IPsec
IP SecurityIPsec encrypts at the network layer, so nothing above needs to know. It authenticates and encrypts whole IP packets, negotiating keys with IKE before any traffic passes — which is what lets two offices behave as one network across the public internet.
IPsec secures the packet rather than the connection — so every application above it is protected without being changed at all.
How it works
In tunnel mode the entire original packet — addresses included — is encrypted and given a fresh outer header addressed gateway to gateway. An observer sees two gateways talking, and nothing about who is really behind them.
What IPsec does, step by step
IKEv2 authenticates the peers, by certificate or pre-shared key, and derives keys over UDP 500.
A pair of security associations is set up — one per direction — each with its own keys and parameters.
ESP encrypts and authenticates each packet; AH authenticates only, and is rarely used now.
SAs expire on time or volume and are rekeyed; DPD notices when the far end has gone away.
In cybersecurity
IPsec is strong cryptography with a great many knobs — most real failures are not breaks but weak pre-shared keys and obsolete algorithms left enabled.
IKEv1 aggressive mode with a PSK can be captured and cracked offline — use certificates or EAP.
DES, 3DES, MD5 and DH groups 1, 2 and 5 should all be off; use AES-GCM and a modern group.
IKEv2 is simpler, faster to rekey and has fewer footguns — migrate where you can.
AH authenticates the outer header, so any NAT on the path breaks it; ESP with NAT-T is the answer.
Enable PFS on rekey so one compromised key doesn’t unlock previously captured traffic.
A site-to-site tunnel joins two networks; what may cross it is still a firewall’s decision.