IPsec (Internet Protocol Security) is a suite of protocols designed to secure Internet Protocol (IP) communications. It is one of the widely supported standards used to establish secure communication between network endpoints in VPNs and other IP networks.
The IPsec suite includes several protocols and technologies:
- AH (Authentication Header) provides authentication of the origin of IP packets and protection against modification during transmission. It ensures data integrity and authenticity, but does not encrypt the packet contents and therefore does not provide confidentiality.
- ESP (Encapsulating Security Payload) provides confidentiality by encrypting data, as well as protection against modification and, depending on the configuration, authentication of the traffic.
- IKE (Internet Key Exchange) is used to negotiate security parameters and exchange cryptographic keys between VPN endpoints. Keys can also be configured manually, but automatic negotiation and periodic rekeying make IKE a more practical option for most deployments. IKE normally uses UDP port 500. When NAT traversal is required, IPsec can also use UDP port 4500.
IPsec is supported by IPv6 and was designed as part of the security architecture for the next-generation Internet Protocol. However, IPv6 does not require every connection to use IPsec for its traffic.