TechKnowSurge
Cisco CCNA 5.5
TechKnowSurge Catalog Videos IPSec
VideoNetworkFree

IPSec

IPsec is a suite of protocols designed to secure IP traffic between networks by encrypting and authenticating communications across tunnels. Key configuration decisions include choosing between Authentication Header and Encapsulating Security Payload, selecting transport or tunnel mode, and defining a cipher suite.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

IPsec is a framework of protocols and standards designed to protect IP traffic as it travels across networks, most commonly used to establish secure site-to-site tunnels between two locations. Rather than a single specification, IPsec encompasses a wide range of interrelated standards, and configuring it requires a series of deliberate decisions about how traffic will be protected. The two primary protocol options are Authentication Header (AH) and Encapsulating Security Payload (ESP). AH was originally designed for integrity and authentication, while ESP was designed for encryption, but because most implementations needed both capabilities, ESP has since incorporated authentication and integrity functions, making it the dominant choice in practice. IPsec also offers two modes of operation. In transport mode, a layer-three header suited to IPsec is constructed when the packet is first assembled. In tunnel mode, an existing packet is taken and wrapped with an ESP header and trailer, effectively encapsulating it for transmission across the tunnel. Both AH and ESP support these two modes, giving administrators flexibility depending on the network architecture and security requirements. Once the protocol and mode are selected, the final step is defining a cipher suite — a combination of an encryption algorithm such as AES, an integrity algorithm such as SHA, an authentication method such as a pre-shared key or RSA, and a key exchange protocol such as Diffie-Hellman. This cipher suite is configured identically on both tunnel endpoints, enabling the two devices to negotiate and establish a secure connection. The result is an encrypted, authenticated tunnel through which traffic between separate networks can pass securely, making IPsec one of the most widely deployed technologies for site-to-site VPN connectivity.

What you'll learn

What's covered

IPsec Overview

Aligned to

Cisco CCNA
5.5 Describe IPsec remote access and site-to-site VPNs

Key terms

IPsec
A suite of protocols that authenticates and encrypts IP packets to provide secure communication over a network.
Authentication
The process of verifying the identity of a user, device, or system.
Encryption
The process of converting readable data into an unreadable format using an algorithm and key to prevent unauthorized access.
Encapsulation
The process of wrapping data with protocol headers as it passes down the layers of the OSI model.
Advanced Encryption Standard
AES
A symmetric encryption algorithm widely used to secure data, supporting key sizes of 128, 192, and 256 bits.
Key Exchange
A method used to securely share cryptographic keys between parties over an insecure channel.
Authentication Header
AH
An IPsec protocol that provides authentication and integrity checking for IP packets without encrypting the payload. AH ensures that packet contents have not been altered in transit and verifies the source of the packet.
Encapsulating Security Payload
ESP
An IPsec protocol that provides confidentiality, authentication, and integrity for IP packets by encrypting the payload and optionally authenticating the packet. Unlike AH, ESP encrypts the data contents, making it the more commonly used IPsec protocol for VPN deployments.
IPsec Transport Mode
An IPsec mode that protects the payload of an IP packet while retaining the original IP header for end-to-end communication between two hosts.
IPsec Tunnel Mode
An IPsec mode that encapsulates an entire IP packet within a new IP packet, commonly used for site-to-site VPN connections.
Cipher Suite
A preconfigured set of algorithms specifying the symmetric cipher, key length, mode of operation, hashing algorithm, and key exchange method used to secure TLS communication.
RSA
An asymmetric encryption algorithm based on the difficulty of factoring large prime numbers, widely used for secure data transmission.

Transcript

Internet Protocol Security, or IPsec, was created to start securing communications across the internet.

IPsec is a collection of standards

The first thing to understand is that there's not just one standard out there for IPsec. Instead it's a lot of different concepts, a lot of different protocols, that are all rolled up into one concept of protecting IP traffic. In fact, this site right here lists out the IPsec and related standards, and you can see there's a lot of different standards that all roll into this idea of IPsec.

When you're configuring IPsec there's a lot of decisions to be made on how you're going to configure it, a lot of selections. Here's some of the selection of how to set up IPsec, and we'll go into some of the details of this. Really IPsec is designed to create tunnels across secure networks so that way you can secure your traffic between two different locations.

AH and ESP

One of the first things that you're going to need to set up when you're setting up IPsec is whether you're going to use authentication header, AH, or encapsulating security payload, ESP, or a combination of the two. So you can choose one of these.

AH is really designed more for integrity and authentication, and ESP was originally designed for encrypting traffic, so they serve different purposes, which is why you might want to implement both. What happened is that no one really used AH that much, because they wanted the features of both of these, so really at this point in time they just incorporated a lot of the authentication piece and also the integrity piece into ESP.

Modes of operation

Another configuration that can be chosen is the modes of operation. Here we see the transport mode and the tunnel mode. With this we see both have the payload and they both have the same layer 4 header, so that is the same.

In transport mode, the first time we assemble and put this together, we assemble it with a layer 3 header that's really designed for IPsec. However, in tunnel mode we're just taking the packet that already exists and then we're adding the ESP header and trailer onto it, and so it's being tunneled across there. And although authentication header packets look a little different, they also have a similar transport mode and tunnel mode.

Choosing a cipher suite

Once we've chosen the method in which we're going to communicate, we're going to choose what encryption method we're going to use, and AES is very common. We're also going to choose what is going to keep the integrity of this, and SHA is a common one that we choose for that. We choose what authentication we would use for this, and so maybe it's a pass key that we'd use, or maybe it's RSA. And then we would choose what we'd use for a key exchange, so Diffie-Hellman, maybe one of the versions of Diffie-Hellman, for the key exchange.

This makes up what we call a cipher suite. That cipher suite we would then set up on both sides, both the beginning of the tunnel and the end of the tunnel, so then it can establish between these two devices, establish this tunnel, and communication can happen between these networks.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →