TCP Port 500 – ISAKMP / IKE (IPsec Key Exchange)
Port 500 is the standard port for IKE (Internet Key Exchange), the protocol that IPsec VPN endpoints use to negotiate the cryptographic keys and security parameters that protect their tunnel. The IANA service name on this port is “isakmp” (Internet Security Association and Key Management Protocol), the framework on which IKE is built; in everyday use, the protocol on UDP/500 is called either ISAKMP, IKE, or simply “the IPsec port.”
IKE was specified in RFC 2409 in 1998 alongside the original IPsec architecture, and its successor IKEv2 was published in RFC 4306 in 2005 and updated in RFC 7296 in 2014. Both versions of IKE run on UDP/500 by default. The exchange uses UDP rather than TCP because IKE handles its own retransmission and ordering at the protocol level, and UDP simplifies traversal of stateful firewalls that would otherwise time out long-lived connections.
An important architectural detail is that port 500 only carries the key-exchange and tunnel-setup traffic, not the encrypted payload. Once IKE has negotiated a Security Association, the actual encrypted user traffic flows over ESP (Encapsulating Security Payload), which is IP protocol 50 and does not use a port number at all. This is one of the few places in modern networking where a service is defined by IP protocol number rather than port number.
When NAT is present in the network path, the picture changes. IKE detects NAT during negotiation and shifts to UDP/4500 (NAT-Traversal, registered as “ipsec-nat-t”), where both the remaining IKE messages and the ESP payload are wrapped in UDP/4500 packets that NAT devices can handle correctly. Sites with internet-facing VPN concentrators typically permit both UDP/500 and UDP/4500.
Inbound UDP/500 to a designated VPN concentrator is normal and continuous in environments that use IPsec. Inbound UDP/500 to any other host is unusual. TCP/500 is also registered in the IANA registry but is not used in practice; IKE is a UDP-only protocol.
About TCP Port 500
Port 500 carries the IANA assignment for isakmp. The IANA description reads: ‘isakmp’.
Security Considerations
Our data shows 23 IDS rules referencing port 500, all on UDP, covering a mix of historical IKE implementation bugs, IPsec-aware reconnaissance, and broader policy detection.
The largest cluster is the ISAKMP payload certificate-request length-overflow rules (sample SIDs 2376 through 2380), which detect attempts to exploit buffer overflow vulnerabilities in IKE implementations from the early 2000s. Multiple major VPN vendors had ISAKMP parser bugs disclosed in that era, and crafted IKE messages with malformed payload lengths could crash or take over the negotiating endpoint. The rules persist for legacy detection and for catching exploit attempts against unpatched VPN devices that still appear in some networks.
A separate category of rules detects ISAKMP behaviors associated with reconnaissance and policy probing. Sample rules detect ISAKMP delete-hash messages with empty hash fields (a known abuse pattern), failed-login signatures used by VPN-credential scanning tools, and a PGPNet connection-attempt indicator dating to the era when several non-standard IPsec implementations were in active deployment. Trojan-activity-classified rules in the dataset reflect malware that historically used IKE-style traffic patterns either as cover or as part of compromise of internet-facing VPN appliances.
Beyond the rule data, the largest ongoing concern with IKE deployments is the long-known weakness in IKEv1 Aggressive Mode with pre-shared key authentication. In Aggressive Mode, the responder sends the hash of the PSK in the first response message, and an attacker who can capture or trigger that message can perform offline brute-force against the PSK without further interaction with the VPN. Modern best practice is to use IKEv2 (which does not have this weakness), to prefer certificate-based authentication over PSK, and where PSK must be used with IKEv1, to require Main Mode rather than Aggressive Mode.
Defensive practice for a VPN concentrator on port 500 includes restricting which source addresses are allowed to initiate IKE (where feasible), keeping the VPN device firmware patched, using IKEv2 with strong authentication, monitoring for IKE-credential brute-force attempts, and ensuring any internet-exposed VPN device’s management interface is not also reachable from the public internet.
Inbound UDP/500 to a designated VPN concentrator is normal. Inbound UDP/500 to any other host is unusual and worth investigating.
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).