Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

IPsec is a security mechanism that provides peer-entity authentication, data-origin authentication, data integrity, and optionally data confidentiality. It relies on extensions to the standard IP header layout and an additional protocol.

The security services that IPSec can provide are:

  • Authorization–access control;
  • Connectionless data integrity;
  • Data-origin authentication;
  • Peer-entity authentication;
  • Rejection of replayed packets;
  • Confidentiality (encryption); and
  • Limited traffic flow confidentiality.

I am unsure how this relates to protection against IP spoofing.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

The simplest answer is that negotiating an IPSec connection requires mutual authentication, which is a way to prove the identity of the entity behind the IP address. All subsequent communications are cryptographically sound, such that there's no way you can carry on those communications unless you went through the mutual authentication phase. An attacker can spoof the IP - but they can't convince the other party to trust that IP unless they compromise the credentials used.

It's more complex than that, of course, but that's the gist of it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.