IPsec

IPsec (Internet Protocol Security) is a set of protocols that secures traffic at the network layer instead of encrypting individual applications one by one. The advantage of this approach is that every connection between two networks is automatically protected without each application needing to handle encryption itself. IPsec is the technical foundation many site-to-site VPN connections between company locations are built on.

In practice, two firewalls or VPN gateways first negotiate shared keys through the IKE (Internet Key Exchange) protocol. The ESP (Encapsulating Security Payload) protocol then encrypts and signs the actual traffic passing between the two points. Staff see none of this day to day; the connection between two sites simply works, as long as the configuration matches on both ends.

A common stumbling block is that IPsec connections between devices from different manufacturers don't automatically interoperate, because both sides must use exactly the same encryption and exchange parameters. Even a small mismatch in configuration, such as a different encryption algorithm, prevents the connection from being established at all, rather than merely weakening its security.