Encryption and trust

IPsec

Also called IKE, IKEv2, ESP, security association, SA, SPI, site-to-site VPN, strongSwan, traffic selector

Encryption at the IP layer: IKE agrees keys between two gateways, ESP carries their traffic encrypted.

IKEv2 (UDP 500, then 4500) runs a Diffie-Hellman exchange, authenticates the peers with a pre-shared key or certificates, and sets up CHILD SAs: one per direction, each named by an SPI, with its own keys. The kernel's policies (ip xfrm policy) decide which traffic goes in: the traffic selectors, which both ends must agree on. ESP (IP protocol 50) in tunnel mode carries whole packets, headers included, between the gateways, so the path sees only that the two sites talk. SAs are rekeyed on a timer, each time with a fresh Diffie-Hellman (perfect forward secrecy). The added headers shrink the MTU by 50 to 70 bytes.

See it on real machines

Learn it on real machines.