500 IKE/IPsec UDP

What it's for

Port 500 is used by IKE (Internet Key Exchange), the protocol that negotiates and manages the security keys for IPsec VPN connections. Before two endpoints (say, a branch office router and a corporate data center) can start encrypting traffic between them with IPsec, they use IKE on port 500 to authenticate each other and agree on the cryptographic parameters and keys they'll use.

Protocol basics

IKE runs over UDP, handling the key negotiation phase before any actual encrypted IPsec traffic flows. Once negotiation completes, the encrypted data itself typically travels using IPsec's ESP protocol (not TCP or UDP in the traditional sense, but its own IP protocol number), though NAT traversal scenarios often encapsulate this traffic inside UDP (commonly port 4500) to get through devices that don't handle raw ESP well. Because port 500 is exposed on any site-to-site or client VPN gateway, it needs the same hardening attention as other authentication-adjacent ports — strong pre-shared keys or certificate-based authentication, and monitoring for unusual negotiation attempts.