Internet Protocol Security (IPsec) is a standards-based protocol suite that authenticates and encrypts IP packets, creating secure tunnels over untrusted networks. It is the workhorse behind most site-to-site VPNs, remote-access tunnels, and SD-WAN overlays – including Versa’s.
Key takeaways
- IPsec provides confidentiality, integrity, and authentication at the IP layer.
- ESP encrypts and authenticates; IKE negotiates keys and security associations.
- Tunnel mode protects whole packets; transport mode protects only payloads.
- Modern deployments use IKEv2 with AES-GCM and strong Diffie-Hellman groups.
- Versa’s encrypted SD-WAN fabric and site-to-site tunnels run on IPsec.
On this page: Why it mattersHow it worksTypesIPsec & VersaFAQ
Why is IPsec important?
Almost every private connection that crosses the public internet depends on IPsec. Branch offices reach data centers through IPsec tunnels; cloud VPCs peer with on-premises networks through IPsec gateways; SD-WAN fabrics encrypt every path with it. Because it operates at the IP layer, IPsec protects all traffic above it – any application, any transport protocol – without the applications having to change.
Its importance also comes from being an open standard. IPsec endpoints from different vendors interoperate, which is why it remains the common denominator for connecting a branch device to a cloud provider’s VPN gateway, a partner’s firewall, or a carrier’s service. When architects need encrypted transport that is vendor-neutral, auditable, and hardware-accelerated on most platforms, IPsec is still the default answer – three decades after its first RFCs.
What is IPsec?
IPsec is a family of protocols that work together. ESP (Encapsulating Security Payload) does the day-to-day work: it encrypts packet contents and verifies they were not tampered with in transit. IKE (Internet Key Exchange) is the control channel: the two endpoints authenticate each other – with certificates or a preshared key – negotiate encryption algorithms, and establish the session keys, which are rotated on a schedule without dropping traffic.
The negotiated state between two endpoints is a security association (SA): an agreement on algorithms, keys, and lifetimes. Data flows through the tunnel only after the SAs are in place, and features such as Perfect Forward Secrecy ensure that even a future key compromise cannot decrypt past sessions.
Types of IPsec
Two encapsulation modes exist. Tunnel mode wraps the entire original packet inside a new encrypted one – the standard for site-to-site VPNs, because it hides internal addressing. Transport mode encrypts only the payload and keeps the original header, used mainly for host-to-host protection.
Two key-exchange generations remain in the field. IKEv1 is legacy but widespread; IKEv2 is the modern standard – faster to establish, more resilient to network changes, and the right default for new deployments. Cipher choices complete the picture: AES in GCM mode (encryption and integrity in one pass) has largely replaced AES-CBC with a separate hash, and Diffie-Hellman group selection sets the key-exchange strength.
IPsec & Versa
IPsec is the encryption fabric of a Versa deployment. The SD-WAN overlay between branches, hubs, and Controller nodes runs over IPsec paths, with branch SD-WAN profiles defining the crypto settings. Site-to-site IPsec tunnels connect VOS devices to third-party gateways and cloud providers – configured through IPsec VPN profiles or site-to-site tunnel interfaces in Concerto – and remote users reach the network through IPsec-protected SASE client sessions. VOS supports IKEv1 and IKEv2, certificate and preshared-key authentication, AES-CBC and AES-GCM transforms, and Perfect Forward Secrecy, with per-tunnel monitoring of SA state.
Frequently asked questions
What is the difference between IPsec and TLS/SSL VPNs?
IPsec operates at the IP layer and protects all traffic between two network endpoints, which suits site-to-site and full-tunnel use. TLS VPNs operate per-connection at the session layer, which suits per-application access. SD-WAN fabrics use IPsec; ZTNA services typically use TLS.
What is the difference between IKEv1 and IKEv2?
IKEv2 establishes tunnels with fewer messages, handles NAT and network changes more gracefully, supports modern authentication, and is less fragile during rekeying. IKEv1 persists only for compatibility with older peers; new tunnels should default to IKEv2.
What is an IPsec security association?
A security association is the negotiated contract between two endpoints: which algorithms they use, which keys, and for how long. Each tunnel maintains SAs in both directions, and IKE refreshes them before they expire so traffic never pauses.
Why use AES-GCM instead of AES-CBC for IPsec?
AES-GCM provides encryption and integrity verification in a single pass, which is faster and removes the separate hash step CBC requires. Most modern hardware accelerates GCM, so it delivers better throughput at equal or stronger security.
What is Perfect Forward Secrecy in IPsec?
Perfect Forward Secrecy derives each session key independently through a fresh Diffie-Hellman exchange. If a long-term key is ever compromised, past sessions still cannot be decrypted – limiting the blast radius of a key breach to the current session.
More on IPsec
If you want to learn more, these are sources we trust.
| RFC 4301: Security Architecture for IP | RFC 7296: IKEv2 |
|---|---|
| The IETF architecture document: how SAs, ESP, and policy databases fit together – the definitive reference. | The current Internet Key Exchange standard: authentication, negotiation, and rekeying as modern endpoints implement them. |
Related terms
If you’re reading about IPsec, these are worth looking at next.
| Internet Key Exchange | Encapsulating Security Payload | Perfect Forward Secrecy |
|---|---|---|
| The negotiation protocol that authenticates IPsec peers and establishes the keys tunnels run on. | The IPsec protocol that encrypts and integrity-protects the packets inside the tunnel. | The key-exchange property that keeps past sessions safe even if a long-term key leaks. |