What is it?
IPsec (Internet Protocol Security) is the most common protocol suite used to build site-to-site VPNs. It uses ESP (Encapsulating Security Payload) to encrypt and authenticate data, and (less commonly today) AH (Authentication Header) to authenticate without encrypting. IPsec negotiation happens in two phases, usually via IKE (Internet Key Exchange).
Why should I learn it?
“Explain IPsec Phase 1 and Phase 2” is one of the most classic VPN interview questions, and understanding it makes real troubleshooting (a VPN “up” but no traffic passing) much easier.
How it works
Phase 1 (IKE Phase 1): the two VPN gateways authenticate each other and negotiate a secure, encrypted management channel (ISAKMP SA) used only to protect further negotiation. Phase 2 (IKE Phase 2): using the secure channel from Phase 1, the gateways negotiate the actual IPsec SAs (Security Associations) — the encryption/authentication parameters used to protect the real data traffic. Only after both phases succeed does user traffic actually flow encrypted through the tunnel.
Real-world example
A VPN tunnel shows as “up” on both routers (Phase 1 succeeded), but no traffic passes — a classic case of Phase 2 failing to negotiate, often due to mismatched “interesting traffic” (the traffic selectors defining what should go through the tunnel).
Troubleshooting mindset
When a VPN tunnel isn’t passing traffic, check Phase 1 and Phase 2 status separately — “the tunnel is up” often only means Phase 1 succeeded, not that data traffic is actually protected.
Common mistake
Do not memorise the definition without connecting it to packet flow, device state and verification. Ask: what should happen, what actually happened, and which command or capture can prove the difference?
Quick recap
- Understand the job of the protocol or feature.
- Know where it sits in the traffic path.
- Verify behaviour instead of guessing.
- Connect the topic to the next networking layer.
Interview connection
Explain the concept in simple words first. Then give one practical example or troubleshooting check. That is stronger than repeating a textbook definition.
References & Further Reading
- AddySec original content — written for the Network Security track to build practical, interview-ready understanding.
Apni Bhasha mein samjho
IPsec do phases mein kaam karta hai — Phase 1 mein ek secure control channel banta hai, Phase 2 mein actual data ko encrypt karne wala tunnel banta hai.
Kaise padho?
Concept ko pehle flow ke saath samjho. Phir English note ke technical terms, commands aur tables dekho — technical terminology same rahegi.