Which protocol uses UDP port 500 to establish IPsec security associations and exchange keys for VPNs?

Which protocol uses UDP port 500 to establish IPsec security associations and exchange keys for VPNs?

• A. Secure Shell (SSH)
• B. ISAKMP and Internet Key Exchange (IKE)
• C. File Transfer Protocol (FTP)
• D. Session Initiation Protocol (SIP)

Answer: (B)

Negotiating and establishing IPsec security associations and exchanging keys for a VPN is handled by IKE, which operates within the ISAKMP framework. IKE uses UDP port 500 by default for these negotiations, making it the correct fit for setting up IPsec SAs. In some scenarios behind NAT, NAT-T can switch to UDP 4500, but the standard initial exchange occurs on port 500. The other options don’t relate to IPsec SA creation: SSH is for secure remote login (port 22), FTP for file transfer (ports 20/21), and SIP for VoIP signaling (often 5060/5061). Therefore, the protocol responsible for establishing IPsec SAs and exchanging keys is IKE (with ISAKMP as the underlying framework).

Negotiating and establishing IPsec security associations and exchanging keys for a VPN is handled by IKE, which operates within the ISAKMP framework. IKE uses UDP port 500 by default for these negotiations, making it the correct fit for setting up IPsec SAs. In some scenarios behind NAT, NAT-T can switch to UDP 4500, but the standard initial exchange occurs on port 500. The other options don’t relate to IPsec SA creation: SSH is for secure remote login (port 22), FTP for file transfer (ports 20/21), and SIP for VoIP signaling (often 5060/5061). Therefore, the protocol responsible for establishing IPsec SAs and exchanging keys is IKE (with ISAKMP as the underlying framework).