IPsec

Also known as: Internet Protocol Security

A suite of protocols that authenticates and encrypts IP packets at Layer 3, widely used for site-to-site VPNs, remote-access VPNs, and mobile carrier backhaul.

Last updated: April 22, 2026

What is IPsec?

IPsec (Internet Protocol Security) is a suite of standards that adds authentication and encryption to IP packets. Unlike VPN protocols that tunnel over UDP or TCP at the application layer, IPsec operates at Layer 3: every IP packet on a protected link is encapsulated in an Encapsulating Security Payload (ESP) header and encrypted. This makes IPsec the dominant protocol for site-to-site VPNs between corporate offices and for mobile carriers' LTE/5G backhaul links.

Key exchange and modes

IPsec relies on a companion protocol, IKE (Internet Key Exchange) — usually IKEv2 today — to authenticate peers (via pre-shared key or X.509 certificate) and derive session keys. Two modes of operation are defined:

Tunnel mode — the entire original IP packet is encrypted and wrapped in a new outer IP header; used for site-to-site and remote-access VPNs
Transport mode — only the payload is encrypted; used for host-to-host

IPsec runs directly over IP protocol 50 (ESP) and 51 (AH), not over TCP or UDP. When NAT is in the path, it must be wrapped in UDP port 4500 (NAT-T).

IPsec vs. modern alternatives

IPsec's complexity is its main drawback — IKEv2 alone spans hundreds of pages of RFCs, and interop between vendors has historically been painful. WireGuard solves much of the same problem in a fraction of the code. But IPsec's ubiquity in router and firewall hardware means it remains the default for enterprise site-to-site tunnels and will stay deployed for decades.

Identify VPN traffic of any protocol behind a suspicious IP with our VPN & proxy detector.

Frequently Asked Questions

IPsec operates at Layer 3 — every IP packet on the protected link is encrypted, regardless of which application sent it. An SSL VPN (also called TLS VPN) operates at Layer 4-7 — it tunnels specific application traffic, often a single TCP session, over a TLS connection on port 443. IPsec is dominant for site-to-site tunnels and is supported in router/firewall hardware; SSL VPNs (Cisco AnyConnect, OpenVPN, Pulse Secure, Palo Alto GlobalProtect) are dominant for remote access because they pass through almost any firewall.

IKE (Internet Key Exchange) is the companion protocol IPsec uses to authenticate peers and derive session keys before encrypted data flows. IKEv2 (RFC 7296, 2014) is the modern version, replacing IKEv1's complex multi-phase handshake with a streamlined 4-message exchange, native NAT traversal, MOBIKE support for seamless connection migration, and stronger built-in authentication options. Every modern IPsec deployment uses IKEv2; IKEv1 is considered deprecated and disabled by default in newer vendor firmware.

Because IPsec ESP packets use IP protocol 50, not UDP or TCP, so they have no port number a NAT router can rewrite. When IPsec traffic crosses a NAT boundary (almost universal today), the NAT router cannot map ESP packets back to the right internal device. NAT-T (NAT Traversal, RFC 3948) wraps ESP inside UDP port 4500, giving NAT something to translate. Modern IKEv2 detects NAT automatically during the handshake and switches to NAT-T transparently.

For new remote-access deployments, often yes — WireGuard is simpler to configure, faster, and uses much less code (~4,000 lines vs hundreds of thousands for IPsec stacks). For existing enterprise site-to-site tunnels, IPsec dominates and will stay deployed for years because it is built into every router and firewall, has decades of operational experience, and requires no software install on routers that already support it. Both will coexist for a long time.

Tunnel mode encrypts the entire original IP packet — header and payload — and wraps it in a new outer IP header pointing to the tunnel endpoint. This is what site-to-site and remote-access VPNs use. Transport mode encrypts only the payload and keeps the original IP header visible; it is used for host-to-host communication where the two endpoints already know each other's addresses and do not need to hide the routing. Tunnel mode is by far the more common deployment.

Back to glossary