I want to ask you for information about the IKEv2 protocol for a VPN connection. I haven't found so much information on the web. I am interested especially regarding the usage on a mobile phone. Is it as secure as the OpenVPN protocol? If yes, could you suggest me some VPN providers that allow to use the IKEv2 protocol?
OpenVPN vs IPSEC:
- IPSEC needs more time to negotiate the tunnel;
- OpenVPN uses strong ciphers and TLS ; (at the present moment it is considered to be the strongest encryption);
- Single port for OpenVPN and option to choose between UDP or TCP.
- Multiple ports/protocols for IPSEC;
- IPSEC can not handle NAT. (needs public IP address on both sides Otherwise), L2TP required. OpenVPN can easily act over NAT;
- OpenVPN can have multiple instances and IPSEC can be established only for single ip addresses pair.
- OpenVPN can be used both as L2 and L3 class.
I am using both IPSEC and OpenVPN infrastructure connections, but OpenVPN shows much better stability and flexibility.
IKE itself is just key exchange protocol, providing secure session keys negotiation. It works together with encryption and authentication modules. So, IKE itself just provides session with secure keys. Moreover, it was developed on far 2005. It is oftenly being used together with ESP and AH protocols.
OpenVPN is an open source project that is growing up fast and being developed also by community.
Mobile devices have native SSL/TLS support and OpenVPN implementation is preferable for Mobile usage for following reasons:
- Mobile internet does not provide fixed IP address that is a problem for IPSEC, having IKEv2 - need to use dDNS or buy public IP address. L2TP that provides transport level for IPSEC uses fixed port and can be blocked by some firewalls;
- OpenVPN is easy to configure and flexible in its usage - modern versions (higher than 2.2) use TLSv1.X. It is possible to use multi-level authentication with client certificates, passwords and secure key if needed. Server can be easily set up to listen any port;
- Mobile Applications for OpenVPN exist for Android and iOS - it has limitations only with Windows based systems.
- OpenVPN considered to be slower than IPSEC. However, OpenVPN is not sensitive to hosts time sync, public ip existence, needs only one free to choose port.
Hope, it helps.
OpenVPN uses SSL/TLS for it's secure protocol which secures data at the Transport level, while IKEv2/IPSec secures data at the IP level. Both protocols are secure. You can see this answer for comparing the two protocols for VPN use.
The iPhone also has an OpenVPN app, but IPSec (IKEv1 & v2) is supported natively (before iOS 9, IKEv2 didn't have a configuration GUI and required a configuration profile).
IPSec / IKEv2 are so customizable I have a hard time believing that OpenVPN can support any cipher suite that for example StrongSwan can't, I think the supported suit list is big enough x'D. I guess the more problematic issue here are the claims that NSA has been trying to weaken the standard from the beginning.
I agree with some of the info from @ETech in the previous answer, particularly on the bummer that is IPSec traffic being so easily blocked, specially compared to OpenVPN, even if NAT-Traversal helps with some situations (it's not so black and white as you put it, IMO)
I have not idea what you mean on point 6 you can setup almost anything imaginable with as many endpoints and gateways as you want.
About mobility, you can use Mobike for a very stable connection on mobile devices, and even you aren't using mobike, you can definitely have a dynamic IP on one of the sides of the connection (eg the phone). I have used both and honestly after you set it up, it just works (apart from the many times you find yourself with NAT/Fw related issues).
One possible example of configuration with the config files if you wish to test it can be found in the official StrongSwan site