6.1Secure protocols and VPN

Securing communication between locations or with remote workers over the internet requires countermeasures against eavesdropping, tampering, and impersonation. A network specialist must accurately select and design IPsec modes and SSL-VPN approaches according to requirements (always-on inter-site connectivity vs. occasional access from the field) and security needs (is confidentiality required, or do integrity and origin authentication suffice). This section builds a decision-making pattern grounded in how the protocols actually work.

6.1.1IPsec (ESP, AH, IKE)

• IPsec is a protocol suite providing per-packet authentication, integrity, and confidentiality at the IP layer. AH (Authentication Header) provides only origin authentication and integrity verification—it does not encrypt the payload. ESP (Encapsulating Security Payload) can provide encryption in addition to authentication and integrity, so ESP is chosen whenever confidentiality is required.
• Transport mode protects only the payload (upper-layer data) while leaving the original IP header intact; it is used for end-to-end communication (direct host-to-host). Tunnel mode encapsulates the entire original IP packet inside a new IP header; it is used for site-to-site VPN (gateway-to-gateway) and hides the internal network's addressing scheme from the outside.
• IKE (Internet Key Exchange) establishes mutual authentication and a SA (Security Association) (agreed cipher algorithms, keys, etc.) before IPsec communication begins. It is a two-phase process: IKE phase 1 establishes the IKE SA (protecting the control channel), and phase 2 establishes the IPsec SA (protecting the actual data).