There's a particular kind of complacency that settles over a firewall config once a VPN tunnel has been "working fine for years." Nobody touches it. Nobody audits it. And that's exactly the problem, because the tunnel that's been quietly running IKEv1 since 2014 is no longer just old — it's officially dead protocol, and in 2026 it became the specific thing attackers went looking for.

Why IKEv1 is officially dead

This isn't an opinion anymore. The IETF published RFC 9395, which formally deprecates IKEv1 and moves it to Historic status. The RFC is blunt about it: IKEv1 development stopped over a decade ago, and systems still running it should be upgraded and reconfigured to run IKEv2. That's not a suggestion buried in a footnote — it's the stated purpose of the document.

National agencies have picked this up too. The UK's NCSC guidance on IPsec now states plainly that because IKEv1 was formally deprecated via RFC 9395 and moved to Historic, it strongly advises against using IKEv1 at all, full stop. If you're in a Gulf organization that maps its policies to UK or NIST frameworks — and a lot of banks, government contractors and healthcare providers here do — this is no longer a "nice to modernize eventually" item. It's a documented deviation from current best practice sitting in your network right now.

The wake-up call: a live exploit in 2026

If deprecation notices don't move budgets, exploited CVEs usually do. In June 2026, Check Point disclosed CVE-2026-50751, a critical authentication-bypass vulnerability (CVSS 9.3) affecting Check Point Remote Access VPN, Mobile Access and Spark Firewall products. The flaw is a logic bug specifically in the IKEv1 certificate-authentication path — not a generic VPN weakness, but one that only exists because IKEv1 is still enabled.

Here's the part that should genuinely worry you: Watchtowr Labs found evidence this vulnerability was actively exploited in the wild from at least May 7, 2026 — roughly a month before a patch even existed — against a few dozen targeted organizations. That's a real window where being on the internet with IKEv1 certificate auth turned on was enough to get you hit, patch or no patch. Cisco has its own history here too: published advisories cover IKEv1 fragmentation and denial-of-service issues in IOS and IOS XE, where an attacker holding valid IKEv1 VPN credentials can force a device to reload. Different vendor, same underlying lesson — IKEv1 keeps producing fresh CVEs because nobody is investing engineering effort into fixing an obsolete protocol properly. They patch it just enough to make the immediate problem go away.

Where IKEv1 still hides in Gulf networks

Ask most IT managers here if they're still running IKEv1 and the honest answer is usually "I'd have to check." That's the real risk. It hides in predictable places: the branch office router installed five or six years ago that nobody's touched since commissioning; a remote-access profile set up for a contractor who left the company but whose VPN client config never got revisited; an End-of-Life firewall image that was never upgraded because "the support contract lapsed and it still passes traffic." Small and mid-size businesses across Oman and the wider Gulf run a lot of gear well past its intended service life, and VPN configuration is one of the least-visited corners of that gear, precisely because it works silently in the background.

If you manage more than two or three sites, assume at least one tunnel or remote-access profile is still on IKEv1 until you've actually confirmed otherwise.

Pre-migration inventory: find everything before you touch anything

Don't start reconfiguring on day one. Build the inventory first. For every firewall, router and VPN concentrator in your environment, pull the running IPsec configuration and note:

• Every IKEv1 peer definition — site-to-site and remote-access — along with its phase 1 and phase 2 parameters.
• Every pre-shared key currently in use, and who besides you knows it.
• Every remote-access client profile, including ones for contractors, remote branches, and any legacy mobile VPN app installs that might still be configured for IKEv1 rather than IKEv2 or SSL VPN.
• Firmware/OS version on each device, and whether that version even supports IKEv2 properly, or needs an upgrade first.

This inventory step is tedious and nobody enjoys it. Do it anyway. Migrating tunnels you didn't know existed is how outages happen mid-project.

Step-by-step cutover checklist

Once you know what you're dealing with, the migration itself follows a fairly standard pattern regardless of vendor:

1. Stand up IKEv2 in parallel. Don't touch the existing IKEv1 tunnel yet. Configure a new IKEv2 peer alongside it, using a different phase 1 proposal, so both can coexist during the transition.
2. Decide certificates vs PSK. Pre-shared keys are simpler to deploy but weaker long-term, especially for remote-access. If you already run any kind of internal CA or Active Directory Certificate Services, use certificates for IKEv2 — it removes the shared-secret sprawl problem entirely and it's the direction most vendor documentation is now pushing.
3. Check NAT-T and MOBIKE support. Confirm NAT Traversal negotiates correctly on both ends, and if you have mobile or roaming users, verify MOBIKE is enabled so sessions survive network changes without a full re-key.
4. Stage the client rollout. Don't flip every remote-access user over at once. Move a pilot group — IT staff first, then one department — confirm stable connectivity for a few days, then expand.
5. Keep a rollback plan for the maintenance window. Schedule the actual site-to-site cutover for a defined window, keep the old IKEv1 peer configuration saved and ready to re-enable, and don't delete it until the new tunnel has proven itself under real traffic for at least a week.

Vendor-specific notes

On Cisco ASA/FTD, when you build new VPN topologies, be aware that Diffie-Hellman Group 5 is deprecated for IKEv1 and removed entirely for IKEv2, and DH groups 2 and 24 along with ciphers like 3DES and AES-GMAC are being removed from current configuration guides — don't copy old phase 1 proposals forward, build the IKEv2 policy fresh. On IOS/IOS XE, check your advisory history for the platform before assuming IKEv1 is "just legacy but harmless" — Cisco's own security advisories cover fragmentation and DoS issues where valid IKEv1 credentials let an attacker force a reload.

On MikroTik RouterOS, the cleanest approach is a dedicated IKEv2 peer profile with its own policy template group, mode-configuration, and certificate import — kept entirely separate from any legacy IKEv1 peer definition rather than trying to modify the old peer in place. It's a small extra step but it avoids the classic mistake of half-editing an existing peer and breaking both protocols at once.

On Check Point Remote Access VPN, given that CVE-2026-50751 specifically targets the IKEv1 certificate-authentication path, this is the platform where migration isn't optional homework — it's incident-response-adjacent. If you're still running IKEv1 certificate auth on Check Point gateways, that's your top-of-list item this week, not this quarter.

Post-migration hardening

Getting IKEv2 running isn't the finish line. Once every peer and client is confirmed working on IKEv2, disable the IKEv1 listener entirely on each device — don't just deprioritize it, turn it off. A dormant IKEv1 listener is still an attack surface even if nothing legitimate uses it anymore.

For algorithm choices, use NIST SP 800-77 Rev. 1 as your reference point. It documents that IKEv2 supports the full range of standardized exchange types, while IKEv1 was limited to Main Mode, Quick Mode, and the notably weaker Aggressive Mode — which is exactly the kind of exchange type you want retired along with the protocol itself. Build your new IKEv2 proposals around current-generation DH groups and AES-GCM ciphers rather than carrying forward whatever was configured a decade ago.

Finally, don't consider the project done once the tunnels are up. Add IKEv2 authentication failures and unexpected phase 1 negotiation attempts to whatever log monitoring or SIEM setup you already run. Given that the 2026 Check Point exploit ran undetected in the wild for about a month before disclosure, the organizations that noticed something was wrong early were the ones actually watching their VPN logs, not the ones who set up the tunnel once and never looked again.

Start today with one thing: pull the IPsec configuration off your edge firewall or router and search it for "IKEv1" or "ikev1-policy." If you find it, you now have a documented finding and a reason to schedule the cutover this month — not "eventually."

References

• RFC 9395 - Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms
• NCSC: Using IPsec to protect data
• Check Point Blog: Patch Critical Check Point VPN Vulnerability (CVE-2026-50751)
• Watchtowr Labs: Marking Your Own Homework (CVE-2026-50751 analysis)
• Cisco Security Advisory: IOS XE IKEv1 Denial of Service
• NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
• Cisco Firepower Management Center Configuration Guide - VPN Overview
• How to Deploy IPsec/IKEv2 on MikroTik (Medium)

Image: John Pavelka — BY (via Openverse)