IP Security (IPSec)

Simple Study Notes

Purpose

These notes explain the uploaded 48-slide IPSec lecture in simpler language, while keeping its original
technical terms and structure.

Main topics VPN basics, IPSec modes, SA, AH, ESP, IKE/ISAKMP, configuration

Best for Revision, exam preparation, quick understanding

Source Uploaded lecture: IP Security (IPSec), 48 slides

Quick memory line

VPN creates private path over public network. IPSec secures IP traffic. AH protects authenticity/integrity.
ESP can also encrypt. IKE builds keys and security associations.
IP Security (IPSec) - Simple Notes

Study Map. What to learn first

Step Topic Core question

1 VPN Why do we need secure tunnel over Internet?

2 IPSec basics What security does IPSec provide?

3 Tunnel vs Transport What part of packet is protected?

4 SA + SPI + Selectors How are security rules identified?

5 AH vs ESP Integrity only, or confidentiality too?

6 IKE / ISAKMP How are peers authenticated and keys created?

7 Configuration How are policies applied on router?

Recommended study order

Understand VPN -> IPSec goals -> modes -> SA -> AH/ESP -> IKE phases -> configuration. This order
makes later slides much easier.

Key acronyms
Term Meaning

VPN Virtual Private Network

IPSec Internet Protocol Security

SA Security Association

SPI Security Parameter Index

AH Authentication Header

ESP Encapsulating Security Payload

IKE Internet Key Exchange

ISAKMP Internet Security Association and Key Management Protocol

ICV Integrity Check Value

PFS Perfect Forward Secrecy

Based on uploaded lecture slides Page 2

IP Security (IPSec) - Simple Notes

1. VPN Basics
Lecture reference: slides 3-8

A Virtual Private Network (VPN) creates a secure tunnel through a public network such as Internet. It
lets users or networks communicate as if they were connected privately.

Simple idea

Think of Internet as public road. VPN acts like protected lane between two endpoints. Traffic still travels
through public infrastructure, but connection is secured.

Common connections
• Client to firewall

• Router to router

• Firewall to firewall

• Remote employee to office network

VPN types in slides

Type Simple meaning Typical use

Remote access VPN / One user connects remotely to private Employee accessing office
VPDN network. network.

Two or more fixed sites connect through

Site-to-site VPN Branch office to head office.
public network.

Point-to-Point / leased-line Networks connect through dedicated ISP T1, Metro Ethernet, DS3, ATM
VPN line. examples in slides.

Implementation options
Implementation Main advantage Main limitation

High throughput; often plug-and-play; dual

Hardware Cost and less flexibility.
purpose.

Software Flexible and relatively low cost. Lower efficiency; more training/labor.

Cost-effective and can combine several

Firewall Still relatively costly.
functions.

VPN protocols
Protocol Layer / origin Key point

PPTP Data-link; Microsoft Originally designed to secure dial-up connections.

L2F Layer 2; Cisco Similar purpose to PPTP.

L2TP Layer 2; IETF Combines functionality of PPTP and L2F.

Based on uploaded lecture slides Page 3

IP Security (IPSec) - Simple Notes

Protocol Layer / origin Key point

IPSec Network layer Open standard for VPN implementation.

Advantages vs disadvantages

Advantages: cheaper than private leased lines, scalable, flexible, broadband-friendly, available wherever
Internet exists.
Disadvantages: needs security knowledge and careful deployment; performance depends on public
network; may need to support non-IP/internal technologies.

Based on uploaded lecture slides Page 4

IP Security (IPSec) - Simple Notes

2. IPSec Fundamentals
Lecture reference: slides 9-13

IPSec is a group of protocols and algorithms that secures IP data at Layer 3 (network layer). Because it
works below applications, applications do not need their own IPSec support.

Main building blocks listed in slides

• Security Associations (SA)

• Authentication Header (AH)

• Encapsulating Security Payload (ESP)

• Internet Key Exchange (IKE)

• ISAKMP security context for VPN tunnel

Main security benefits

Benefit What it means

Confidentiality Data can be encrypted so outsiders cannot read it.

Integrity Hash/checksum helps detect modification.

Authentication Peer/source can be verified using shared secrets, signatures, or certificates.

Anti-replay Sequence handling helps detect reused/replayed packets.

Key management IKE negotiates, establishes, refreshes, and deletes security sessions.

Where IPSec fits

Slides compare encryption at different layers: link layer, network layer (IPSec), and application layer
(examples: SSL, PGP, SSH, HTTPS). IPSec specifically protects traffic at network layer.

Standards referenced in slides

RFC Slide description

4301 IP Security Architecture

4302 Authentication Header (AH)

4303 Encapsulating Security Payload (ESP)

2408 ISAKMP

5996 IKEv2

4835 Cryptographic algorithm implementation for ESP and AH

Based on uploaded lecture slides Page 5

IP Security (IPSec) - Simple Notes

3. Tunnel Mode vs Transport Mode

Lecture reference: slides 14-15, 27-30

IPSec can protect traffic in two main modes. Difference is how much of original IP packet is
wrapped/protected.

Feature Transport mode Tunnel mode

IPSec header is inserted into existing IP Entire original IP packet becomes data
Packet handling
packet. inside new IP packet.

New IP header No Yes

Larger because new

Packet size Smaller overhead
header/encapsulation is added

Common use in slides Frequently remote-access VPN Frequently site-to-site VPN

Packet picture in simple form

Case Simplified structure

Normal packet IP Header | TCP/UDP Header | Payload

Transport IPSec IP Header | IPSec Header | TCP/UDP Header | Payload

Tunnel IPSec New IP Header | IPSec Header | Original IP Header | TCP/UDP Header | Payload

Memory trick

Transport = protect transport payload inside same outer IP packet.

Tunnel = put original packet inside a new packet.

AH/ESP packet alteration shown in slides

• AH transport: AH header is inserted after original IP header; authentication covers packet except
mutable IP fields.

• ESP transport: ESP header/trailer surround transport data; protected portion is encrypted and
authentication is added.

• AH tunnel: new IP header is added; AH protects encapsulated original packet except mutable fields in
new header.

• ESP tunnel: new IP header + ESP header; original IP header and payload are inside encrypted portion.

Based on uploaded lecture slides Page 6

IP Security (IPSec) - Simple Notes

4. Security Associations (SA), SPI, and Selectors

Lecture reference: slides 17-22

A Security Association (SA) is a collection of parameters needed to create one secure IPSec session.
It tells peers which security settings should protect traffic.

Important SA rules
• SA is unidirectional. Bidirectional communication needs two SAs.

• One SA is for AH or ESP, not both at same time.

• If both AH and ESP are used in both directions, multiple SAs are required.

• SA can define peers/selectors, security service, cryptographic algorithm, key length, and key lifetime.

How SA is uniquely identified

Identifier part Meaning

SPI 32-bit Security Parameter Index

Destination IP address Destination endpoint for protected traffic

Security protocol AH or ESP identifier

Security Parameter Index (SPI)

SPI is a 32-bit identification number carried in AH or ESP header. Receiver uses SPI to find correct SA
and therefore correct algorithms, keys, lifetimes, and other crypto parameters. Slides note that SPI has
local significance and is defined by SA creator.

Selectors
Selectors classify which traffic should use IPSec and what protection should be applied.

Selector element Example role

Source IP address Which sender/network traffic comes from

Destination IP address Which destination/network traffic goes to

Protocol TCP or UDP

Upper-layer protocol Further identifies traffic/application

How SA can be created

Manual keying: configure peers, AH/ESP mode, algorithm, and key on each node.
Automatic: use IKE (Internet Key Exchange).

Based on uploaded lecture slides Page 7

IP Security (IPSec) - Simple Notes

5. AH vs ESP
Lecture reference: slides 23-30

AH focuses on authentication and integrity. ESP adds confidentiality through encryption and can also
provide authentication/integrity.

Feature AH ESP

IP protocol number 51 50

Source authentication Yes Yes (when authentication is used)

Integrity Yes Yes

Confidentiality / encryption No Yes

Anti-replay support Yes Yes via sequence handling

Protects mutable IP header No; mutable fields excluded/zeroed Not described as protecting outer
fields for authentication mutable header in same way

AH header - fields to remember

Field Simple purpose

Next Header Says which upper-layer protocol follows (such as TCP, UDP, ESP).

Payload Length Size of AH.

Reserved Future use; currently zero.

SPI Identifies Security Association.

Sequence Number Starts at 1 and must not repeat; supports anti-replay.

Authentication Data / ICV Digital integrity/authentication value; length depends on algorithm.

ESP header/trailer - fields to remember

Field Simple purpose

SPI Identifies Security Association.

Sequence Number Starts at 1 and must not repeat.

Initialization Vector (IV) Initializes CBC-mode encryption as described in slides.

Payload Data Protected/encrypted content.

Padding + Padding Length Makes data fit encryption requirements and records added bytes.

Next Header Identifies original protocol contained in protected part.

Authentication Data / ICV Integrity/authentication value.

Based on uploaded lecture slides Page 8

IP Security (IPSec) - Simple Notes

Fast exam answer

AH = authentication + integrity.
ESP = AH-like protection plus confidentiality through symmetric encryption.

6. ISAKMP and Internet Key Exchange (IKE)

Lecture reference: slides 21, 31-41

ISAKMP provides a framework for establishing Security Associations and cryptographic keys. IKE is a
key exchange mechanism used to authenticate peers and create/maintain SAs.

Simple idea

IPSec needs rules and keys before protected traffic can start. IKE handles negotiation process that builds
those security relationships.

IKE facts from slides

• Used for mutual authentication and establishing/maintaining Security Associations.

• Typically used to establish IPSec sessions.

• Uses UDP port 500.

• Authentication methods listed: pre-shared key, public-key encryption, public-key signature.

• Negotiation variations discussed: main mode, aggressive mode, and quick mode.

IKE modes
Mode What happens

Three exchanges (six messages). Peers negotiate proposal, perform DH exchange,

Main mode
and authenticate. Identity is protected after keying material exists.

Same broad goal with only three messages. Slides note no DoS protection and no
Aggressive mode
identity protection; optional and not widely implemented.

Negotiates IPSec session parameters inside protected ISAKMP session;

Quick mode
creates/refreshes keys.

IKE Phase 1 vs Phase 2

Phase Goal Mode in slides Result

Build secure ISAKMP communication

Phase 1 Main or aggressive ISAKMP SA
channel and authenticate peer.

Build secure channel used for actual IPSec IPSec SAs (inbound +
Phase 2 Quick mode
data traffic. outbound)

Overall flow

Based on uploaded lecture slides Page 9

IP Security (IPSec) - Simple Notes

1. IKE Phase 1 2. Secure ISAKMP SA

->
Negotiate IKE policy + authenticate peers Protected negotiation channel

3. IKE Phase 2 4. IPSec tunnel/data

->
Negotiate IPSec parameters Secured traffic exchange

7. IKE Message Flow - Easy Version

Lecture reference: slides 37-41

Main mode uses six messages. Slides group them into three logical steps:

Step Messages Purpose

Negotiate IKE/ISAKMP policy (encryption, hash, authentication method,

1 1-2
Diffie-Hellman group).

2 3-4 Exchange Diffie-Hellman public values and nonces; derive shared keying material.

3 5-6 Exchange authentication material and identity; authenticate peer.

Aggressive mode
Aggressive mode compresses setup into three messages. It is faster in message count but slides
highlight weaker protection characteristics: no denial-of-service protection and no identity protection.

Quick mode
Quick mode happens after Phase 1. It runs inside protected ISAKMP session. Each quick-mode
negotiation creates two IPSec SAs: one inbound and one outbound. It also creates or refreshes keys.

Message Purpose

1 Initiator sends authentication/keying material and SA proposal.

2 Responder sends authentication/keying material and accepted SA.

3 Initiator sends hash proving integrity/authentication.

Memory trick

Phase 1 = secure negotiation channel.

Phase 2 = secure data channel.
Main/Aggressive = Phase 1. Quick = Phase 2.

ISAKMP header basics from slides

ISAKMP header includes initiator cookie, responder cookie, next payload, major/minor version,
exchange type, flags, message ID, and total message length. ISAKMP payloads include next-payload
field, reserved field, payload length, and payload data.

Based on uploaded lecture slides Page 10

IP Security (IPSec) - Simple Notes

8. Best Practices and Configuration Flow

Lecture reference: slides 42-47

Best practices listed in lecture

• Use IPSec for integrity as well as encryption.

• Use ESP option.

• Prefer strong encryption such as AES instead of DES.

• Use a good hashing algorithm such as SHA instead of MD5.

• Reduce SA lifetime with Perfect Forward Secrecy (PFS) when data is highly sensitive; slides note
increased processor burden.

Configuration sequence shown in slides

Order Action Example command idea

1 Configure IKE Phase 1 / ISAKMP policy crypto isakmp policy [priority]

2 Set ISAKMP identity crypto isakmp identity {ipaddress|hostname}

3 Configure IPSec transform set and mode crypto ipsec transform-set ... mode [tunnel|transport]

4 Create crypto map and match traffic crypto map ... ; match address ... ; set peer ...

set transform-set ... ; set security-association ... ; set pfs

5 Set transform set / lifetime / PFS
...

6 Apply crypto map to interface crypto map ... local-address interface-id

Two things router must know

What traffic should be protected? Access list defines "interesting VPN traffic."
Where should policy be applied? Crypto map is applied to outbound interface.

Example from lecture slides

crypto isakmp policy 1
authentication pre-share
encryption aes
hash sha
group 5

crypto isakmp key Training123 address [Link]

crypto ipsec transform-set ESP-AES-SHA esp-aes esp-sha-hmac

crypto map LAB-VPN 10 ipsec-isakmp

match address 101
set transform-set ESP-AES-SHA
set peer [Link]

Based on uploaded lecture slides Page 11

IP Security (IPSec) - Simple Notes

interface fa0/1
crypto map LAB-VPN

access-list 101 permit ip [Link] [Link] [Link] [Link]

Lecture labels this configuration as covering Phase 1 SA, encryption/authentication settings, Phase 2 SA, applying crypto
map to outbound interface, and defining interesting VPN traffic.

9. One-Page Exam Cheat Sheet

Question Short answer

What is VPN? Secure tunnel over public network such as Internet.

What layer does IPSec secure? Network layer (Layer 3).

Main IPSec components? SA, AH, ESP, IKE; ISAKMP provides SA/key-management framework.

What does AH provide? Source authentication + data integrity + replay protection; no encryption.

Confidentiality through symmetric-key encryption, plus

What does ESP add?
authentication/integrity capabilities.

AH protocol number? 51

ESP protocol number? 50

IKE port? UDP 500

What is SA? Set of parameters for one secure, unidirectional session.

How many SAs for two-way

At least two: inbound and outbound.
communication?

What is SPI? 32-bit value used by receiver to find correct SA.

Transport mode? Adds IPSec information to existing packet; no new IP packet.

Tunnel mode? Wraps entire original IP packet inside new IP packet.

Creates secure ISAKMP SA / negotiation channel; main or aggressive

IKE Phase 1?
mode.

IKE Phase 2? Creates IPSec SAs for protected data; quick mode.

Strong algorithms recommended? AES instead of DES; SHA instead of MD5.

5-second recall

VPN -> tunnel. IPSec -> Layer 3 security. SA -> rules. SPI -> SA ID. AH -> integrity/authentication.
ESP -> encryption + protection. IKE -> negotiate keys/SAs. Phase 1 -> ISAKMP SA. Phase 2 ->
IPSec SAs.

Based on uploaded lecture slides Page 12

IP Security (IPSec) - Simple Notes

10. Quick Self-Test

Q1. Why are two SAs needed for normal bidirectional IPSec communication?
Answer: Because each SA is unidirectional.

Q2. Which protocol provides confidentiality: AH or ESP?

Answer: ESP.

Q3. Which IPSec mode creates a new outer IP header?

Answer: Tunnel mode.

Q4. Which value does receiver use to locate correct SA?

Answer: SPI.

Q5. What does IKE Phase 1 establish?

Answer: Secure ISAKMP SA / negotiation channel.

Q6. What does IKE Phase 2 establish?

Answer: IPSec SAs used for protected traffic.

Q7. Which IKE mode uses six messages?

Answer: Main mode.

Q8. Which IKE mode uses three messages and lacks identity protection in slides?
Answer: Aggressive mode.

Q9. What is UDP port used by IKE in slides?

Answer: 500.

Q10. What algorithms are recommended over DES and MD5?

Answer: AES and SHA.

Final study tip

First memorize differences: AH vs ESP, Transport vs Tunnel, and IKE Phase 1 vs Phase 2. Then learn
SA/SPI details and configuration order.

Based on uploaded lecture slides Page 13