{
  "port": 500,
  "protocol": "both",
  "service": "ISAKMP / IKE (IPsec key exchange)",
  "oneLiner": "IKE — the key negotiation in front of every IPsec VPN, and the port that identifies a VPN concentrator.",
  "whatItIs": "IKE runs over UDP 500 to authenticate the two peers and negotiate the keys and security associations that the IPsec ESP tunnel then uses; ISAKMP (RFC 2408) defined the original framework and IKEv2 (RFC 7296) is what current implementations speak. When a NAT sits in the path, peers detect it during the exchange and move to UDP 4500 with UDP encapsulation. IANA registers 500 for TCP as well, but the protocol is UDP in practice. An open 500 on a public address is a firewall, router, or VPN gateway doing exactly its job.",
  "exposure": {
    "verdict": "fine",
    "note": "Public by design for site-to-site and remote-access VPN. Two caveats: IKEv1 aggressive mode with a pre-shared key hands an offline-crackable hash to any prober, and the handshake can be abused for UDP reflection — use IKEv2 with certificates and rate-limit the port."
  },
  "checkCommand": "nmap -sU -p 500 --script ike-version TARGET",
  "links": [
    {
      "title": "RFC 7296 — Internet Key Exchange Protocol Version 2 (IKEv2)",
      "url": "https://www.rfc-editor.org/rfc/rfc7296.html",
      "kind": "spec"
    },
    {
      "title": "RFC 2408 — Internet Security Association and Key Management Protocol (ISAKMP)",
      "url": "https://www.rfc-editor.org/rfc/rfc2408.html",
      "kind": "spec"
    },
    {
      "title": "strongswan/strongswan — IKEv1/IKEv2 daemon",
      "url": "https://github.com/strongswan/strongswan",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 500",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=500",
      "kind": "iana"
    }
  ],
  "ianaName": "isakmp"
}