IPSec Encapsulating Security Payload

IP Protocol 50

Usually used with GRE, or mGRE.

Terms

ESP — Encapsulating Security Payload

IPSec process responsible for providing encryption

ESP SPI — Security Parameters Index

32-bit field
Identifies the SA on both sides

ESP Sequence

32-bit field
Goes up by 1 for each transmitted packet.

It’s not recommended to share a SA for multiple senders for this reason.

Transport mode

IPSec Transport Mode

IPSec ESP Packet

Tunnel mode

IPSec Tunnel Mode

IPSec ESP Packet

References

RFC 4303: IP Encapsulating Security Payload (ESP) | RFC Editor

RFC 7296: Internet Key Exchange Protocol Version 2 (IKEv2) | RFC Editor

IPsec - Wikipedia