What IKEv2 actually is
"IKEv2" is shorthand for Internet Key Exchange version 2, a key-negotiation protocol defined in RFC 7296. It's typically paired with IPsec (Internet Protocol Security) for the actual encryption β so the full name is often written as "IKEv2/IPsec."
- IKEv2: handles the handshake and negotiates session keys.
- IPsec: encrypts and authenticates the data packets.
Most VPN providers and users refer to the combined stack as just "IKEv2." It was developed jointly by Microsoft and Cisco in the mid-2000s, with the goal of being more mobile-friendly than its predecessor IKEv1.
The MOBIKE extension
The killer feature for mobile use is an extension called MOBIKE (Mobility and Multihoming Protocol). It allows the tunnel to survive when your device's IP address changes β for example, when you switch from WiFi to cellular, or roam between WiFi networks.
Without MOBIKE, the tunnel would have to be torn down and rebuilt on every network change. With it, the existing tunnel updates its endpoint addresses in place. Users experience this as the VPN "just working" through network transitions, even when their IP changes mid-session.
WireGuard handles roaming differently but achieves the same effect β peers can change endpoints without rebuilding tunnels. OpenVPN does not handle this well, which is why OpenVPN connections tend to drop on network switches.
How IKEv2 works (briefly)
The IKEv2 handshake happens in two phases:
- IKE_SA_INIT: client and server exchange initial parameters and perform Diffie-Hellman key agreement.
- IKE_AUTH: client and server authenticate each other (typically with certificates, sometimes with username/password via EAP), and the first IPsec child SA is established.
Once the handshake completes (typically 2 round trips), packets flow through the IPsec tunnel. The protocol supports re-keying (periodically changing session keys for forward secrecy) and tunnel updates (MOBIKE) without requiring a new full handshake.
iOS native support
Apple has included IKEv2 in iOS since version 9 (2015). You can configure an IKEv2 VPN profile in iOS Settings β VPN β Add VPN Configuration β IKEv2, without installing a third-party app.
This is one reason IKEv2 remains common for iOS users: you can use it without giving a third-party app full VPN access to your device.
For VPN providers, configuration profiles
(.mobileconfig files) make it easy to ship a
turnkey iOS setup. Most reputable providers offer this for
users who prefer to use Apple's built-in stack.
Performance
IKEv2 generally performs well β better than OpenVPN, comparable-but-slightly-slower than WireGuard:
| Metric | IKEv2 | WireGuard | OpenVPN |
|---|---|---|---|
| Throughput | ~600-800 Mbps | ~900+ Mbps | ~250-400 Mbps |
| Handshake | ~2 RTT | ~1 RTT | ~6 RTT |
| Mobile reconnect | Excellent (MOBIKE) | Excellent | Poor |
| Battery (mobile) | Moderate | Low | Moderate |
Security considerations
The protocol itself is sound, but specific implementations and configurations have weaknesses worth knowing:
- Diffie-Hellman parameters matter. Older IPsec setups used 1024-bit DH groups that are now considered weak (Snowden-era leaks suggested NSA could crack them). Modern configurations use 2048-bit or larger, or elliptic curve variants like ECP-256.
- Pre-shared keys are dangerous. Some IKEv2 deployments use a shared password as the authentication factor. If the PSK leaks, all users using it are compromised. Certificate-based authentication is much safer.
- Implementation complexity. IPsec is a complicated protocol family (RFCs spanning hundreds of pages) and implementations vary in quality. The protocol family has had a few notable CVEs over the years.
Modern IKEv2/IPsec, properly configured with strong ciphers and certificate auth, is secure. It's been extensively analyzed and is used in enterprise and government deployments worldwide.
Where IKEv2 shines
- iOS without third-party apps. Built into the OS, no install needed.
- Mobile with frequent network switches. MOBIKE handles WiFi-to-cellular transitions cleanly.
- Enterprise compatibility. Corporate VPNs often use IPsec for legacy and standards-compliance reasons.
- Restrictive networks. IKEv2 typically uses UDP ports 500 and 4500; less likely to be blocked than WireGuard's flexible ports, more likely than OpenVPN-over-443.
Where IKEv2 falls short
- Speed. WireGuard is consistently faster.
- Complexity. IPsec implementations are large and intricate β more attack surface, harder to audit.
- Network blocks. Some networks specifically block IKEv2/IPsec ports.