IP Security (IPSec)

1.4 Explain common networking ports, protocols, services, and traffic types

IP Protocol Types

📘CompTIA Network+ (N10-009)

---

IPSec is a suite of protocols used to secure Internet Protocol (IP) communications. It ensures that data sent over a network is confidential, authentic, and intact.

IPSec operates mainly at the network layer (Layer 3) of the OSI model, which means it can protect any application or protocol that uses IP, such as HTTP, FTP, or email. This is different from something like TLS, which works at the transport layer (Layer 4) or above.

---

Why IPSec is important

• Protects data while it travels across networks, especially untrusted networks like the internet.
• Ensures data is encrypted, so even if someone intercepts it, they cannot read it.
• Confirms that the data actually comes from the claimed sender (authentication).
• Makes sure the data hasn’t been altered in transit (integrity).

---

Core Components of IPSec

1. Protocols for Security IPSec uses two main protocols to secure traffic: a) Authentication Header (AH)
   • Ensures data integrity and origin authentication.
   • AH verifies that the data was not tampered with and that it really came from the sender.
   • Does NOT encrypt the data—the content can still be read if intercepted.
   • Example in IT: AH might be used internally in a data center to ensure a server-to-server message is legitimate.
   b) Encapsulating Security Payload (ESP)
   • Provides confidentiality (encryption), integrity, and authentication.
   • Encrypts the actual data so that it cannot be read by attackers.
   • Example in IT: ESP is commonly used in VPN connections, so a remote employee can securely access internal systems.

---

2. Security Associations (SAs)
   • A Security Association is like a set of rules both endpoints agree to use for secure communication.
   • It defines how encryption and authentication are applied.
   • SAs are unidirectional, so for two-way communication, you need two SAs (one for each direction).
   • IT example: When connecting two branch offices over a VPN, each branch has an SA for sending and another for receiving encrypted traffic.

---

3. Key Management
   • IPSec needs encryption keys to secure traffic.
   • Keys can be exchanged manually (manual keying) or automatically using Internet Key Exchange (IKE).
   • IKE handles negotiation of SAs, key exchange, and can use strong cryptography.

---

Modes of IPSec

1. Transport Mode
   • Only encrypts or authenticates the IP payload (the actual data), leaving the IP header visible.
   • Used for end-to-end communication, like between two servers or a client and a server.
   • IT example: Encrypting emails between two mail servers inside the same company.
2. Tunnel Mode
   • Encrypts the entire IP packet and wraps it inside a new IP packet with a new header.
   • Used for site-to-site VPNs or remote access VPNs.
   • IT example: A branch office connecting to the main office over the internet using a VPN tunnel.

---

Common Encryption and Authentication Methods

• Encryption Algorithms: AES (Advanced Encryption Standard), 3DES (Triple DES)
• Hashing Algorithms: SHA-1, SHA-2, MD5 (used for integrity checks)
• Key Exchange: Diffie-Hellman, often via IKE

---

How IPSec Works in an IT Environment

Let’s look at a practical IT setup:

Scenario: Remote Office VPN

1. Branch office wants to connect securely to the main office over the public internet.
2. IPSec tunnel mode is used to encrypt all data between the branch and main office.
3. ESP ensures the data is encrypted, authenticated, and integrity-protected.
4. IKE negotiates the keys automatically, and a Security Association (SA) defines the rules.
5. All applications—email, file servers, or internal tools—are protected without modifying them individually, because IPSec works at the network layer.

---

Key Exam Points to Remember

1. IPSec operates at Layer 3 (network layer).
2. Two main protocols: AH (authentication/integrity) and ESP (encryption + authentication).
3. Two modes:
   • Transport (payload only)
   • Tunnel (entire packet)
4. Security Associations (SAs) define rules for encrypted communication.
5. Key exchange via IKE is standard for automation.
6. Use in IT: VPNs, secure server-to-server communication, remote access.

---

Tip for the Exam:

• When you see a question about “encrypting all traffic between offices” → IPSec tunnel mode.
• When it’s “encrypting only the data, not headers, between two servers” → IPSec transport mode.
• If a question mentions authentication but no encryption, think AH.

---

This explanation covers everything you need to understand IPSec for the Network+ exam, in simple IT-focused language.