What does IKE stand for?
IKE stands for Internet Key Exchange. The protocol that negotiates IPsec security associations and exchanges keys, in two phases, before ESP or AH traffic flows. It runs on UDP 500, with UDP 4500 for NAT traversal; IKEv2 is the current, simpler version.
IKE is the protocol that sets up an IPsec VPN. Before two gateways can encrypt traffic they must prove who they are, agree on algorithms and create shared keys. IKE does all three, and renews the keys during the life of the tunnel. The current version is IKEv2. It runs over UDP port 500 and moves to UDP port 4500 when it detects a NAT device on the path. The peers authenticate with a pre-shared key or with certificates. The result of the exchange is a set of security associations that the data protocol, ESP, then uses.
IKE in practice: an example
A site-to-site VPN between two offices will not come up after a firewall is replaced. The log on one side shows IKE proposals being sent and no reply. The new firewall allows ESP but drops UDP 500, so the two gateways never get as far as agreeing keys. Opening UDP 500 and 4500 between the two public addresses brings the tunnel up.
What IKE is confused with
IKE vs IPsec: what is the difference?
IPsec is the framework that protects the packets. IKE is the part that negotiates and refreshes the keys IPsec uses. Without IKE there are no keys and no tunnel. What IPSec stands for
IKE vs ESP: what is the difference?
ESP is the IPsec protocol that encrypts and authenticates the data packets themselves. IKE is the control channel that sets up the keys ESP needs.
Which exams cover IKE?
IKE is on the official CompTIA acronym list for one of the four exams covered here.
- Network+ N10-009: 1.0 (Networking Concepts).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A firewall between two VPN gateways must allow IKE. Which ports are needed when NAT may be present on the path?
- UDP 500 and UDP 4500
- TCP 80 and TCP 443
- UDP 67 and UDP 68
- TCP 20 and TCP 21
Show the answer
A. UDP 500 and UDP 4500. IKE uses UDP 500 and switches to UDP 4500 for NAT traversal. The other pairs are the web, DHCP and FTP ports.
2. What is the role of IKE in an IPsec VPN?
- Authenticating the peers and negotiating the keys
- Compressing the payload
- Assigning VLAN tags
- Resolving host names
Show the answer
A. Authenticating the peers and negotiating the keys. IKE authenticates both ends and establishes the security associations and keys. The traffic is then protected by ESP using those keys.
Sources: RFC 7296: Internet Key Exchange Protocol Version 2 (IKEv2); NIST SP 800-77 Rev. 1, Guide to IPsec VPNs; NIST glossary: Internet Key Exchange. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 12 November 2026.