News / Security
2006 reporting described an IKE denial-of-service risk for Cisco VPN devices
In July 2006, a reported weakness in Internet Key Exchange version 1 raised denial-of-service concerns for Cisco VPN 3000 concentrators and other products using the protocol.
The risk was before authentication
The record said an attacker could send many legitimate-looking IKE requests until a concentrator could no longer serve normal traffic. Because the activity occurred before user authentication, ordinary login controls were not the relevant safeguard. It also warned that detection systems could have difficulty distinguishing this traffic from normal protocol use.
Treat the report as period-specific
Cisco’s security team discussed connection-admission controls as a mitigation for some IOS deployments and said a straightforward patch would be difficult because the issue involved the protocol. This is historical vulnerability reporting, not current configuration advice. Operators should use vendor-supported documentation and current advisories for any live system.