IKEv1 negotiates the Phase 1 tunnel using either Main Mode, which exchanges six packets for identity protection, or Aggressive Mode, which uses three packets for faster establishment. In contrast, IKEv2 simplifies the process by establishing the IKE SA (Phase 1 equivalent) and the first Child SA (Phase 2 equivalent) in a combined four-packet exchange. Furthermore, IKEv2 natively includes NAT-Traversal (NAT-T) in the core standard, whereas it was an extension for IKEv1. IKEv2 also introduces built-in support for EAP (Extensible Authentication Protocol) for client authentication, replacing the XAUTH mechanism often used in IKEv1.

RFC 7296 (IKEv2 Standard):

Section 1.2 "Initial Exchanges": Details the four-packet exchange (IKE_SA_INIT and IKE_AUTH) used to create the IKE SA and the first Child SA.

Section 2.23 "NAT Traversal": Confirms that NAT discovery and traversal are built into the IKEv2 protocol core.

Section 2.16 "Extensible Authentication Protocol (EAP) Methods": Documents the use of EAP for authentication.

Source: Kaufman, C., et al. (2014). Internet Key Exchange Protocol Version 2 (IKEv2). RFC 7296. https://doi.org/10.17487/RFC7296

RFC 2409 (IKEv1 Standard):

Section 5 "Exchanges": Defines the packet flow for Main Mode (6 messages) and Aggressive Mode (3 messages).

Source: Harkins, D., & Carrel, D. (1998). The Internet Key Exchange (IKE). RFC 2409. https://doi.org/10.17487/RFC2409

Cisco Systems Official Documentation:

Technote: "IKEv1 generally calculates a hash... IKEv2 allows the use of EAP for authentication." & "IKEv2... supports NAT-Traversal."

Source: Cisco Systems. (2023). FlexVPN and IKEv2 Configuration Guide, Cisco IOS XE 17.x. "IKEv2 Overview".