---
{
  "title": "IPsec",
  "summary": "Protect IP traffic through negotiated security associations.",
  "topic": "foundations",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "units": [
    7
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: Cryptographic Standards and Guidelines",
      "url": "https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines"
    },
    {
      "title": "IETF RFC 4301: Security Architecture for the Internet Protocol",
      "url": "https://www.rfc-editor.org/rfc/rfc4301.html"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

IPsec is a collection of mechanisms for protecting IP communications. It can provide authentication, integrity, and confidentiality depending on the configured protocols and policies. Tunnel mode wraps an original IP packet within protected communication between peers, while transport mode protects the payload of the original packet. Secure deployment includes peer authentication, key exchange, traffic selectors, and careful routing. It is frequently used for network-to-network VPNs.

## In practice

Two offices establish an authenticated IPsec tunnel so permitted traffic between their networks crosses an untrusted network with cryptographic protection.

## A common misunderstanding

A tunnel does not determine which internal users should access a sensitive application. Network protection and application permissions are different layers.

## Check your understanding

What should be defined before allowing traffic through the tunnel?

**Think it through:** The peers, authentication method, permitted networks and services, and the relevant routing and firewall policies.

## A protected path still needs a traffic policy

A fictional organization connects two offices through an IPsec VPN. The cryptographic relationship protects selected traffic between configured peers, but the organization must still decide which networks and services may communicate. A tunnel is not permission for every user at one office to access every system at the other.

Traffic selectors, routing, and firewall rules should agree on that intent. A mismatch can leave traffic unprotected, block legitimate communication, or permit more than intended. Review the actual path and policy rather than assuming that an established tunnel means all application traffic uses it.

Peer authentication and key management are central. Protect the credentials that establish the tunnel, define renewal and rotation, and monitor failures. A certificate expiry or configuration mismatch can interrupt availability even when the network links themselves are healthy.

## Map one permitted cross-office flow

For a paper exercise, draw a branch client, the two VPN peers, and a central document service. Mark where protection begins and ends, which route carries the traffic, and which policy allows the service connection. Add an unrelated administrative service as an expected denial.

Use an isolated lab for configuration practice and follow current implementation guidance for algorithms and negotiation. Avoid weakening settings simply to make an old example connect. Validate the protected path and the application permissions separately. A useful IPsec review explains authenticated peers, protected traffic, routing, access restrictions, and lifecycle operations, showing how network confidentiality and integrity fit within the wider service security model.

## Keep exploring

- [[vpn]]
- [[network-segmentation]]
- [[key-management]]