Cisco ASA Site-to-Site IKEv1 IPsec VPN Dynamic Peers

Hello Daniel

Main mode uses a six-way handshake where parameters are exchanged in multiple exchanges with encrypted authentication information. Agressive mode on the other hand is considered less secure because it sends the hashed preshared key to the client in a single unencrypted message, a fact that makes this option comparatively more vulnerable.

Aggressive mode is obviously faster than main mode and is required for certain cases such as described in this lesson. For this reason, it is vital that the preshared key that is used be complex enough to protect such a connection from brute force attacks.

If the preshared key is complex enough, aggressive mode provides sufficient security for most implementations. If however security is paramount in your particular application, you should ensure that the appropriate infrastructure is available to support main mode.

Yes, you can configure aggressive mode on Cisco IOS routers as well as on the ASA. Although this is an old document, you can see how this can be accomplished at the following link:

I hope this has been helpful!

Laz