IKE supports client negotiation. Client mode is where the negotiating parties are not the endpoints for which security association negotiation is taking place. When used in client mode, the identities of the end parties remain hidden.

Before going into the RFC 2049 details, it must be understood that IKE is not yet fully deployed on the Internet because the total system is still under development. Parts of it (like 2049) seem relatively stable, but other parts (like the specific hash function to be used in IKE) are still in the draft stages. Also, there is not a distributed PKI yet that is available to all. A VPN can use the overall framework of IKE, but must look at a specific implementation to make sure that it will perform as needed.