Now that we understand how IPsec wraps packets (Modes), we must decide *how* to protect the data. IPsec provides two primary protocols for this: AH and ESP. While they might seem similar, they offer fundamentally different security guarantees.
AH is designed for integrity and authenticity only. It signs the entire packet (including the IP header) using a keyed hash. This ensures that the packet wasn't tampered with and that it truly came from the claimed sender. However, AH provides **zero encryption**. Everything is sent in cleartext.
⚠️ AH is almost never used in modern deployments because it is incompatible with NAT. Since NAT changes the IP header (the source IP), and AH signs the IP header, the integrity check will fail at the destination every single time.
In the output above, `proto 51` identifies the Authentication Header. If you see this in a modern network, it's likely a legacy system or a very specific internal requirement where encryption is legally forbidden but integrity is required.
ESP is the 'workhorse' of IPsec. Unlike AH, ESP provides confidentiality (encryption) as well as optional authentication. It encrypts the payload and adds its own header and trailer. Because ESP does not sign the outer IP header, it can pass through NAT devices (provided NAT-T is enabled).
💡 Modern ESP implementations use 'Authenticated Encryption' (like AES-GCM), which provides both encryption and integrity in one efficient operation, making AH redundant.
# Conceptual ESP Packet Structure
[ New IP Header ] [ ESP Header ] [ IV ] [ Encrypted Data ] [ ESP Trailer ] [ ESP Auth Tag ]| Feature | AH (Protocol 51) | ESP (Protocol 50) |
|---|---|---|
| Confidentiality | None (Cleartext) | Strong (AES/ChaCha20) |
| Integrity | Entire Packet | Payload + ESP Header |
| NAT Compatible | No | Yes (with NAT-T) |
| Overhead | Low | Medium |
| Modern Usage | Rare/Obsolete | Industry Standard |
In contemporary security architecture, the recommendation is to use ESP for everything. If you need authentication without encryption, you can technically configure ESP with a 'NULL' encryption algorithm, but you still benefit from the NAT compatibility and structural advantages of the ESP protocol.
A common mistake is thinking that ESP is automatically secure. If you use an old ESP configuration with DES or 3DES, the encryption is trivial to crack.
Verify exercises to earn ★ 140 XP and unlock next lab level.