What does IPSec stand for?
IPSec stands for Internet Protocol Security. A suite that secures IP traffic at the network layer. AH provides integrity and authentication, ESP adds encryption; tunnel mode is used for site-to-site VPNs.
IPSec is a set of protocols that protects traffic at the IP layer, so any application's packets can be secured without changing the application. ESP encrypts packets and checks their integrity. AH checks integrity and origin but does not encrypt. IKE negotiates the keys and parameters between the two ends. In tunnel mode the whole original packet is wrapped inside a new one, which is how site-to-site VPNs connect two networks. In transport mode only the payload is protected, between two hosts. When one end sits behind NAT, the ESP packets are wrapped in UDP on port 4500 so that they survive the address translation.
IPSec in practice: an example
A company links its head office and a branch over the internet. The two firewalls negotiate keys with IKE and build an IPSec tunnel. A file copied from a branch PC to a head-office server crosses the internet inside encrypted ESP packets, and neither the PC nor the server needs any VPN software.
What IPSec is confused with
IPSec vs TLS: what is the difference?
IPSec works at the network layer and can protect all traffic between two networks. TLS works above the transport layer and protects one application's connection, such as a browser session. What TLS stands for
IPSec vs VPN: what is the difference?
A VPN is the private connection; IPSec is one of the technologies used to build it. TLS-based VPNs are another. What VPN stands for
Which exams cover IPSec?
IPSec is on the official CompTIA acronym list for two of the four exams covered here.
- Security+ SY0-801: on the acronym list, not tied to one objective.
- Network+ N10-009: 1.0 (Networking Concepts).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Which IPSec protocol provides encryption of the packet payload?
- AH
- ESP
- ARP
- ICMP
Show the answer
B. ESP. ESP provides confidentiality and integrity. AH authenticates the packet but leaves its content readable.
2. Two offices must be connected so that all traffic between their networks is encrypted, with no software on the PCs. Which IPSec mode do the gateways use?
- Transport mode
- Tunnel mode
- Monitor mode
- Promiscuous mode
Show the answer
B. Tunnel mode. Tunnel mode encapsulates the entire original packet between two gateways, which is the standard design for a site-to-site VPN.
Sources: RFC 4301: Security Architecture for the Internet Protocol; RFC 4303: IP Encapsulating Security Payload (ESP); RFC 3948: UDP Encapsulation of IPsec ESP Packets; NIST SP 800-77 Rev. 1, Guide to IPsec VPNs. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.