VPN types and IPsec: AH, ESP and IKE
Pick the VPN type from who connects and what they reach
A VPN builds an encrypted tunnel across a network you do not trust, usually the internet, so that the two ends behave as if they were on one private network. The decision rule: if the requirement connects two networks permanently, it is a site-to-site VPN between gateways; if it connects one user or device to a network, it is a client-to-site (remote access) VPN. Then look at the two refinements the exam likes, clientless and split tunnel. IPsec is the protocol suite that most site-to-site VPNs, and many remote access VPNs, use underneath.
| The requirement says | VPN type | Why |
|---|---|---|
| Branch office and head office share one address plan, always on, no user action | Site-to-site | Gateways at each edge hold the tunnel; hosts need no software |
| Employee on a laptop at home needs the whole internal network | Client-to-site, full or split tunnel | A VPN client on the device connects to a gateway |
| Contractor may open one internal web app, and nothing can be installed | Clientless (browser based) | The gateway publishes selected apps over TLS in a browser |
| Only traffic for corporate subnets should use the tunnel, the rest goes straight out | Split tunnel | Saves bandwidth, but the device is on two networks at once |
| All traffic must pass corporate inspection | Full tunnel | Everything is sent through the gateway, including internet traffic |
In Azure the same split appears: a VPN Gateway supports site-to-site IPsec/IKE tunnels, and point-to-site connections over OpenVPN, IKEv2 or SSTP (Microsoft Learn). A VPN still crosses the public internet; if the scenario says traffic must not, the answer is a private circuit such as ExpressRoute (AWS calls it Direct Connect), not a bigger VPN.
What IPsec adds: AH, ESP, modes and IKE
IPsec secures traffic at the IP layer, so applications need no changes. It has three parts that exams separate carefully.
- AH (Authentication Header, IP protocol 51) gives integrity, origin authentication and anti-replay, but no encryption. It also authenticates parts of the IP header, including the addresses, so it is inherently incompatible with NAT (RFC 4302, RFC 3948).
- ESP (Encapsulating Security Payload, IP protocol 50) gives the same integrity services and, normally, confidentiality by encrypting the payload (RFC 4303). In practice ESP is what is deployed.
- IKE (Internet Key Exchange) is not a data protocol. It authenticates the peers, agrees algorithms and keys, and creates the security associations (SAs) that AH or ESP then use. It runs over UDP 500, and over UDP 4500 when NAT traversal is needed (RFC 7296).
Each protocol works in one of two modes (RFC 4301):
| Mode | What is protected | Typical use |
|---|---|---|
| Transport | The payload of the original packet; the original IP header stays | Host to host |
| Tunnel | The whole original packet, which is wrapped in a new outer IP header | Gateway to gateway, so site-to-site VPNs |
IKE has two versions. In IKEv1 the exam vocabulary is phase 1 (build a protected channel between the peers) and phase 2 (negotiate the SAs that protect the actual traffic, called quick mode). IKEv2 folds this into an initial exchange of four messages, IKE_SA_INIT and IKE_AUTH, which create the IKE SA and the first child SA (RFC 7296). If a question says “phase 1 and phase 2” it is describing IKEv1 behaviour.
Worked example: one packet through a site-to-site tunnel
Head office uses 10.1.0.0/24 behind gateway 203.0.113.1; the branch uses 10.2.0.0/24 behind gateway 198.51.100.7. PC 10.1.0.15 sends a packet to server 10.2.0.20. The head office gateway matches it against the VPN policy and sends this over the internet, in ESP tunnel mode:
- Outer IP header: source 203.0.113.1, destination 198.51.100.7, protocol 50 (ESP).
- ESP header, then the encrypted original packet (10.1.0.15 to 10.2.0.20 plus its data) and the ESP trailer, followed by the integrity check value.
- The branch gateway verifies the integrity value, decrypts, discards the outer header and forwards the original packet to 10.2.0.20.
An observer on the internet sees only two gateway addresses and protocol 50. The private addresses are hidden, which is the point of tunnel mode. If the head office gateway sat behind a NAT device, the outer addresses would be rewritten, which is why ESP with NAT traversal (UDP 4500) works and AH does not.
Which exams test this
| Exam | How it appears | Where on this site |
|---|---|---|
| N10-009 | Networking Concepts (23%): VPN as a network function, VPN versus Direct Connect for cloud, and IPsec with AH, ESP and IKE as IP types. Network Operations (19%), objective 3.5: site-to-site, client-to-site, clientless, split versus full tunnel | Network security (VPN basics); Networking concepts |
| 200-301 | v1.1 (until Feb 2, 2027): Security Fundamentals (15%), 5.5, IPsec remote access and site-to-site. v2.0 (from Feb 3, 2027): Network Services and Security (20%), 4.5, the same topic with protocols and transport modes | Network services and security |
| SY0-801 | Security Architecture (19%), 3.2: VPN, remote access and tunneling as secure communication. Security+ V8 launches Nov 17, 2026; SY0-701 stays bookable until then | Security architecture |
| AZ-900 | Architecture and services (35 to 40%): the purpose of Azure VPN Gateway and ExpressRoute | Architecture and services |
| SC-500 | Secure storage, databases and networking (25 to 30%): configure security for VPN connections | Storage, databases and networking (listed, little depth) |
| 200-901 | Network Fundamentals (15%), 6.8: a VPN as one possible cause of application connectivity trouble (minor) | Network fundamentals |
How VPN questions are built
- “Encrypted” versus “authenticated only”. AH cannot satisfy a confidentiality requirement. If the answer must hide payloads, it is ESP.
- NAT in the path. Any scenario with a NAT device between the gateways rules out AH and points to ESP with NAT traversal. Related reading is NAT types.
- Mode. “Between two gateways” or “the original IP header must be hidden” means tunnel mode; “host to host” means transport mode.
- Client software. “Without installing anything” means clientless; “only corporate traffic” means split tunnel; “all traffic inspected” means full tunnel.
- Wrong layer. IKE negotiates; it does not carry user data. Ports 500 and 4500 are UDP, so look up the others in the common ports cheat sheet.
Practice questions
Question 1. Two branch gateways must exchange traffic that is both encrypted and authenticated. One gateway sits behind a router that performs NAT. Which IPsec protocol should be used?
- A. AH
- B. IKE
- C. ESP
- D. GRE
Show answer
Answer: C
ESP provides encryption plus integrity and works with NAT traversal, which encapsulates it in UDP 4500. AH provides integrity only and authenticates the outer IP addresses, so NAT breaks it. IKE only negotiates keys and SAs. GRE is a tunnelling protocol with no encryption or authentication of its own.
Question 2. A contractor must reach one internal web application from an unmanaged computer. Security forbids installing software on that computer and forbids giving the contractor access to the rest of the network. Which solution fits best?
- A. A site-to-site VPN to the contractor’s network
- B. A clientless VPN published through the gateway
- C. A full-tunnel client VPN
- D. A split-tunnel client VPN
Show answer
Answer: B
A clientless VPN publishes selected applications through a browser over TLS, so nothing is installed and access is limited to what the gateway publishes. A site-to-site VPN connects whole networks. A full-tunnel client VPN needs a client and normally gives broad network access. A split-tunnel client VPN also needs a client.
Go deeper
- RFC 4301, Security Architecture for IP for SAs and the two modes.
- RFC 7296, IKEv2 for the exchanges and ports.
- Azure VPN Gateway overview for site-to-site, point-to-site and protocol support.
- On this site: network devices, cryptography basics, zero trust, and the study method.