IPsec

IPsec, short for Internet Protocol Security, protects traffic at the IP layer rather than within a particular application protocol. This allows a single connection between security gateways to protect traffic from many applications, including applications that do not implement their own encryption. Its security properties depend on the protocols, algorithms, authentication methods, and policies configured at both endpoints.

The main IPsec packet-protection protocols are Encapsulating Security Payload (ESP) and Authentication Header (AH). ESP is commonly used for cloud VPNs because it supports encryption together with integrity and authentication protections. AH provides integrity and authentication but does not encrypt packet contents and is generally unsuitable for paths involving address translation. Internet Key Exchange (IKE), preferably IKEv2 where supported, authenticates peers and negotiates security associations, cryptographic parameters, and key material. These agreements must be compatible on both endpoints.

IPsec supports tunnel mode and transport mode. Tunnel mode encapsulates the original IP packet inside another IP packet and is the usual choice for gateway-to-gateway cloud connectivity. Transport mode protects the payload of the original IP packet without adding a new outer IP header and is more commonly associated with host-to-host protection. Neither mode automatically protects data after it leaves the IPsec endpoints.

For example, a company can connect its data center firewall to a cloud VPN gateway and route private application traffic through an encrypted tunnel across the internet. With AWS Site-to-Site VPN, the cloud endpoint can be a virtual private gateway or a transit gateway. Route tables must direct the relevant network prefixes into the VPN, and security groups, network ACLs, and on-premises firewalls must permit the intended application traffic. A tunnel showing an established state does not prove that these routing and authorization requirements are satisfied.

A common exam distinction is that private connectivity and encrypted connectivity are different properties. AWS Direct Connect provides dedicated connectivity but does not encrypt customer traffic by default. An appropriately designed IPsec VPN can run over Direct Connect when both private transport and network-layer encryption are required. MACsec is another encryption option on supported Direct Connect connections, but it protects a link rather than providing the same gateway-to-gateway protection boundary as IPsec.

IPsec introduces encapsulation overhead and cryptographic processing, which can reduce effective throughput and usable packet size. Engineers should account for path MTU, fragmentation, and TCP maximum segment size when diagnosing applications that stall despite an established tunnel. Internet-based VPNs also inherit the latency and availability characteristics of their underlying paths. Redundant tunnels, resilient customer gateway infrastructure, and tested routing failover are important; AWS Site-to-Site VPN supplies two tunnels per connection, and both should be configured.

Operational troubleshooting should separate negotiation failures from forwarding failures. Check peer authentication, IKE and IPsec proposals, key lifetimes, and traffic selectors when tunnels fail to establish. Check routes, return paths, overlapping address ranges, and firewall policies when tunnels establish but traffic fails. IKE commonly uses UDP port 500; NAT traversal encapsulates ESP in UDP port 4500, while native ESP uses IP protocol 50 rather than a TCP or UDP port. Finally, retain TLS where application identity or protection beyond the VPN gateways is required: an IPsec tunnel is not a substitute for end-to-end application security.