nerdexam
Fortinet

NSE4 · Question #46

Which IPsec mode includes the peer id information in the first packet?

The correct answer is C. Aggressive mode. Aggressive mode in IKEv1 is the specific IPsec mode that includes the peer ID information in the very first packet of the negotiation, making it visible before encryption.

Submitted by satoshi_tk· Apr 18, 2026VPN and Routing

Question

Which IPsec mode includes the peer id information in the first packet?

Options

  • AMain mode.
  • BQuick mode.
  • CAggressive mode.
  • DIKEv2 mode.

How the community answered

(60 responses)
  • A
    5% (3)
  • B
    2% (1)
  • C
    90% (54)
  • D
    3% (2)

Why each option

Aggressive mode in IKEv1 is the specific IPsec mode that includes the peer ID information in the very first packet of the negotiation, making it visible before encryption.

AMain mode.

Main mode in IKEv1 uses a six-packet exchange where the peer's identity is encrypted and sent within the third and fourth packets, thus protecting it from eavesdropping.

BQuick mode.

Quick mode is part of IKE Phase 2, which establishes the IPsec Security Association for data encryption and does not involve the initial peer identification process.

CAggressive mode.Correct

Aggressive mode is an IKEv1 Phase 1 negotiation method where the initiator sends its identity payload (IDi) and other security parameters in the initial packet. This allows for a faster three-packet exchange but means the peer's identity is transmitted unencrypted in that first packet.

DIKEv2 mode.

While IKEv2 is a newer version of the IKE protocol, it has its own exchange types, and the characteristic of sending the peer ID unencrypted in the *first* packet is a specific feature of IKEv1 Aggressive Mode.

Concept tested: IKEv1 Aggressive Mode peer ID

Source: https://www.cisco.com/c/en/us/support/docs/ip/ipsec/13876-ipsec-debug.html

Topics

#IPsec#IKEv1#Aggressive Mode#Peer Identification

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice