We've seen how IPsec wraps packets using AH or ESP. But how does a server know *which* key to use for a specific packet? If a server has VPN tunnels to ten different offices, it can't use the same key for all of them. This is managed by the Security Association (SA) and the Security Policy Database (SPD).
The SPD is the 'Rule Book'. Before a packet is even processed by the IPsec engine, the OS checks the SPD to decide what to do. The SPD contains rules based on source/destination IP, port, and protocol. It can tell the OS to: 1. Bypass (send in cleartext), 2. Discard (block), or 3. Protect (apply IPsec).
💡 Think of the SPD as a firewall for encryption. It defines *what* needs to be encrypted before the system decides *how* to encrypt it.
# Conceptual SPD Entry
Rule 1: Src 10.0.1.0/24, Dst 10.0.2.0/24 -> ACTION: PROTECT
Rule 2: Src 10.0.1.0/24, Dst 8.8.8.8 -> ACTION: BYPASS
Rule 3: Any -> Any -> ACTION: DISCARDOnce the SPD decides a packet must be 'Protected', it hands the packet over to the SA manager to find the actual cryptographic keys.
The SA is the 'Actual Contract'. It is a one-way (unidirectional) agreement between two parties that defines the specific algorithms and keys used for a session. Because an SA is unidirectional, a bidirectional conversation requires **two SAs**: one for inbound traffic and one for outbound traffic.
The SPI (Security Parameter Index): Since there are many SAs, every ESP packet contains an SPI. This is a unique 32-bit identifier that tells the receiver, 'Use SA #456 to decrypt this packet'.
| Component | Role | Analogy |
|---|---|---|
| SPD | Policy Decision | The Company Rulebook |
| SA | Cryptographic Agreement | A Signed Contract |
| SPI | SA Identifier | The Contract ID Number |
SAs are not permanent. To prevent an attacker from collecting enough ciphertext to crack a key, SAs have a 'Lifetime' (e.g., 8 hours or 10GB of data). When the lifetime expires, the two endpoints must negotiate a new SA through a process called 'Rekeying'.
A 'Symmetric SA' does not exist. If you see a configuration that implies a single key for both directions, it is likely a simplified representation of two separate unidirectional SAs.
Verify exercises to earn ★ 150 XP and unlock next lab level.