Frequently Asked Questions

When an IKE server receives a connection request, and there's more than one IKE VPN tunnel configured on that server, the problem arises that the server needs to decide which tunnel this request is targeting and quite often it must base that decision only on the information available in the very fast packet. Knowing the correct tunnel is important as the tunnel configuration defines the cryptographic parameters as well as which pre-shared key or certificates to use. Which information will be available in the very first packet depends on the chosen exchange mode. In Main Mode the first packet contains a list of encryption algorithms, hash algorithms, DH groups, the desired kind of authentication (pre-shared key or certificates, but neither the key itself nor any certificates, both are validated at a later time), as well as information whether XAUTH must be performed, may optionally be performed or must not be performed. Further it can see the IP address of the sender from the network packet as well as the IP address to which this packet was sent to (as a gateway may have more than one address). It now needs to decide upon a tunnel only based on this information. Since Main Mode is typically used for static gateway-to-gateway connections and gateways typically have either a fixed IP address or at least a fixed (possibly "dynamic") DNS name, most servers base their decision only on the sender IP address. In case a VPN gateways also allows mobil users to connect using Main Mode, it will either only allow one such connection (this is a fallback connection, that will always be used when the sender IP address doesn't match any other configured Main Mode tunnel) or it allows more than one in which case it will try to guess the right one solely by the connection settings offered in the first packet. If these settings match more than one tunnel, any of these may win, which can easily cause the wrong tunnel to be targeted. In Aggressive Mode the same information is available but additional to that the local identifier (type and value) is sent in the first packet. As this identifier can be chosen freely and as it's also easy to make it unique for every tunnel, most gateways will base their decision solely on this identifier in Aggressive Mode. So it's fundamental easier to operate multiple user VPN connections using aggressive mode. All that is required is configuring a unique remote identifier for each of them and then using this remote identifier as local identifier in the client (what is remote for the gateway is local for the client and the other way round).