🧱IPsec

NEW

A standards-based suite that provides authentication, integrity, and encryption for IP traffic at the network layer.

DESCRIPTION

Internet Protocol Security (IPsec) defines mechanisms to protect IP traffic using cryptographic services. Core components include IKE for negotiation and key management, ESP for encryption/integrity, and AH for integrity-only. It operates in transport or tunnel mode, supporting host-to-host and gateway-to-gateway protection. IPsec underpins many site-to-site and remote-access VPNs. Correct algorithm selection and certificate-based authentication are essential for modern security.

ALTERNATIVE DEFINITIONS

IETF

This document describes an updated version of the Security Architecture for the Internet Protocol, and defines the services and mechanisms for IPsec.

Defines architecture and mechanisms at the IP layer from the standard.

Source

NIST

IPsec is a suite of protocols that provides cryptographic protection for IP traffic through authentication, integrity, and encryption services.

Summarizes IPsec services from federal guidance.

Source

Cisco

IPsec is a framework of open standards that provides data confidentiality, data integrity, and data origin authentication between IP devices.

Vendor-oriented description stressing confidentiality, integrity, and origin authentication.

Source

RELATED TERMS

IKEv2 ESP AH Virtual Private Network Tunnel Mode Transport Mode NAT Traversal RFC 4301

COMPETING TERMS

TLS

KNOWLEDGE AREAS

Data Security Infrastructure

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Cloud Architect Chief Information Security Officer

EXTERNAL SOURCES

• Wikipedia - IPsec
• IETF - IPsec architecture RFC
• IETF - IKEv2 key management RFC
• NIST - NIST guide to IPsec VPNs

TOP QUESTIONS

What problems does IPsec solve?

It secures IP traffic with authentication, integrity, and encryption. It enables private communications over untrusted networks.

Category: Relevancy

What is the difference between ESP and AH in IPsec?

ESP provides encryption and integrity; AH provides integrity and authentication only. ESP is more commonly used.

Category: Example

How does IKEv2 relate to IPsec?

IKEv2 negotiates security associations and keys for IPsec. It is essential for automation and rekeying.

Category: Requirements

What are common IPsec cipher suites today?

AES-GCM with SHA-2 and ECDH is common. Avoid deprecated algorithms like 3DES and MD5.

Category: Requirements

Does IPsec work with NAT?

Yes, via NAT Traversal encapsulating ESP in UDP 4500. This is widely supported.

Category: Example

What is the biggest misunderstanding about IPsec?

People assume any IPsec is secure; poor parameters or PSKs undermine it. Certificates and modern suites are crucial.

Category: Misunderstanding

How is IPsec monitored in production?

Monitor SA lifetimes, IKE negotiations, packet counters, and drops. Use logs and metrics for rekey events.

Category: Management

When should you use transport vs tunnel mode in IPsec?

Use transport for host-to-host, tunnel for network-to-network. Tunnel is typical for site-to-site VPNs.

Category: Opinion

What standards define IPsec?

Core is RFC 4301 (architecture), with RFCs for ESP, AH, and IKEv2 (RFC 7296).

Category: Example