After going through many videos I must say this is best explained on the internet about IPsec messages. Sir, could you please make one video on quick mode messages as well.
Your way of explanation is osum to understand. Could you clarify the below query? In MM5, we encrypt the hash + ID I. If I use NAT device then the responder will do the hash matching with the Natted ip only. So hash will fail know. So, please explain
If Both peer IP known and fixed, we can go for Main Mode. But what if remote end ip gets changed by ISP frequently or its not fixed, like HUB-SPOKE. I mean to say we dont know the fixed IP, we can use identity as HOSTNAME/FQDN. and for spoke side ,HUB has fixed ip. But for HUB side, spoke doesn't have fixed ip, its dynamic. we can use aggressive mode site to site.