---
title: "Short note: IPSec"
subject: "Computer Networks and Security"
chapter: 8
key: "semester_7/computer_networks_and_security:ipsec-note"
source: https://www.bctengineer.com/q/semester_7/computer_networks_and_security/ipsec-note
site: BCT Engineering
---

# Short note: IPSec

Computer Networks and Security · Chapter 8: Network Security

- Asked in: 2072 Kartik, 4 marks; 2070 Asar, 4 marks (asked 2 times)
- Video: [IPsec Explained](https://www.youtube.com/watch?v=xTH1ZA_qUvA) — PowerCert Animated Videos
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_7/computer_networks_and_security/ipsec-note
- Whole chapter: https://www.bctengineer.com/md/semester_7/computer_networks_and_security/chapter-8

## Question

Write a short note on IPSec.

## Short answer

IPsec provides network-layer security with AH for authentication, ESP for encryption, and IKE for key management. It operates in transport mode (host-host) or tunnel mode (gateway VPN), protecting entire IP packets transparently to applications.

## Answer

**IPsec (IP Security)** is a suite of protocols (RFC 4301) that provides security at the **network layer**, protecting IP packets by authentication, integrity and encryption. It works for both IPv4 and IPv6 and is transparent to applications, so one mechanism protects all upper-layer traffic. It is the basis of many VPNs.

#### Components
- **AH (Authentication Header, protocol 51):** gives data origin authentication, integrity and replay protection; no encryption.
- **ESP (Encapsulating Security Payload, protocol 50):** gives confidentiality (encryption) plus optional authentication and integrity.
- **IKE (Internet Key Exchange):** negotiates keys and algorithms and sets up **Security Associations (SA)**. An SA is a one-way logical connection identified by SPI, destination address and protocol.

#### Modes
```text
Transport mode: [IP hdr][ESP hdr][ TCP + data ][ESP trailer]
Tunnel mode   : [New IP][ESP hdr][ old IP hdr + TCP + data ][trailer]
```
| Mode | Protects | Use |
|---|---|---|
| Transport | Payload only; original IP header kept | Host to host |
| Tunnel | Entire original packet inside a new IP packet | Gateway to gateway (VPN) |

#### Algorithms
Encryption: AES, 3DES. Integrity: HMAC-SHA. Key exchange: Diffie-Hellman.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. At which layer does IPsec operate?
   A. Network layer
   B. Application layer
   C. Transport layer
   D. Data link layer
   Answer: A. IPsec protects IP packets, transparent to applications. (Key point: Layer)

2. What is the difference between AH and ESP?
   A. AH is for IPv6 only
   B. AH encrypts, ESP does not
   C. AH gives authentication and integrity without encryption; ESP adds confidentiality
   D. They are identical
   Answer: C. AH has no encryption; ESP provides encryption plus optional authentication. (Key point: AH vs ESP)

3. Which mode protects the entire original packet inside a new IP packet?
   A. AH mode
   B. Transport mode
   C. Tunnel mode
   D. IKE mode
   Answer: C. Tunnel mode is used gateway to gateway (VPN); transport protects only the payload. (Key point: Modes)

4. What does IKE do?
   A. Encrypts data
   B. Filters packets
   C. Negotiates keys and algorithms and sets up Security Associations
   D. Compresses packets
   Answer: C. IKE sets up SAs, one-way logical connections. (Key point: IKE)