IPsec

networkingsecurity

The standard suite for encrypting and authenticating IP traffic, powering most site-to-site VPNs; keys are negotiated by IKE.

Two modes: transport protects the payload, tunnel wraps the whole packet - site-to-site VPNs live in the second.

IPsec secures traffic at the network layer, which is what makes it different from TLS in a way that matters operationally. TLS protects one connection between two applications that both know they are using it. IPsec protects everything between two endpoints, transparently, including protocols that have no security of their own, which is why it underpins site-to-site VPNs.

It is really two things working together, and conflating them causes most confusion. IKE negotiates: it authenticates the peers and establishes the keys. ESP then does the actual encryption and integrity protection of packets. When a tunnel fails, the useful first question is which phase failed, because a phase one failure means the peers could not agree on identity or parameters while a phase two failure means they agreed on who they are and not on what to protect.

The classic operational trap is fragmentation. Encapsulation adds overhead, the effective MTU shrinks, and if path MTU discovery is blocked the symptom is a tunnel that comes up cleanly and then hangs on large transfers. That signature, small things work and big things fail, points at MSS clamping far more often than at the tunnel itself.

← All glossary entries