Definition and purpose of IPsec
IPsec (Internet Protocol Security) is a set of standards for securing IP network traffic. In practical terms, it helps protect the confidentiality (encryption) and integrity/authenticity (cryptographic checks) of packets exchanged between two endpoints or between networks.
IPsec is not a single “one switch” feature; it’s a framework made of multiple components that work together: packet protection mechanisms, policies that decide what to protect, and key/parameter management that establishes the cryptographic context.
A simple model: Security Associations and packet protection
A helpful way to understand IPsec is to separate “what to protect” from “how to protect it.”
- What to protect is defined by security policy rules (for example, which source/destination traffic should be protected, and with what general requirements).
- How to protect it is implemented using Security Associations (SAs). An SA is essentially the active agreement that says which encryption and integrity algorithms to use and what keys are in effect for that protected traffic.
When IPsec is protecting traffic, it applies cryptographic operations to the IP packets. Depending on configuration, this can include:
- Encryption to reduce the risk of eavesdropping.
- Integrity protection to detect tampering.
- Authentication to help confirm that the traffic comes from the expected party.
Because SAs are tied to specific traffic flows and cryptographic choices, changes in keys or algorithms typically require establishing or updating SAs.
Modes: Transport vs tunnel
IPsec can protect traffic in different ways depending on the desired scope.
- Transport mode protects the payload (and/or relevant headers) while keeping the original IP header structure more intact.
- Tunnel mode encapsulates the original IP packet inside a new IP packet, so that the outer IP header can be used to carry the protected “tunneled” data.
A common rule of thumb is: transport mode is often used when securing host-to-host communication, while tunnel mode is often used when securing network-to-network links or when you want the endpoints to appear as specific gateway addresses on the outer layer. The exact choice depends on the scenario and how the endpoints are set up.
Key management and endpoints
IPsec requires a way to set up and refresh the cryptographic parameters used by SAs. Many real deployments use a key management approach (commonly involving an “IKE” component) so that endpoints can:
- negotiate algorithms and lifetimes,
- authenticate each other,
- derive session keys,
- and create/update SAs.
The important limitation to keep in mind is that IPsec’s security properties depend on correct key management and policy configuration. If endpoints are misconfigured or authentication/key exchange is weak or improperly implemented, the protection may be reduced even if “IPsec is enabled.”
Differences, limits, and what you can verify
IPsec is often compared with other VPN/protocol options, but the core differentiator is that IPsec is designed around protecting IP packet flows with well-defined cryptographic mechanisms and security policies.
Relevant limits and exceptions you should consider:
- Scope depends on policy/SAs. Only traffic that matches the configured selectors/policies will be protected.
- Traffic behavior can change. Encryption and encapsulation affect how packets look on the wire and can influence debugging, latency, and failure modes.
- Interoperability depends on choices. Both endpoints must agree on compatible algorithms and parameters.
What you can check in your own environment (without assuming a specific product):
- Whether IPsec policies/selectors match the exact traffic you expect.
- Whether the endpoints negotiate and maintain SAs (and whether keys are being refreshed as intended).
- Whether authentication method and certificate/secret management (if used) are configured consistently across peers.
If any of these pieces don’t line up, you may see partial protection, negotiation failures, or traffic that bypasses IPsec entirely.