What is Internet Protocol Security (IPsec)?
Internet Protocol Security (IPsec) is a standards-based suite that protects IP traffic at the network layer. The IPsec network security protocol suite can provide confidentiality, integrity, data-origin authentication, and anti-replay protection without requiring application-specific integration. Encapsulating Security Payload (ESP) provides confidentiality through encryption and can also provide integrity and authentication. Authentication Header (AH) provides integrity, authentication, and anti-replay protection, but does not encrypt traffic.
Internet Key Exchange, typically IKEv2, authenticates peers and negotiates cryptographic keys and Security Associations (SAs). Transport mode protects the IP payload while retaining the original IP header; tunnel mode encapsulates the original packet inside a new IP packet.
What is IPsec used for?
IPsec commonly secures site-to-site virtual private networks (VPNs), remote-access connections, host-to-host communications, and cloud, hybrid, or inter-network links. Sound architecture requires deliberate choices about peer authentication, cryptographic suites, key management and rekeying, SA lifetimes, interoperability, segmentation, and trust boundaries. Where network address translation is present, ESP is commonly carried using NAT Traversal (NAT-T); AH is generally incompatible with address translation because it authenticates IP-header fields that NAT changes.
IPsec does not automatically guarantee end-to-end security. Configuration mismatches, obsolete algorithms, weak key management, MTU or fragmentation problems, and inadequate monitoring can weaken deployments or disrupt connectivity. Practitioners should align policy on both peers, protect credentials and keys, monitor tunnel and SA state, and test failover and rekeying under realistic network conditions.
