DataTerminology.comNEW
A set of standards providing authentication, integrity, and encryption for IP traffic via AH, ESP, and IKE components.
DESCRIPTION
IPsec secures IP communications at the network layer using Authentication Header (AH) and Encapsulating Security Payload (ESP). Key management and negotiation are handled by IKE, with IKEv2 widely used. It supports transport and tunnel modes, enabling end‑to‑end or site‑to‑site VPNs. Policy, security associations, and selectors govern which traffic is protected. IPsec integrates with NAT via NAT‑T and can leverage certificates for authentication. Alternatives like TLS‑based VPNs and WireGuard offer different trade‑offs in simplicity and performance.
ALTERNATIVE DEFINITIONS
IETF RFC 4301
This document specifies the security architecture for IP, including security services, security protocols, key management, and algorithms used by IPsec.
Defines overarching architecture, services, and policy constructs.
IETF RFC 6071
This document provides an overview of security technologies for the Internet, discussing IPsec, SSL/TLS, and other mechanisms.
Compares IPsec with other Internet security technologies.
RELATED TERMS
IKEv2 AH ESP Tunnel Mode Transport Mode NAT-T Security Association SPD SAD Virtual Private Network
COMPETING TERMS
RELATIONS
- Narrower: Authentication Header
KNOWLEDGE AREAS
Data Security Infrastructure Software Engineering
TARGET AUDIENCE
Cybersecurity Engineer Security Architect IT Manager Chief Information Security Officer Solution Architect
EXTERNAL SOURCES
- Wikipedia - IPsec
- IETF RFC 4301 - Core IPsec security architecture specification.
- IETF RFC 7296 - IKEv2 protocol specification for IPsec key management.
TOP QUESTIONS
What does IPsec protect?
It protects IP packets by providing authentication, integrity, and optional encryption at the network layer.
Category: Example
How is IPsec different from TLS?
IPsec secures at the network layer for packet flows, while TLS secures application‑level connections like HTTPS.
Category: Alternatives
What components make up IPsec?
AH and ESP provide packet protection, while IKE handles key exchange and negotiation.
Category: Example
What are common mistakes deploying IPsec?
Misconfigured selectors, weak authentication, or inconsistent policies can break tunnels or reduce security.
Category: Mistakes
What risks exist with IPsec?
Complexity and misconfiguration can cause outages or expose traffic; robust monitoring and testing are crucial.
Category: Risks
How is IPsec managed operationally?
Define clear SPD policies, maintain certificates or preshared keys, and monitor SAs and tunnel health.
Category: Management
What is tunnel mode in IPsec?
Encapsulates entire IP packets to create site‑to‑site VPNs between gateways.
Category: Example
What is transport mode in IPsec?
Protects payloads between endpoints while leaving original IP headers intact.
Category: Example
What are notable alternatives to IPsec?
WireGuard emphasizes simplicity and performance; TLS‑based VPNs are easier to traverse NAT and proxies.
Category: Alternatives