5

As I understand, IPSec protects packets at IP layer and SSL/TLS at transport layer?

Is there a scenario in which we might want to use both?

3

Absolutely. In fact, I'm posting this answer using both IPSec (via VPN) and TLS (via HTTPS). As you noted, the technologies are similar as they both provide confidentiality and integrity on communications. Sometimes, as discussed in gowenfawr's answer, there is little value of using the two combined, but sometimes there is value.

Both protocols encrypt the contents of messages but leave the envelope unencrypted. The envelope contains information about the protocol being communicated and the site that you are communicating with. So, someone watching my home network connection can see that I'm using IPSec to connect to my VPN provider but they cannot tell that I'm posting on StackExchange. If I wasn't using VPN, someone monitoring my home network connection would see that I'm posting on StackExchange (specifically security.SE), but not be able to see what I'm posting or to what question I'm responding to.

I should point out that the VPN doesn't totally hide my connection to StackExchange, it just hides it between my home and my VPN provider. Someone watching my VPN provider's outbound connection would see the posting to StackExchange, they just wouldn't be able to match it to me.

So this answer posting is IPSec and TLS encrypted between my home and my VPN provider and just TLS encrypted from my VPN provider to StackExchange.

Whether this is an interesting distinction or not is up to you. It will likely depend on the task you are performing.

2

Another advantage not mentioned in other responses, and one for the really paranoid, is that in the event of a critical vulnerability being detected in one of the technologies, one would still have the benefit (confidentiality and integrity on communications) of the other technology.

1

See also What is the difference between SSH and IPSec? - the same rules apply. Both may be used without issue, and often are (e.g. I VPN into my work and access webmail over HTTPS).

There's rarely a security advantage to be had in layering the two; either provides sufficient security for the leg of traffic they cover.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.