DataTerminology.comNEW
Also known as: IPSec VPN
A VPN that uses the IPsec protocol suite to authenticate and encrypt IP traffic between hosts or gateways.
DESCRIPTION
An IPsec VPN applies IP-layer cryptographic protection to traffic between endpoints, commonly gateways connecting sites or clients to networks. It uses IKE for key exchange, ESP for confidentiality/integrity, and optionally AH for integrity-only. IPsec supports tunnel and transport modes, enabling both site-to-site and host-to-site designs. With NAT-T, it traverses NAT devices using UDP encapsulation. Proper cipher suites, certificate management, and rekey policies are crucial for security and reliability.
ALTERNATIVE DEFINITIONS
NIST
IPsec VPNs use the IPsec protocol suite to protect IP traffic between hosts, between security gateways, or between a security gateway and a host.
Authoritative guidance explicitly enumerating protected endpoint scenarios.
Cisco
An IPsec VPN is a group of protocols that negotiate keys and encrypt IP packets to create secure tunnels between endpoints.
Highlights negotiation and packet-level encryption aspects.
Microsoft Azure
IPsec provides standards-based encryption and integrity for VPN connections between Azure and on-premises networks.
Cloud-focused description linking IPsec to hybrid scenarios.
RELATED TERMS
IPsec Protocol Suite IKEv2 ESP AH Tunnel Mode Transport Mode Site-to-Site VPN Remote Access VPN NAT Traversal
COMPETING TERMS
KNOWLEDGE AREAS
Data Security Infrastructure Cloud
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Cloud Architect IT Manager Chief Information Security Officer
EXTERNAL SOURCES
- Wikipedia - IPsec#Virtual private networks
- IETF - IPsec architecture standard
- IETF - IKEv2 key exchange standard
- NIST - Guide to IPsec VPNs
TOP QUESTIONS
What differentiates an Internet Protocol Security VPN from an SSL/TLS VPN?
IPsec protects IP at the network layer, enabling site-to-site tunnels. SSL/TLS VPN focuses on transport/app layers, often enabling clientless access.
Category: Example
Which algorithms are common in Internet Protocol Security VPNs?
AES-GCM for ESP, SHA-2 for integrity, and ECDH for key exchange are common. Avoid legacy algorithms like 3DES and MD5.
Category: Requirements
How does NAT traversal work in an Internet Protocol Security VPN?
NAT-T encapsulates ESP in UDP, typically on port 4500, allowing traversal through NAT devices.
Category: Example
What are common mistakes in deploying Internet Protocol Security VPNs?
Mismatched proposals, weak pre-shared keys, and not using certificates are frequent errors. Monitor rekey intervals and lifetimes.
Category: Mistakes
Is Internet Protocol Security VPN suitable for remote access?
Yes, with client software using IKEv2/IPsec. Many enterprises use both remote access and site-to-site IPsec.
Category: Relevancy
How do you scale Internet Protocol Security VPNs?
Use route-based tunnels, high-availability pairs, BGP over IPsec, and hardware acceleration. Segment tunnels by domain.
Category: Management
What logs are essential in Internet Protocol Security VPN troubleshooting?
IKE negotiation, ESP sequence counters, and SA lifetimes are critical. Packet captures confirm encapsulation and NAT-T.
Category: Requirements
When should you choose Internet Protocol Security VPN over TLS VPN?
Choose IPsec for site-to-site, full network connectivity, or when routing protocols must traverse tunnels.
Category: Opinion
What is the security posture of Internet Protocol Security VPNs today?
Strong when using modern suites, short lifetimes, and MFA. Poor choices or PSKs harm assurance.
Category: Risks