Protocols & PKIRecommended
IPsec (IKEv2, ESP and AH)
Network-layer encryption and authentication (VPNs)
How it works
IPsec protects IP packets. IKE (usually IKEv2, on UDP 500 and 4500 for NAT traversal) authenticates the peers and negotiates keys. ESP (IP protocol 50) provides encryption and integrity, while AH (IP protocol 51) provides integrity and authentication only, with no encryption. Tunnel mode encrypts the whole original packet (site-to-site VPNs); transport mode protects only the payload.
Status: IKEv2 with AEAD ciphers; avoid legacy IKEv1 aggressive mode and old algorithms.
Strengths
- Protects all traffic between networks or hosts, not just one application
- Mature standards with AES-GCM support
Weaknesses and known attacks
- Complex configuration; weak pre-shared keys can be cracked offline in some IKE modes.
- AH breaks through NAT because it authenticates the IP header.
- Legacy deployments may still allow 3DES, SHA-1 or small DH groups.
Use it for
- Site-to-site VPNs
- Remote-access VPNs
- Protecting traffic between servers
Don't use it for
- AH alone when confidentiality is needed
- Weak pre-shared keys
Exam tip
ESP = encryption + integrity; AH = integrity only, no confidentiality. Tunnel mode wraps the whole packet; transport mode protects the payload.