IKEv2 (Internet Key Exchange version 2) is the standard protocol that sets up IPsec VPN connections; it is valued on phones because it can keep a VPN alive when the network changes.
Explanation
IKEv2 does the negotiating part of an IPsec VPN: the two sides authenticate each other, agree keys, and IPsec then encrypts the traffic. It is an IETF standard (RFC 7296), so it is built into iOS, macOS, Windows and many Android phones, and companies can deploy it without installing a separate client. Its best-known feature comes from the MOBIKE extension (RFC 4555): when a phone moves from Wi-Fi to mobile data, the VPN updates its address and carries on instead of tearing the tunnel down and starting again. That makes IKEv2 a comfortable choice for people who are always on the move. The weak point is how it travels. IKEv2 needs UDP port 500, and port 4500 when NAT is involved, and both are easy for a firewall to block. On hotel, school or national networks that do this, IKEv2 simply fails to connect, while VPNs that can fall back to TCP 443 or a web proxy using ordinary HTTPS may still work. Its traffic is also clearly identifiable as IPsec, so it offers no disguise against deep packet inspection.
In practice
IKEv2 is defined in RFC 7296 and sets up IPsec VPN connections over UDP ports 500 and 4500. With the MOBIKE extension (RFC 4555) it keeps a session alive when a phone switches between Wi-Fi and mobile data, which is why it is the built-in VPN type on iOS and many phones. The fixed ports are its weakness: a network that blocks UDP 500 and 4500 stops it completely.
Sources: RFC 7296 — IKEv2 · RFC 4555 — MOBIKE
Questions about IKEv2
Related terms