Feature	IPsec (Internet Protocol Security)	IKE (Internet Key Exchange)
Primary Role	Protects data packets	Negotiates management tunnel
Operation Layer	Layer 3 to encrypt data	Application layer to facilitate SAs setup
Protocols	AH or ESP	IKEv1 or IKEv2

---

IKE

IKE protocol formerly is referred to as ISAKMP/Oakley. It negotiates IPsec parameters (aka. security associations (SAs)) between devices.

	RFC Doc	Full Names
IKEv1	RFC 2409	Internet Key Exchange
IKEv2	RFC 7296	Internet Key Exchange Version 2
ISAKMP	RFC 2408	Internet Security Association and Key Management Protocol

	IKEv2	IKEv1
Protocol Establishment messages	4 message	6 message
EAP support	Yes (2 extra message)	No
Negotiation for Security Associations	2 extra messages	3 extra message
Run over UDP 500/4500	Yes	Yes
NAT Traversal (NAT-T)	Yes	Yes
Retransmissions and acknowledgment functions	Yes	Yes
Provide identity protection, a DoS-protection mechanism, and Perfect Forward Secrecy (PFS)	Yes	Yes
Next Generation Ciphers Support	Yes	No

---

IPsec

Operation Protocols

	ESP (Encapsulating Security Payload)	AH (Authentication Header)
Best Practice	Acceptable	Avoid
Cryptography	Encryption, Integrity, and Authentication	Integrity and Authentication
Hashing Packet	Exclude new IP header	Include new IP header (Whole IP packet)

Encapsulation Modes

Mode	ESP Encapsulation
Transport	ip-header:ESP-header:Payload:ESP-tail:ESP-auth
Tunnel	new-ip-header:ESP-header:ip-header:Payload:ESP-tail:ESP-auth

1. Only when new-ip-header and ip-header are the same, it is transport mode.
2. ESP-auth is HMAC hash algorithm against the part from ESP-header to ESP-tail.