NetworkTools
Sign In
1ACLs2Zone Firewalls3IPsec4SSL VPN5802.1X6IDS/IPS7PKI
← Back to Network Security

Learning Objectives

  • Understand the IPsec protocol suite and its components
  • Differentiate ESP from AH
  • Visualize IKE phase 1 and 2 exchanges
  • Identify appropriate use cases for IPsec modes

What is IPsec?

IPsec is a suite of protocols that provides confidentiality, integrity, and authentication at the IP layer. Unlike TLS which protects specific applications, IPsec protects all IP traffic between two endpoints — making it ideal for site-to-site VPNs, remote access, and transport-mode host-to-host communication.

IPsec operates in two modes: transport mode, which encrypts only the payload, and tunnel mode, which encrypts the entire original packet and wraps it in a new IP header.

IKE: The Key Exchange

Internet Key Exchange (IKE) negotiates security associations (SAs) between peers. It has two phases. Phase 1 establishes a secure authenticated channel using either Main Mode or Aggressive Mode. Phase 2 negotiates the IPsec SAs that protect actual data traffic.

IKE Phase 1 & 2 Exchange

Peer APeer B

ESP vs AH

The two main IPsec protocols are Encapsulating Security Payload (ESP) and Authentication Header (AH). ESP provides encryption plus optional authentication. AH provides authentication only (no encryption, so it does not protect confidentiality). In modern deployments, ESP is almost always preferred because it offers both.

Match each IPsec component to its purpose.

Hints
  • ESP is the workhorse protocol for modern VPNs.
  • AH authenticates the entire packet but does not encrypt.
  • IKE is the control plane; IPsec SAs are the data plane.
Left
matches to
Right
Left
matches to
Right
Left
matches to
Right
Left
matches to
Right
Attempts: 0

When to Use Each Mode

Tunnel mode is the standard for site-to-site VPNs. The original packet is fully encapsulated with a new IP header, hiding the internal topology. Transport mode is used within a single network or between hosts — the original IP header is preserved and only the payload is protected. Transport mode is common for internal host-to-host security or when used with L2TP.

Which IPsec protocol provides both encryption and authentication?

Which IPsec mode is typically used for site-to-site VPNs?

Key Takeaways

  • IPsec provides confidentiality, integrity, and authentication at Layer 3
  • IKE Phase 1 establishes an ISAKMP SA; Phase 2 negotiates IPsec SAs
  • ESP encrypts and optionally authenticates; AH authenticates only
  • Tunnel mode encapsulates the full packet; transport mode protects only the payload
  • Modern deployments use ESP in tunnel mode for site-to-site VPNs
PreviousZone FirewallsNextSSL VPN