IKE / IKEv2
Internet Key Exchange — protocol for IPsec key-management. Establishes Security Associations (SAs) between peers. IKEv2 (RFC 7296, 2014) replaced IKEv1 — simpler state machine, mobile-friendly (MOBIKE for IP change), built-in NAT-traversal.
Two phases in v1: Phase 1 (IKE SA, authenticate peers) + Phase 2 (IPsec SAs for actual data). IKEv2 collapsed to one exchange. Authentication: pre-shared key, X.509 certs, EAP. Standard today on enterprise VPN gateways (Strongswan on Linux, Cisco ASA, Fortigate). WireGuard is the modern alternative — simpler, no IKE, faster. Mobile clients: iOS/macOS native IKEv2 support via Settings. Configuration complexity is classically off-putting — Strongswan config files can be hundreds of lines.