Skip to content
Cryptography
ASD ISMISM-1233

ASD ISM 1233 Use IKE version 2 for IPsec key exchange

What it says

IKE version 2 is used for key exchange when establishing IPsec connections.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure secure IPsec connection by using IKE version 2 for exchanging keys.

When setting up an IPsec connection, it's important to use a process called IKE version 2 for exchanging keys. If you don't use the correct method, you risk hackers intercepting sensitive information or disrupting communication by pretending to be someone they're not.

Why it matters

Using outdated IKE versions can lead to key exchange vulnerabilities, allowing attackers to intercept traffic or impersonate systems.

How to implement

  1. The IT team should update the network equipment configuration to use IKE version 2 for IPsec connections.

    Check the settings on routers and firewalls and switch the key exchange protocol to the IKE version 2 option. Update the firmware or software if the current version doesn't support IKE version 2.

  2. System administrators should review and test the changes to ensure stability.

    Run tests to confirm that the IPsec connections function correctly with IKE version 2 without drops. Document the test results and any issues encountered during the transition process.

  3. Network administrators should train their team on the changes, highlighting the differences between the older IKE version 1 and IKE version 2.

    Create a simple guide or hold a short training session to familiarize the team with the updated process and benefits of IKE version 2, such as improved security features.

  4. Procurement teams, when purchasing new network equipment, should ensure all new devices support IKE version 2.

    Involve the IT department to verify the technical specifications before purchasing and consider future-proofing by selecting models that offer the latest security features.

  5. IT security personnel should monitor logs to ensure that all active IPsec connections are using IKE version 2.

    Set up regular checks or automate log scans to alert if any connections fall back to older protocols, ensuring compliance with this security measure.

Keep it running

Regularly confirm IPsec uses IKEv2 (no IKEv1) in VPN gateway and client configs; monitor for downgrade negotiation and fix misconfigurations promptly.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The network configuration documentation: Request the latest configuration files for routers and firewalls.

    Look at

    Entries indicating the use of IKE version 2 for all IPsec connections.

    Good evidence

    Displays consistent settings across all devices reflecting IKE version 2 usage.

  2. Check 2 of 5What an auditor asks for

    Ask for

    A network test report: Request a recent report summarising tests of the IPsec connections.

    Look at

    Test results to ensure they mention successful connections using IKE version 2 without failures.

    Good evidence

    Shows thorough testing with positive outcomes.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Training materials on IKE version 2: Request any documents or slides used for training network staff on IKE version 2.

    Look at

    Content that explains both setup and safety benefits of the updated protocol.

    Good evidence

    Includes clear material addressing key differences and advantages.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Procurement records of new network devices: Request recent records of network equipment purchases.

    Look at

    Specifications that confirm IKE version 2 support in the chosen models.

    Good evidence

    Provides detailed specifications and IT sign-off on compatibility.

  5. Check 5 of 5What an auditor asks for

    Ask for

    System monitoring logs: Request logs from the past month that demonstrate active monitoring of IPsec connections.

    Look at

    Alerts or entries that verify the use of IKE version 2.

    Good evidence

    Shows consistent monitoring and alerts when deviations occur.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.