NSE4 Authentication and VPN Practice Question
Which of the following is a benefit of using IKEv2 over IKEv1 for IPsec VPN?
⚠ Common exam trap
It's easy for candidates to confuse IKEv2's simplified exchange (fewer messages) with requiring fewer firewall rules, but the actual benefit tested is MOBIKE support for network resilience.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IKEv2 is more robust to network changes and supports MOBIKE
IKEv2 is more robust to network changes because it supports the Mobility and Multihoming (MOBIKE) protocol, which allows an IPsec VPN tunnel to survive IP address changes without re-establishing the entire security association. This is a key advantage over IKEv1, which lacks native support for MOBIKE and requires a full rekey when the endpoint's IP address changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IKEv2 supports only main mode
Why it's wrong here
The statement is false because IKEv2 does not use the IKEv1 main/aggressive mode split. Instead, IKEv2 performs a single pair of IKE_SA_INIT and IKE_AUTH exchanges to establish the security association. Therefore, claiming IKEv2 supports only main mode mischaracterizes its negotiation flow, which is a single authenticated exchange, not a mode selection.
- ✗
IKEv2 requires fewer firewall rules
Why it's wrong here
This is incorrect because both IKEv1 and IKEv2 rely on the same UDP ports: 500 for the initial IKE negotiation and 4500 for IPsec NAT traversal. Since the transport protocol and port requirements are identical, firewall rules needed to allow VPN traffic are effectively the same. IKEv2 does not reduce the number of required firewall rules or simplify ACL configuration.
- ✗
IKEv2 uses a single UDP port 500
Why it's wrong here
IKEv2 actually uses two UDP ports in practice: UDP 500 for the initial IKE_SA_INIT and later exchanges, and UDP 4500 for ESP packets wrapped in UDP when NAT-T is involved. The use of a single port is a misconception; without UDP 4500, NAT traversal of ESP would fail. Hence, IKEv2 is not single-port, and this option is wrong.
- ✓
IKEv2 is more robust to network changes and supports MOBIKE
Why this is correct
IKEv2 is indeed more robust in mobile and changing network environments, primarily due to MOBIKE (Mobility and Multihoming). MOBIKE allows the VPN peer to update its current IP address to the remote gateway without renegotiating the entire IKE and IPsec SAs, preserving the tunnel across Wi-Fi to cellular handoffs. This feature, specified in RFC 4555 and integrated into RFC 7296, is absent from IKEv1, making IKEv2 superior for dynamic links.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.