Aggressive Mode

Aggressive Mode

As the name implies, in the Aggressive mode, only a single three-way exchange is performed. In the initial exchange, the sender defines the proposed IKE SA values and adds their DH public key, a nonce to be signed by the other party, and an identity packet to verify their identity via a third party.

The peer sends everything back that’s required to complete the exchange, plus their DH public key. The only thing left is for the initiator to confirm the exchange.

While Aggressive mode is faster than Main mode, it exposes the peers to discovery because both sides have exchanged information before you have a secure channel. The possibility exists to sniff the wire and discover who formed the new SA.