What Is IPsec VPN? How It Works, Protocols, and When to Use It

September 15, 2026 By Johan Curtis No Comments 9 minutes

IPsec is a protocol used for securing internet communications. When do you use IPsec, or when does it come in handy? Read everything you need to know about it in this blog.

What Is IPsec?

Internet Protocol Security, or IPsec, is a Layer 3 protocol framework that encrypts and authenticates IP packets between two endpoints. This procedure enables secure site-to-site VPNs, giving you remote-access VPNs, and cloud interconnects.

In plain terms: IPsec is a set of rules that govern how data is encrypted, authenticated, and transmitted securely across a network. It does not refer to a single protocol but a suite of them working together. When your office VPN connects two branch locations securely over the public internet, IPsec is almost certainly what is making that connection safe.

Any application running on the network gets the protection automatically, without needing to be individually configured for encryption.

How IPsec VPN Works: The Seven Stages

First things first: IPsec is not a single protocol; rather, it is a set of components that deliver host recognition, negotiation, authentication, encryption, transmission, decryption, and termination altogether, working as one unit. 

Here is what each stage actually means:

1. Host Recognition

The two devices that want to communicate identify each other and agree that an IPsec connection should be established.

2. Negotiation

The devices negotiate which security parameters they will use: which encryption algorithm, which authentication method, and how long the session will last. 

These negotiations comprise two forms: a main mode in which both systems propose and negotiate until they reach an agreed set of protocols, and an aggressive mode, when the initiating system proposes its preferences to conclude the process with or without further negotiation. 

3. Authentication

IPsec authenticates each packet to verify its source, confirming its legitimacy and preventing tampering. 

4. Encryption

Once authenticated, Data is secured by encrypting packet payloads. Using tunnel mode, it is ensured that data remains protected during the next phase; i.e the transmission phase. 

5. Transmission

Using the User Datagram Protocol (UDP), IPsec payloads can pass through firewalls without impediment. 

6. Decryption

At the receiving end, the device uses the agreed keys to decrypt the packet and reassemble the original data.

7. Termination

The session ends, keys are discarded, and the security association is closed.

The Three Core IPsec Protocols

Authentication Header (AH)

Authentication Header (AH) doesn’t encrypt data; rather, it provides data integrity and authentication. This process ensures that the transmitted data has not been modified. 

AH is useful when you need to verify that packets have not been altered in transit, but it offers no confidentiality. Because it authenticates the entire packet, including the IP header, it is also incompatible with Network Address Translation (NAT), which makes it less commonly used in modern deployments.

Encapsulating Security Payload (ESP)

ESP is the workhorse of IPsec. 

Unlike AH, ESP provides confidentiality, which is what most people mean when they think about VPN encryption. Most real-world IPsec deployments use ESP rather than AH, or use ESP with its optional authentication feature to cover both confidentiality and integrity in one protocol.

Internet Key Exchange (IKE)

Both host systems need the keys that are needed to encrypt as well as decrypt the data packets. IKE is what establishes and manages the security association before any data is transmitted.

With IKEv2, IPsec sets up a Security Association (SA), the logical connection that provides a secure channel between network devices.

IKEv2 is faster than its predecessor IKEv1, supports MOBIKE (which maintains connections when switching networks, useful on mobile devices), and handles re-keying more efficiently. Most modern VPN implementations use IKEv2.

IPsec Modes: Tunnel vs Transport

Tunnel mode wraps the entire original data packet — including source and destination addresses — inside a new packet with a fresh header. This conceals the original network details and is the preferred choice for site-to-site and consumer VPN setups. Transport mode, on the other hand, encrypts only the data payload while leaving the original packet headers exposed. It is typically reserved for direct host-to-host communication on networks that are already partially trusted.

Tunnel Mode

This is the mode used for site-to-site VPNs and gateway-based connections. Because the original IP header is hidden, an outside observer cannot determine the source or destination of the traffic inside the tunnel. This is the more secure of the two modes and the one most consumer VPNs, including FastestVPN, use.

Transport Mode

This makes it suitable for host-to-host communication on trusted networks where the IP addresses of the communicating parties do not need to be concealed. It is best for end-to-end host communication, while tunnel mode is best for site-to-site VPNs, cloud VPNs, and gateway-based network protocols. 

IKEv1 vs IKEv2: What Changed

IKEv1 aggressive mode is faster but weaker, as it exposes identities during negotiation. Most references to IPsec in modern VPN contexts involve IKEv2. Here is why the upgrade matters. 

IKEv2, the current standard, improved on this with:

• Faster negotiation using fewer message exchanges
• Built-in NAT traversal, removing compatibility issues with modern networks
• MOBIKE support, which allows the VPN connection to survive network changes (moving from Wi-Fi to mobile data without dropping)
• Better resistance to denial-of-service attacks through cookie-based mechanisms
• Simpler re-keying for long-lived connections

For anyone using a VPN on a phone or laptop that moves between networks, IKEv2’s MOBIKE support is the practical difference that matters most.

IPsec vs Other VPN Protocols

IPsec vs WireGuard

WireGuard is newer, uses a leaner codebase (roughly 4,000 lines vs. IPsec’s considerably larger implementation), and generally achieves faster throughput with lower latency. IPsec has deeper enterprise support, broader hardware acceleration, and a longer track record in enterprise and government deployments. For most consumer VPN use cases, both are strong choices. FastestVPN supports both.

IPsec vs. SSL/TLS (OpenVPN)

SSL VPNs secure data at the application level, typically protecting traffic within a web browser rather than the entire network connection. This makes them a practical choice for straightforward, app-specific remote access scenarios where full network-level encryption isn’t necessary.

OpenVPN, which runs on SSL/TLS, offers extensive configuration options and is known for its ability to bypass censorship and restrictive networks. The trade-off is that it requires a dedicated client application to function.

IPsec, by contrast, is integrated directly into most major operating systems — including Windows, macOS, iOS, and Android. This means IKEv2/IPsec connections can be set up without installing any additional software, which is one of its most practical advantages over OpenVPN for everyday users.

Advantages and Limitations of IPsec VPN

Advantages:

• Operates at Layer 3, so all application traffic is protected automatically
• Native support in Windows, macOS, iOS, and Android
• Strong encryption using AES-256, SHA-256/384/512, and DHE/ECDHE for forward secrecy
• IKEv2 handles network changes gracefully on mobile devices
• Widely tested, audited, and deployed in enterprise and government environments

Limitations:

• More complex to configure from scratch than WireGuard or OpenVPN
• AH protocol is incompatible with NAT, though ESP avoids this limitation
• Larger codebase than WireGuard increases the theoretical attack surface, though no significant real-world exploits of a correctly configured IKEv2/IPsec deployment have been publicly documented

Frequently Asked Questions

What is IPsec VPN?

IPsec VPN is a security protocol suite that encrypts and authenticates data packets traveling between two network endpoints. Because it functions at the network layer (Layer 3), it works with any application that uses IP — meaning it can secure everything from web browsing to file transfers without needing individual app configuration. It is commonly deployed for site-to-site connections, remote access, and cloud network security.

What are the main IPsec protocols?

IPsec relies on two core security protocols. Authentication Header (AH) verifies the integrity and origin of data but does not encrypt the contents. Encapsulating Security Payload (ESP) goes a step further by both authenticating and encrypting the payload. A third component, Internet Key Exchange (IKE), handles the negotiation of encryption keys and establishes the security parameters that both devices agree on before communication begins.

Is IPsec better than WireGuard?

Neither protocol is universally superior. WireGuard tends to deliver faster speeds and has a leaner, more modern codebase. IPsec, however, benefits from decades of enterprise adoption and native support across virtually every operating system. Many VPN providers, including FastestVPN, offer both protocols so users can pick whichever suits their performance needs and device compatibility.

What is IKEv2 in IPsec?

IKEv2 (Internet Key Exchange version 2) is the protocol responsible for setting up and managing the security association within an IPsec connection. It determines the encryption and authentication settings both endpoints will use and ensures they share matching keys before any data is transmitted. Compared to the older IKEv1, IKEv2 is faster, supports MOBIKE for uninterrupted connections when switching networks, and has become the default choice in most modern VPN implementations.

Does FastestVPN use IPsec?

Yes. FastestVPN supports IKEv2/IPsec on all major platforms. It operates in tunnel mode with AES-256 encryption enabled by default, making it well-suited for everyday privacy protection, secure remote access, and mobile usage where MOBIKE’s ability to maintain connections across network changes is particularly useful.

IPsec and FastestVPN

FastestVPN supports IKEv2/IPsec as one of its core VPN protocols, available across Windows, macOS, iOS, Android, and router configurations. IKEv2/IPsec is particularly well-suited for mobile users because MOBIKE maintains your VPN connection when you switch from a Wi-Fi network to a cellular connection and back, without any manual reconnection required.

When you connect through FastestVPN using IKEv2/IPsec, your traffic runs through tunnel mode with AES-256 encryption and SHA-384 authentication by default. The original IP headers of your packets are concealed inside the encrypted tunnel; your actual IP address is replaced with FastestVPN’s server IP, and the entire data path between your device and the destination server is protected end-to-end.