What is IPsec, and which security services does it provide?
Show the answer
Say this first
IPsec is a framework of protocols that protects IP packets at the network layer, so every application above it is covered without changes. It provides confidentiality (encryption), integrity, data origin authentication and anti-replay protection. The parts are IKE, which authenticates the peers and agrees keys; ESP (and rarely AH), which protects the packets; and security associations, which record what was agreed for each direction.
Go deeper
Service by service
| Service | How IPsec delivers it |
|---|---|
| Confidentiality | ESP cipher, for example AES |
| Integrity | HMAC (SHA-256 and up) or an AEAD cipher such as AES-GCM |
| Origin authentication | Keys only the two authenticated peers know, agreed after a PSK or certificate check in IKE |
| Anti-replay | ESP sequence numbers checked against a sliding window |
Why "framework"
The algorithms are pluggable and negotiated per tunnel: cipher, integrity, Diffie-Hellman group, lifetimes. The architecture is RFC 4301; ESP is RFC 4303; IKEv2 is RFC 7296.
Where you meet it
Site-to-site VPNs, remote-access clients, cloud VPN gateways, and as the authentication method for OSPFv3.
They will ask next
Does IPsec hide that a VPN exists?
No. An observer sees IKE on UDP 500 or 4500 and ESP between the two gateways, plus packet sizes and timing. Tunnel mode hides the inner addresses, ports and payload, nothing more.
Is IPsec mandatory in IPv6?
It was originally a "must implement" for IPv6 nodes. RFC 6434 relaxed that to "should". Using it has always been optional, so IPv6 traffic is not encrypted by default.
Traps
- Saying IKE encrypts the user data. IKE negotiates and authenticates; ESP encrypts the data packets.