https://lesitedefrancois.be/en/tags/layer3/Recent content in Layer3 on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/ipsec/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/ipsec/<p><strong>IPsec (Internet Protocol Security)</strong> is a suite of IETF standards (core specification RFC 4301) that adds cryptographic security to IP packets at the network layer, transparently to applications running above it. Where <strong>TLS</strong> secures a specific connection between two application endpoints, IPsec secures all IP traffic between two hosts or networks — including traffic from applications that have no TLS support, protocols that predate encryption (routing protocols, SNMP, ICMP), and layer-3 metadata that TLS cannot protect. IPsec provides two protocol headers: <strong>AH (Authentication Header, IP protocol 51)</strong> signs the IP packet including immutable header fields, providing integrity and source authentication without confidentiality — rarely used in modern deployments because NAT rewrites fields that AH covers. <strong>ESP (Encapsulating Security Payload, IP protocol 50)</strong> encrypts the payload and provides authenticated encryption with AES-GCM or ChaCha20-Poly1305, optionally protecting the inner IP header as well; ESP is the universally deployed choice. Both operate in two modes: <strong>transport mode</strong> protects only the payload of an existing IP packet (used for host-to-host encryption between endpoints that share routing), and <strong>tunnel mode</strong> encapsulates the entire original IP packet inside a new one with new source and destination addresses — the basis of VPN gateways where traffic from one network is tunnelled to another through the public internet.</p>