IPsec explained
IPsec (Internet Protocol Security) is a suite of protocols that encrypts and authenticates internet traffic at the network layer (Layer 3). It secures communication between devices by protecting IP packets as they travel across untrusted networks such as the public internet.
IPsec is most commonly used to create VPN (Virtual Private Network) connections, including:
- Site-to-site VPNs between offices
- Remote access VPNs for employees
- Cloud VPN connections between data centers and cloud platforms
By encrypting traffic and verifying the identity of communicating devices, IPsec ensures that sensitive data cannot be intercepted, modified, or replayed by attackers.
Why is IPsec important?
The standard Internet Protocol (IP) does not include built-in encryption or authentication. This means that data sent over public networks can potentially be intercepted.
IPsec solves this problem by providing:
- Encryption – protects data from eavesdropping
- Authentication – verifies the identity of communicating devices
- Integrity protection – ensures data is not modified during transmission
- Anti-replay protection – prevents attackers from reusing captured packets
Because of these capabilities, IPsec is widely used in enterprise networks, cloud environments, and VPN services.
How does IPsec work?
IPsec works by establishing a secure tunnel between two endpoints (such as routers, firewalls, or servers). Once the tunnel is created, all selected network traffic is encrypted before being transmitted.
The process typically follows these steps:
- Negotiation – devices agree on encryption methods and security parameters
- Authentication – each endpoint verifies the other using certificates or shared keys
- Key exchange – cryptographic keys are generated securely
- Encrypted communication – traffic is encapsulated and protected
- Rekeying – keys are refreshed periodically to maintain security
This process is managed through Security Associations (SAs) that define how traffic is protected.
What protocols are used in IPsec?
IPsec relies on several protocols that work together to secure traffic.
Encapsulating Security Payload (ESP)
ESP is the most commonly used IPsec protocol. It provides:
- Encryption of data
- Integrity checking
- Authentication of packet origin
- Anti-replay protection
Most modern IPsec deployments use ESP instead of AH.
Authentication Header (AH)
AH provides packet authentication and integrity, but it does not encrypt the payload.
Because AH does not work well with NAT (Network Address Translation), it is rarely used in modern networks.
Internet Key Exchange (IKE)
IKE manages key exchange and authentication between devices before a secure tunnel is created.
Modern deployments use IKEv2, which improves reliability and NAT compatibility.
IPsec tunnel mode vs transport mode
IPsec supports two operating modes depending on how traffic is protected.
Tunnel mode
In tunnel mode, the entire original IP packet is encrypted and encapsulated within a new packet.
This mode is commonly used for:
- Site-to-site VPNs
- Cloud VPN connections
- Gateway-to-gateway communication
Transport mode
In transport mode, only the payload of the packet is encrypted, while the original IP header remains visible.
This mode is typically used for:
- Host-to-host communication
- Server-to-server encryption
What ports does IPsec use?
IPsec uses several protocols and ports depending on configuration:
When network address translation is present, IPsec often uses NAT Traversal (NAT-T), which encapsulates ESP traffic inside UDP packets.
What is an IPsec VPN?
An IPsec VPN is a virtual private network that uses IPsec protocols to encrypt traffic between endpoints over the internet.
Common IPsec VPN deployments include:
- Site-to-site VPN – connects multiple office networks
- Remote access VPN – allows employees to securely access corporate resources
- Cloud VPN – connects on-prem infrastructure with cloud environments
Major cloud providers such as AWS, Microsoft Azure, and Google Cloud offer managed IPsec VPN services.
IPsec vs SSL VPN: What are the differences
IPsec VPNs and SSL/TLS VPNs both secure remote access, but they operate at different layers.
Organizations often deploy both technologies depending on their networking needs.
Key takeaways
- IPsec is a network-layer protocol suite that secures IP communications.
- It is widely used to build VPN connections between networks, users, and cloud environments.
- IPsec relies on IKE, ESP, and optionally AH to authenticate and encrypt traffic.
- It supports tunnel mode and transport mode for different deployment scenarios.
- IPsec remains a core technology for enterprise networking and hybrid cloud connectivity.
