IKE Parameters That Must Match for IPsec Tunnel Establishment

Quick Answer

The correct answer, IKE version, matters because IKE peers negotiate a security association before any encrypted traffic can flow, and that negotiation only succeeds if both sides are speaking the same protocol dialect from the very first exchange. IKEv1 and IKEv2 are not interchangeable or backward compatible mid-negotiation, so if one peer is configured for one version and the other for the different version, the initial handshake fails before any other parameter even gets compared. Beyond the version itself, the peers also need to agree on the specific cryptographic parameters proposed for that negotiation, such as the encryption algorithm used to protect the phase 1 exchange; if the proposed algorithms don't overlap between the two sides, the peers can't agree on how to secure their communication even if they're both running the same IKE version. Both of these are mandatory matching parameters precisely because IKE is a negotiation protocol, not a one-sided configuration, so every parameter that affects how the two sides interpret and protect their exchange has to have at least one mutually acceptable option on both ends. When a question asks what must match between IKE peers, think in terms of protocol version and the cryptographic proposal parameters, since any mismatch there prevents the SA from ever being established.