Understanding IPSec

IPSec Overview

IPSec is a suite of protocols which was designed by Internet Engineering Task Force (IETF) to protect data by signing and encrypting data before it is transmitted over public networks. The IETF Request for Comments (RFCs) 2401-2409 defines the IPSec protocols with regard to security protocols, security associations and key management, and authentication and encryption algorithms. IPSec is a framework of open standards for encrypting TCP/IP traffic within networking environments. IPSec works by encrypting the information contained in IP datagrams through encapsulating. This in turn provides network level data integrity, data confidentiality, data origin authentication, and replay protection.

The primary features of IPSec are:

IPSec can be used to provide packet filtering capabilities. It can also authenticate traffic between two hosts and encrypt traffic passed between the hosts. IPSec can be used to create a virtual private network (VPN). IPSec can also be used to enable communication between remote offices and remote access clients over the Internet.

IPSec operates at the network layer to provide end-to-end encryption. This basically means that data is encrypted at the source computer sending the data. All intermediate systems handle the encrypted portion of the packets as payload. Intermediate systems such as routers merely forward the packet to its end destination. Intermediate systems do not decrypt the encrypted data. The encrypted data is only decrypted when it reaches the destination.

IPSec interfaces with the TCP/UDP transport layer and the Internet layer, and is applied transparently to applications. IPSec is transparent to users as well. This basically means that IPSec can provide security for most of the protocols within the TCP/IP protocol suite. When it comes to applications, all applications that use TCP/IP can enjoy the security features of IPSec. You do not have to configure security for each specific TCP/IP based application. By using rules and filters, IPSec can receive network traffic and select the required security protocols, determine which algorithms to use, and can apply cryptographic keys required by any of the services.

The security features and capabilities of IPSec can be used to secure the private network and private confidential data from the following

In Windows Server 2003, IPSec uses the Authentication Header (AH) protocol and Encapsulating Security Payload (ESP) protocol to provide data security on:

The security functions and features provided by IPSec are summarized below:

What New in Windows Server 2003 IPSec

A few new IPSec features have been included in Windows Server 2003, together with enhancements to some IPSec features which existed in previous Windows operating systems:

Understanding IPSec Terminology

This section of the Article lists the commonly used IPSec terminology and concepts:

Understanding How IPSec Works

A security association (SA) has to first be established between two computers before data can be securely passed between the computers. A Security Association (SA) is a relationship between devices that define how they use security services and settings. The SA provides the information necessary for two computers to communicate securely. Internet Security Association and Key Management Protocol (ISAKMP) and the IKE protocol are the mechanism that enables two computers to establish security associations. When an SA is established between two computers, the computers negotiate on which security settings to utilize to secure data. A security key is exchanged and used to enable the computers to communicate securely.

The security association (SA) contains the following:

With IPSec, two separate SAs are established for each direction of data communication:

In addition to the above, there is a unique SA for each IPSec security protocol. There are therefore basically two types of SAs:

To secure and protect data, IPSec uses cryptography to provide the following capabilities:

Understanding the IPSec Modes

IPSec can operate in one of the following modes:

IPSec Components

The primary two components installed when IPSec is deployed are:

Understanding the IPSec Protocols

As mentioned previously, the main IPSec security protocols are the Authentication Header (AH) and Encapsulating Security Payload (ESP) protocols. There are other IPSec protocols such as ISAKMP, IKE, and Oakley that use the Diffie-Hellman algorithm.

Authentication Header (AH) Protocol

The AH protocol provides the following security services to secure data:

The AH protocol ensures that data is not modified as it moves over the network. It also ensures that the data originated from the sender.

The AH protocol does not though provide data confidentiality because it does not encrypt the data contained in the IP packets. This basically means, that if the AH protocol is used by itself; intruders that are able to capture data would be able to read the data. They would not though be able to change the data. The AH protocol can be used in combination with the ESP protocol if you need to ensure data confidentiality as well.

The communication process which occurs when the AH protocol is used is shown here:

  1. One computer transmits data to another computer.
  2. The IP header, AH header, and the data itself is signed to ensure data integrity.
  3. The AH header is inserted between the IP header and IP payload to provide authentication and integrity.

The fields within a AH header, together with the role performed by each field is listed here:

Encapsulating Security Payload (ESP) protocol

The ESP protocol provides the following security services to secure data:

The primary difference between the AH protocol and the ESP protocol is that the ESP protocol provides all the security services provided by the AH protocol, together with data confidentiality through encryption. ESP can be used on its own, and it can be used together with the AH protocol. In transport mode, the ESP protocol only signs and protects the IP payload. The IP header is not protected. If the ESP protocol is used together with the AH protocol, then the entire packet is signed.

ESP inserts an ESP header and ESP trailer, which basically encloses the payload of the IP datagram. All data after the ESP header to the point of the ESP trailer, and the actual ESP trailer is encrypted.

The fields within an ESP header, together with the role performed by each field are listed here:

The fields within an ESP trailer, together with the role performed by each field are listed here:

Understanding IPSec Security Filters, Security Methods, and Security Policies

Security filters basically match security protocols to a specific network address. IPSec filters can be used to filter out unauthorized traffic. The filter contains the following information:

Each IP address contains a network ID portion and a host ID portion. Through security filters, you can filter traffic according to the following:

Security filters can be grouped into a filter list. There is no limit to the number of filters which can be included in a filter list. IPSec policies uses IP filters to ascertain whether an IP security rule should be used in a packet.

You can use a security method to specify the manner in which an IPSec policy should deal with traffic matching an IP filter. Security methods are also referred to as filter actions. The filter actions result in either of the following events:

To apply security in your network, IPSec policies are used. The IPSec policies define when and how data should be secured. The IPSec policies also determine which security methods to use when securing data at the different levels in your network. You can configure IPSec policies so that different types of traffic are affected by each individual policy.

IPSec policies can be applied at the following levels within a network:

The different components of an IPSec policy are listed here:



Top 5 Free Networking Tools

Bookmark Understanding IPSec

Latest Blog Posts


English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.