IPsec

IPsec is a suite of protocols that secures IP traffic at layer 3 of the OSI model, protecting every application above it without any change to the applications themselves. Its two protection protocols divide the work: Authentication Header (AH) provides integrity and origin authentication but no confidentiality, while Encapsulating Security Payload (ESP) adds encryption alongside integrity. Internet Key Exchange (IKE) negotiates the security associations that hold the agreed keys and algorithms for each direction of traffic.

Mode matters as much as protocol. Transport mode protects only the payload and leaves the original IP header exposed, suiting host-to-host traffic inside a trusted network. Tunnel mode encapsulates the entire original packet, header included, inside a new packet with a fresh header, which is why gateway-to-gateway VPN links use it: internal addressing stays hidden while crossing the internet. A further caveat: AH authenticates the IP header itself, so it breaks behind NAT, one more reason ESP dominates real deployments.

Exam relevance: match the requirement to the protocol and mode. If a scenario demands confidentiality, the answer is ESP, never AH; if it asks how to protect whole packets between two sites across an untrusted network, the answer is ESP in tunnel mode. Contrast TLS, which encrypts a single application session above the transport layer rather than all IP traffic between two endpoints.