Computer Network & Network Security System — Network Security, NEC licence examination syllabus (Nepal Engineering Council).
Network Layer Security: IPsec and VPN
Securing the actual network layer itself, not just individual applications.
🛡️ IPsec — AH and ESP
AHAuthentication Header — provides authentication and integrity, but NOT confidentiality (data isn't encrypted, just verified as unaltered).
ESPEncapsulating Security Payload — provides encryption (confidentiality) PLUS authentication and integrity — the more commonly used of the two in practice.
Transport modeOnly the payload is protected — used for direct end-to-end host communication.
Tunnel modeThe ENTIRE original IP packet is protected and wrapped inside a new one — used for site-to-site VPNs.
A VPN (Virtual Private Network) creates an encrypted "tunnel" over a public network (like the internet), making a remote connection behave as if it were on a private, secure network — this is exactly what lets employees securely access their office network from home.
💡 One-liner: "Why choose ESP over AH?" → ESP encrypts the data (confidentiality) in addition to authenticating it; AH only authenticates — for most real security needs, ESP is the stronger choice.
Why ESP is used and AH is largely not
"ESP also encrypts" is true but understates it. AH has a structural problem that makes it unusable across most of the internet.
AH authenticates the IP header, including the source and destination addresses. NAT rewrites the source address as the packet leaves a private network. So the address the receiver checks is not the one that was authenticated, the integrity check fails, and the packet is discarded — every time. AH and NAT cannot coexist.
💡 ESP protects only the payload, leaving the outer IP header alone, so NAT can rewrite addresses without breaking anything. Since almost every home and office connection sits behind NAT, this is the practical reason ESP dominates — a better answer than "it encrypts too", and the one exam questions are usually reaching for.
Transport and tunnel mode, and what each hides
Original packet: [IP header][TCP header][data]
TRANSPORT MODE [IP header][ESP][TCP header][data][ESP trailer]
↑ original header kept, visible
Protects the payload. Anyone watching still
sees WHO is talking to WHOM.
TUNNEL MODE [NEW IP header][ESP][IP header][TCP][data][trailer]
↑ entire original packet, encrypted
The original addresses are inside the encrypted
part. An observer sees only gateway-to-gateway
traffic.
Tunnel mode conceals the traffic pattern, not merely the contents. Two offices linked by a tunnel-mode VPN look like a single encrypted stream between two gateways, revealing nothing about which internal machines are communicating — which is why site-to-site VPNs use it and end-to-end host pairs generally use transport mode.
💡 The cost is overhead: tunnel mode adds a whole extra IP header to every packet, reducing the payload each one can carry. It also explains why a VPN can require a lower MTU — the added headers must fit within the same maximum packet size.
What a VPN does and does not protect
🔐 The boundaries of the tunnel
ProtectedEverything between the two tunnel endpoints — unreadable and unmodifiable in transit.
Not protectedAnything beyond the far endpoint. Traffic leaving the VPN gateway for the wider internet travels normally from there.
Not protectedThe endpoints themselves. A compromised machine at either end sees the data in plaintext, because that is where it is decrypted.
💡 So "a VPN makes you secure" is too strong. It relocates the trust boundary to the VPN provider or gateway rather than removing it — a good exam answer names what is protected, between which points, and against whom.
Syllabus points
IPsec: AH, ESP; transport vs tunnel mode
VPN concept
Create a free account to tick topics off, take notes as you read, watch the video lessons and get a day-by-day study plan built around your exam date.