4.5 Cryptography, IPsec VPN Architecture (AH/ESP) & Tunnel Modes

🎯 Key CompTIA Network+ Exam Takeaways

• AES is a symmetric bulk cipher; RSA and Diffie-Hellman are asymmetric public-key algorithms used for key exchange.
• IPsec ESP (protocol 50) provides confidentiality (encryption), integrity, and authentication; AH (protocol 51) provides NO encryption.
• IPsec Tunnel Mode encrypts the entire original IP packet and adds a new public outer header for gateway-to-gateway site-to-site VPNs.

Cryptography underpins network data privacy and integrity. Symmetric ciphers (AES-256) provide fast, efficient encryption for large data streams. Asymmetric algorithms (RSA, ECC, Diffie-Hellman) securely exchange shared symmetric keys across untrusted networks.

IPsec is the standard framework for secure network communications. It operates using two headers: Authentication Header (AH, IP protocol 51) provides data integrity and anti-replay but no encryption. Encapsulating Security Payload (ESP, IP protocol 50) encrypts data payloads with AES.

In IPsec Tunnel Mode, the entire original IP packet is encrypted and enclosed inside a newly generated public IP header, making it the universal standard for site-to-site VPN gateways across the public Internet.

⚠️ Common Pearson VUE Exam Traps

• Selecting AH when confidentiality or encryption is required; AH provides integrity and authentication only.
• Using IPsec Transport mode for site-to-site WANs; Transport mode exposes private IP headers to the public Internet.