Port 500 – IPsec IKE (Internet Key Exchange)

Port 500 is the default UDP port for IKE (Internet Key Exchange), the ISAKMP-based protocol that negotiates and sets up the encrypted tunnels behind almost every IPsec VPN. Before any data flows, the two peers talk on UDP 500 to authenticate each other and agree on keys and ciphers — the security associations (SAs) that the IPsec tunnel then uses. An open port 500 is a dead giveaway that you’ve found a VPN gateway, and it’s one of the more rewarding external-pentest targets: a single misconfiguration — IKEv1 Aggressive Mode with a pre-shared key — hands an unauthenticated attacker a crackable hash of the VPN password.

Why It’s Open

Port 500 is open on anything terminating IPsec: VPN concentrators, perimeter firewalls (Cisco ASA/IOS, Fortinet FortiGate, Juniper, Palo Alto, SonicWall, Check Point), routers, and Linux/BSD hosts running strongSwan, Libreswan, or the legacy racoon daemon. It carries both site-to-site tunnels (office-to-office) and remote-access VPNs (roaming laptops dialing home).

IKE rarely travels alone. Where a peer sits behind NAT, IPsec switches to UDP 4500 (NAT-Traversal) to wrap ESP inside UDP, and the encrypted payload itself rides ESP (IP protocol 50). So an IPsec gateway usually answers on 500 and 4500. IPsec is also the encryption layer under L2TP on port 1701 (the classic “L2TP/IPsec” combo), sitting alongside older tunnels like PPTP on 1723 and OpenVPN on 1194 in the VPN family.

Common Risks

• IKEv1 Aggressive Mode PSK disclosure. This is the headline finding, and it’s a configuration weakness, not a CVE. When a gateway accepts IKEv1 in Aggressive Mode with pre-shared-key authentication, it replies to an unauthenticated attacker with a hash of the PSK inside the third message of the exchange. Capture it with ike-scan --aggressive and crack it offline with psk-crack. A weak PSK falls in minutes, and the PSK is often the only thing standing between the attacker and the internal network.
• Group name / ID enumeration. Remote-access IKEv1 setups key their configuration off a group name (the IKE ID). Aggressive Mode lets an attacker probe and enumerate valid group IDs, then target the matching PSK.
• VPN fingerprinting and information disclosure. The IKE handshake, vendor IDs, and transform sets leak the device make, model, and software — ike-scan fingerprints Cisco, Juniper, Fortinet, strongSwan and friends by their vendor IDs and their retransmission “backoff” patterns, narrowing the CVE hunt before a single exploit is fired.
• Unauthenticated remote code execution. IKE parsers have carried critical pre-auth memory-corruption bugs — the Cisco ASA fragmentation overflow (CVE-2016-1287) and the strongSwan charon-tkm DH overflow (CVE-2023-41913) both reach code execution over UDP 500 with no credentials.
• Memory disclosure. Cisco’s BENIGNCERTAIN flaw (CVE-2016-6415) lets a crafted IKEv1 packet dump chunks of device memory — including RSA private keys and PSKs — straight off port 500.
• Weak and legacy cryptography. DES/3DES transforms, MODP-768/1024 (Diffie-Hellman groups 1/2), and reused or short PSKs leave tunnels open to offline and downgrade attacks.
• Denial of service. Malformed IKE packets crash several implementations (Libreswan CVE-2023-30570, strongSwan CVE-2021-41991), dropping every tunnel the gateway serves.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Check if it’s open and fingerprint the IKE service

nmap -sU -p 500 -sV --script ike-version <target>

Discover and fingerprint the VPN gateway with ike-scan

# Basic Main Mode probe — confirms IKE and fingerprints the vendor
ike-scan <target>

# Show vendor IDs and the retransmission backoff fingerprint
ike-scan -M --showbackoff <target>

Test for IKEv1 Aggressive Mode and capture the PSK hash

# -A = Aggressive Mode, -M = multiline output, --id sets a group name
ike-scan -M -A --id=vpngroup --pskcrack=psk.txt <target>

If the gateway answers in Aggressive Mode, the hash lands in psk.txt.

Crack the captured pre-shared key offline

psk-crack -d /usr/share/wordlists/rockyou.txt psk.txt
psk-crack -b 5 psk.txt          # brute force, 5-char keyspace

Dump device memory with the BENIGNCERTAIN Metasploit module

msfconsole -q
use auxiliary/scanner/ike/cisco_ike_benigncertain
set RHOSTS <target>
run

Every PSK you crack, group name you enumerate, and vendor you fingerprint is a finding — keep it with the engagement so it lands in the pentest report instead of a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

• CVE-2016-1287 — A heap buffer overflow in the IKEv1 and IKEv2 code of Cisco ASA Software. An unauthenticated attacker who sends crafted fragmented UDP packets to port 500 (or 4500) gets remote code execution or crashes the device — full compromise of the firewall from the outside. CVSS 9.8, weaponized in Metasploit and archived on Exploit-DB (39823). The flagship “own the VPN box over IKE” bug.
• CVE-2016-6415 — “BENIGNCERTAIN.” A flaw in the IKEv1 SA-negotiation handling of Cisco IOS, IOS XE, IOS XR, and PIX leaks chunks of device memory — including RSA private keys, PSKs, and configuration — to an unauthenticated attacker on UDP 500. CVSS 7.5, in CISA’s Known Exploited Vulnerabilities catalog, and exploitable with auxiliary/scanner/ike/cisco_ike_benigncertain. Originally an Equation Group / Shadow Brokers tool.
• CVE-2023-41913 — A buffer overflow and possible unauthenticated remote code execution in strongSwan before 5.9.12, via an oversized Diffie-Hellman public value that overruns the internal buffer in the charon-tkm DH proxy — reachable through a crafted IKE_SA_INIT. CVSS 9.8. Affects deployments that use the TKM-backed charon-tkm daemon.
• CVE-2023-26463 — strongSwan 5.9.8/5.9.9 mishandles a certificate in its TLS-based EAP methods (EAP-TLS/TTLS/PEAP/TNC, used for IKEv2 authentication), trusting an untrusted client certificate and then dereferencing an expired pointer. Sending an untrusted client cert during EAP-TLS can lead to a crash or code execution. CVSS 9.8; only affects servers that load the TLS-EAP plugins.
• CVE-2021-41991 — A remote integer overflow in strongSwan’s in-memory certificate cache (before 5.9.4): flooding the cache with many certificates and triggering entry replacement can crash the charon IKE daemon. CVSS 7.5 (denial of service). (The old version of this page mislabeled this as an “authentication bypass” — it is a DoS.)
• CVE-2023-30570 — Libreswan before 4.11: an unauthenticated attacker can crash the pluto IKE daemon (DoS) with crafted IKEv1 Aggressive Mode packets that mishandle the responder SPI. CVSS 7.5 — a reminder that leaving Aggressive Mode enabled is a liability even beyond PSK cracking.

Scope note: Cisco’s other famous ASA “10.0” bug, CVE-2018-0101, is a WebVPN/SSL double-free on TCP 443, not an IKE/500 vulnerability — don’t credit it to this port.

Mitigation

• Disable IKEv1 Aggressive Mode. If you must run IKEv1, use Main Mode only — it never exposes the PSK hash. Better still, move to IKEv2, which has no Aggressive Mode at all.
• Prefer certificates over pre-shared keys. Certificate (or EAP) authentication removes the offline-crackable PSK entirely. Where a PSK is unavoidable, make it long and random (20+ characters), never reuse it across peers, and rotate it.
• Drop legacy crypto. Disable DES/3DES and DH groups 1 and 2 (MODP-768/1024); require AES-GCM and modern DH/ECDH groups.
• Restrict who can reach 500/4500. Where the set of VPN peers is known (site-to-site links, static remote offices), firewall UDP 500 and 4500 to those source IPs. Roaming remote-access VPNs can’t always do this, which is why the crypto and mode hardening above matters most.
• Patch the VPN firmware. The critical bugs on this port (CVE-2016-1287, CVE-2016-6415, CVE-2023-41913) are all patched — keep ASA/IOS/FortiOS and strongSwan/Libreswan current.
• Monitor IKE negotiations. Alert on Aggressive Mode attempts, repeated failed negotiations, and group-name guessing — the fingerprints of an ike-scan sweep.

Real-World Example

In August 2016 the Shadow Brokers dumped a cache of Equation Group tooling that included BENIGNCERTAIN — an exploit for what became CVE-2016-6415. Pointed at a Cisco PIX (and later ASA/IOS) firewall, it sent a crafted IKEv1 packet to UDP 500 and the device replied with fragments of its own memory: enough, in many cases, to recover the VPN’s RSA private key or pre-shared key. With those in hand an attacker could passively decrypt captured VPN traffic or impersonate the gateway — no crash, no shell, just the keys handed over by the key-exchange service itself. It’s the perfect illustration of why an internet-facing port 500 deserves a hard look on every external engagement: the protocol whose entire job is negotiating secrets can, when unpatched, be talked into giving them away.

FAQ

What is port 500 used for?

Port 500 carries IKE (Internet Key Exchange), the ISAKMP-based protocol that authenticates two IPsec peers and negotiates the keys and ciphers for a VPN tunnel. It’s the control channel that sets up an IPsec VPN before any encrypted data flows.

Is port 500 TCP or UDP?

UDP. IKE/ISAKMP runs over UDP 500. When a peer is behind NAT, IPsec also uses UDP 4500 (NAT-Traversal), and the encrypted data itself travels as ESP (IP protocol 50) — but the key exchange that opens on port 500 is always UDP.

What is the difference between port 500 and port 4500?

Port 500 is where the IKE negotiation starts. Port 4500 is IPsec NAT-Traversal: when a firewall or router between the peers is doing NAT, both the remaining IKE messages and the ESP payload get wrapped in UDP and sent to 4500 so they survive the address translation. A working IPsec VPN through NAT usually shows both 500 and 4500 open.

Why is port 500 dangerous to leave open?

An open port 500 advertises a VPN gateway and invites two attacks. If it allows IKEv1 Aggressive Mode with a pre-shared key, it will hand an unauthenticated attacker a crackable hash of the VPN password. And unpatched gateways have carried critical pre-auth bugs (CVE-2016-1287, CVE-2016-6415) that give remote code execution or leak keys straight off the port.

What is IKE Aggressive Mode and why do pentesters care?

IKEv1 has two negotiation modes. Main Mode protects the identities and never exposes the PSK. Aggressive Mode is faster but sends a hash of the pre-shared key back to the initiator before authentication completes — so anyone who can reach port 500 can capture that hash with ike-scan --aggressive and brute-force it offline with psk-crack. It’s a configuration weakness, not a software bug, which is why it survives on so many gateways.

How do I close or secure port 500?

Disable IKEv1 Aggressive Mode (or IKEv1 entirely) and move to IKEv2 with certificate authentication. If PSKs stay, make them long and random. Firewall UDP 500 and 4500 to known peer IPs where the deployment allows it, drop legacy DES/DH-group-1 crypto, and patch the VPN firmware. Rescan with ike-scan <target> afterwards to confirm Aggressive Mode no longer answers.

TL;DR

• Service: IKE / ISAKMP — key exchange that sets up IPsec VPN tunnels
• Default port: 500/UDP (NAT-Traversal on UDP 4500, ESP on IP protocol 50)
• Biggest risk: IKEv1 Aggressive Mode + PSK leaks a crackable password hash to an unauthenticated attacker (ike-scan --aggressive → psk-crack) — a config weakness, not a CVE
• Also watch: pre-auth RCE and memory-leak CVEs on unpatched gateways (CVE-2016-1287, CVE-2016-6415, CVE-2023-41913)
• Mitigation: disable Aggressive Mode, use IKEv2 + certificates, strong PSKs, drop legacy crypto, restrict 500/4500 to known peers, patch firmware