses UDP 500 and UDP 4500. Both are well known and both are commonly blocked on restrictive networks. Unlike OpenVPN, there is no port 443 mode to fall back to.

Configuration complexity. IPsec has an enormous parameter space, and two implementations that both follow the RFCs can fail to interoperate because they propose non-overlapping cipher suites. Anyone who has debugged a site-to-site tunnel between two vendors knows this.

Speed

IKEv2/IPsec is fast. The data path is in the kernel on every major platform, and AES-GCM with hardware acceleration is quick on any modern CPU.

In practice it lands between WireGuard and OpenVPN, closer to WireGuard, and the difference on a phone is usually not the deciding factor. Reconnection behaviour and whether an app is needed matter more.

How it compares

	IKEv2/IPsec	WireGuard	OpenVPN
Built into the OS	Yes	No	No
Survives network change	Yes, via MOBIKE	Yes, statelessly	No
Runs on port 443/TCP	No	No	Yes
Certificate identity	Yes	No	Yes
Codebase size	Large	About 4,000 lines	Large
Configuration by MDM	Yes	Limited	Limited

When you will actually use it

• A work VPN pushed to your device by a profile. Almost certainly IKEv2.
• A provider with no app for your platform, offering a .mobileconfig or a manual configuration. That is IKEv2, because it is what the system speaks.
• Apple TV before an app existed, and managed Apple devices generally.
• A situation where the tunnel must be up before login.

For a consumer VPN on a device that can run an app, WireGuard is the better default, which is why the iOS and Windows clients use it. IKEv2 is the fallback that works without installing anything, and that is a genuinely useful property rather than a consolation.

One security note

IKEv1 is obsolete. Its aggressive mode has known weaknesses against offline dictionary attacks on preshared keys, and it should not be used. If a configuration says IKEv1, or if a router only offers it, that is a reason to change something rather than a detail.