About this interactive
Setting up IPsec means choosing:
- **AH or ESP**, or both. AH was designed for integrity and authentication, ESP for encryption; ESP now does all three, so it is the usual choice.
- **Transport or tunnel mode**. Tunnel mode wraps the whole original packet in a new IP header and is the more common.
- A **cipher suite**, set the same at both ends of the tunnel:
- **Encryption**: AES, commonly.
- **Integrity**: a hash such as SHA.
- **Authentication**: a pre-shared key or RSA.
- **Key exchange**: a Diffie-Hellman group.
What you'll learn
- Sort the parts of an IPsec cipher suite by role: encryption (AES), integrity (SHA), authentication (pre-shared key or RSA) and key exchange (Diffie-Hellman)
- Explain what each role protects: the data's privacy, the data's integrity, the peer's identity and the shared key
Aligned to
Cisco CCNA
5.5
Describe IPsec remote access and site-to-site VPNs
Key terms
- Advanced Encryption Standard
AES
- A symmetric encryption algorithm widely used to secure data, supporting key sizes of 128, 192, and 256 bits.
- Secure Hash Algorithm
SHA
- Secure Hash Algorithm is a family of cryptographic hash functions standardized by NIST, including SHA-1 (deprecated for most uses), SHA-256, and SHA-3, used for data integrity verification, digital signatures, and certificate validation.
- Pre-Shared Key
PSK
- A shared secret passphrase used for authentication in wireless networks and VPNs without requiring a dedicated authentication server. In WPA-Personal mode, the PSK is used to derive the Pairwise Master Key (PMK) for encrypting the wireless session.
- Diffie-Hellman
- A key exchange algorithm that allows two parties to independently generate a shared secret over an insecure channel using two private keys, two public keys, and a shared value, without ever transmitting the secret itself.
- IPsec
- A suite of protocols that authenticates and encrypts IP packets to provide secure communication over a network.
- Encapsulating Security Payload
ESP
- An IPsec protocol that provides confidentiality, authentication, and integrity for IP packets by encrypting the payload and optionally authenticating the packet. Unlike AH, ESP encrypts the data contents, making it the more commonly used IPsec protocol for VPN deployments.
Topics
Ipsec
Cipher Suite
Encryption
Integrity
Diffie Hellman
Interactive
Categorize
About TechKnowSurge
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →