VPN & tunnellingUDP 500, 4500 Encrypted
Port 500, 4500: IKE
Internet Key Exchange (IPsec)
Negotiates IPsec VPN tunnels on UDP 500; UDP 4500 carries NAT traversal.
How attackers abuse it
- Aggressive mode with pre-shared keys leaking crackable hashes (IKEv1).
- Unpatched VPN appliances are frequent initial-access targets.
How to defend it
- Use IKEv2 with certificates.
- Patch VPN appliances quickly and require MFA.
Exam tip
IPsec: AH gives integrity and authentication; ESP adds confidentiality. Tunnel mode protects the whole packet.