L47
IPsec, ESP, AH, modes and IKE
Cram this first — memory hook
Internet Key Exchange agrees; Encapsulating Security Payload protects; tunnel wraps the whole original packet. 500 talks; 4500 traverses NAT; 50/51 are protocol IDs.
Exam trap
Authentication Header does not encrypt. Internet Protocol protocol 50 is not port 50. Protection depends on configuration, not merely the word .
The slide facts
Internet Protocol Security includes / and transport/tunnel modes. negotiates keys/settings; the phase I/phase II description is identified with IKEv1 in the simplified lesson.
If you have time — extra
Internet Protocol Security () protects traffic using negotiated security arrangements. Encapsulating Security Payload () can provide confidentiality and integrity/authentication according to the selected algorithms. Authentication Header () provides integrity/authentication but not encryption. In transport mode, the original addressing remains outside the protected upper-layer payload; in tunnel mode, an original packet is encapsulated inside a new outer packet, commonly for gateway VPNs. Internet Key Exchange () negotiates security associations and keys. A Security Association () describes security parameters for traffic; SAs are directional. The old phase I/II vocabulary belongs to IKEv1; do not imply IKEv2 uses exactly the same exchange structure. Added port/protocol facts for the trainer: commonly uses User Datagram Protocol 500; Network Address Translation Traversal () commonly uses 4500. Native is protocol 50 and is protocol 51. Those numbers are not Transmission Control Protocol / ports.
Walkthrough
Peers authenticate and negotiate through , establish appropriate SAs, protect data using the negotiated parameters/mode, and renew keys/SAs as required. Trace outer versus inner addresses when diagnosing routing.