IPsec questions and answers test how well you understand VPN security, traffic selection, tunnel negotiation, encryption, integrity, and troubleshooting. The examples below focus on concepts that remain useful for Cisco networking and security study.
What Is IPsec?
IPsec is a suite of protocols that protects IP traffic across an untrusted network. It can provide confidentiality through encryption, integrity to detect modification, authentication of peers, and anti-replay protection. Site-to-site VPNs commonly use IPsec to connect offices securely over the internet.
What Is Interesting Traffic?
Interesting traffic is the traffic selected for protection by the VPN policy. Traditional policy-based VPNs often use an access control list to define the local and remote networks. The source and destination must mirror correctly on the opposite peer.
For example, one router may protect traffic from 10.10.10.0/24 to 10.20.20.0/24. The remote router should define the reverse direction. A mismatch can prevent negotiation or cause only one direction to work.
IKE and IPsec Security Associations
Internet Key Exchange (IKE) authenticates peers and negotiates security parameters. The resulting security associations define how traffic is protected. IKEv2 simplifies negotiation and is commonly preferred in modern designs.
- IKE security association: protects control-plane negotiation between peers.
- IPsec security association: protects the actual user data.
Transport Mode vs Tunnel Mode
Transport mode protects the payload of the original IP packet and is often used when the endpoints themselves perform IPsec. Tunnel mode encapsulates and protects the complete original packet inside a new IP packet. Site-to-site VPNs commonly use tunnel mode.
ESP and AH
Encapsulating Security Payload (ESP) can provide encryption, integrity, authentication, and anti-replay protection. Authentication Header (AH) provides integrity and authentication but not encryption, and it is less commonly deployed because it does not work well with address translation.
How NAT Affects IPsec
NAT can change packet headers and interfere with IPsec negotiation. NAT Traversal encapsulates IPsec traffic in UDP, commonly using port 4500. Policy-based VPNs may also require NAT exemption so protected traffic is not translated before encryption.
IPsec Troubleshooting Checklist
- Verify IP reachability between VPN peers.
- Confirm peer addresses and authentication credentials.
- Compare IKE proposals, encryption, integrity, and Diffie-Hellman settings.
- Check that interesting-traffic selectors mirror correctly.
- Review NAT and firewall rules for required protocols and ports.
- Generate matching traffic and inspect security-association counters.
- Check routing so protected networks use the intended VPN device.
Common IPsec Symptoms
- No IKE association: investigate reachability, credentials, proposals, and firewall filtering.
- IKE is established but no IPsec association: check traffic selectors and IPsec proposals.
- Encapsulation increases but decapsulation does not: inspect the remote peer, routing, NAT, and return traffic.
- Tunnel works intermittently: examine rekey timers, path MTU, fragmentation, and unstable connectivity.
Frequently Asked Questions
Does IPsec always encrypt traffic?
No. The selected protocol and settings determine the protection. ESP commonly provides encryption, while AH does not.
Which ports does IKE use?
IKE commonly uses UDP port 500. NAT Traversal commonly uses UDP port 4500.
Where can I practice more Cisco security questions?
Review our CCNA interview questions and answers. For focused preparation, browse the Cisco Premium PDF directory for relevant Premium PDFs with the latest available questions and answers.
CiscoForAll provides independent study and practice material. Always use official Cisco documentation as a primary preparation source.