Course 17 - Computer Network Security Protocols And Techniques | Episode 9: Foundations of VPN Security: The IPsec Protocol Suite

In this lesson, you’ll learn about:

• The fundamentals of VPNs and IPsec
• Key management and Security Associations (SA)
• IPsec protocols: AH vs. ESP
• Operational modes: Transport vs. Tunnel

1. VPNs and IPsec Fundamentals

• A VPN (Virtual Private Network) creates a secure, logical tunnel over the public internet, allowing private communication without costly dedicated lines.
• IPsec (Internet Protocol Security) operates at the network layer and supports both IPv4 and IPv6.
• Security services provided by IPsec include:
  1. Access Control – Only authorized users can send/receive data
  2. Data Origin Authentication – Verify the source of the packet
  3. Integrity Protection – Ensure data hasn’t been tampered with
  4. Confidentiality – Encrypt the packet contents
  5. Anti-Replay – Detect and discard duplicated or malicious packets

2. IPsec Framework and Key Management

• Encryption algorithms: DES, 3DES, AES for confidentiality
• Integrity algorithms: MD5, SHA to create digital signatures (MACs)
• Key exchange: Diffie-Hellman ensures a shared secret is established securely

3. Security Associations (SA) and IKE

• An SA is a unidirectional logical connection, identified by:
  • SPI (Security Parameter Index)
  • Destination IP address
• Bidirectional communication requires two SAs.
• IKE (Internet Key Exchange) establishes SAs and manages keys:
  • IKE Phase 1: Creates a secure management tunnel (authenticates parties, negotiates algorithms, performs Diffie-Hellman exchange)
  • IKE Phase 2: Sets up the actual data tunnel (negotiates AH/ESP and operational mode)
• IKEv2 is the modern version, supporting NAT traversal and keep-alive, and is widely used in 5G networks.

4. IPsec Protocols: AH vs. ESPProtocolSecurity ProvidedNotesAH (Authentication Header)Integrity & authenticationDoes not encrypt; ignores changing IP header fields like TTLESP (Encapsulating Security Payload)Integrity, authentication, encryptionPreferred protocol for most VPNs and mandatory for 5G

5. Operational Modes: Transport vs. Tunnel

• Transport Mode: Only the payload is encrypted; original IP header is visible
• Tunnel Mode: Entire original IP packet (header + payload) is encrypted inside a new IP packet
• Most common setup: Tunnel Mode + ESP (encrypts everything and ensures privacy)

Analogy:

• Transport Mode: Transparent envelope with coded letter inside – address is visible, content protected
• Tunnel Mode: Envelope inside an opaque crate – both content and sender/receiver are hidden

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy