Internet Protocol Security (IPsec) is designed and used to provide secure connections between nodes and networks throughout the internet. IPsec has become the standard for most of the IP Virtual Private Network (VPN) technology.

Note: This document covers both the policy-based and route-based VPN functionality supported on LoadMaster. Policy-based VPNs are supported in the base LoadMaster system in LMOS 7.2.48.x and subsequent releases. Support for route-based VPNs was added in LMOS 7.2.53.0 via an add-on package that can be installed separately, as explained later in this document in the section Configure the LoadMaster using Route Based VPN.

IPsec can operate in a point-to-point (aka host-to-host) configuration or in a site-to-site (aka network-to-network) configuration. An IPsec implementation operates in a host, as a Security Gateway (SG), or as an independent device, affording protection to IP traffic for both IPv4 and IPv6. (A security gateway is an intermediate system implementing IPsec, for example a firewall, router or gateway which has been IPsec-enabled.)

A suite of protocols are utilized to implement IPsec. These include Authentication Header (AH) and Encapsulating Security Payload (ESP). Handshaking and exchanging session keys is implemented using the Internet Key Exchange (IKE) protocol.

IPsec also has several Hashed Message Authentication Codes (HMAC) from which to choose, each giving different levels of protection for attacks such as man-in-the-middle, packet replay (anti-replay), and data integrity attacks.

There are many benefits of using IPsec. These include, but are not limited to:

  • Secure connectivity provided across distributed enterprises
  • Bandwidth benefits over traditionally expensive Wide Area Network (WAN) infrastructure
  • Cost benefits over traditionally expensive WAN infrastructure
  • Security - IPsec VPNs inherently provide a high degree of data security
  • Flexibility - IPsec VPNs can be established and be available using the internet
  • Resilience and High Availability (HA) for critical and sensitive applications available over the internet