The VPN gateway must use IKE main mode for the purpose of negotiating an IPSec security association policy when pre-shared keys are used for authentication
Aggressive mode is completed using only three messages instead of the six used in main mode. Essentially, all the information needed to generate the Diffie-Hellman secret is exchanged in the first two messages exchanged between the two peers. The identity of the peer is also exchanged in the first two packets which have been sent in the clear. There are risks to configurations that use pre-shared keys which are exaggerated when aggressive mode is used. The entire session may be intercepted and manipulated. An adversary can either use a pre-shared key to impersonate a trusted end-point or client and connect to the protected network, or it can mount a Man-in-the-Middle attack on any new session.
Configure the VPN gateway to ensure aggressive mode is disabled for all IKE Phase 1 security associations.
Examine all ISAKMP profiles configured on the VPN gateway to verify aggressive mode has not been defined for IKE Phase 1 Security Association. Aggressive mode could also be configured globally which would make it applicable to all IKE sessions.
Information Assurance Officer