3

IPsec is a security mechanism that provides peer-entity authentication, data-origin authentication, data integrity, and optionally data confidentiality. It relies on extensions to the standard IP header layout and an additional protocol.

The security services that IPSec can provide are:

  • Authorization–access control;
  • Connectionless data integrity;
  • Data-origin authentication;
  • Peer-entity authentication;
  • Rejection of replayed packets;
  • Confidentiality (encryption); and
  • Limited traffic flow confidentiality.

I am unsure how this relates to protection against IP spoofing.

Improve this question

1 Answer 1

Reset to default
4

The simplest answer is that negotiating an IPSec connection requires mutual authentication, which is a way to prove the identity of the entity behind the IP address. All subsequent communications are cryptographically sound, such that there's no way you can carry on those communications unless you went through the mutual authentication phase. An attacker can spoof the IP - but they can't convince the other party to trust that IP unless they compromise the credentials used.

It's more complex than that, of course, but that's the gist of it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .