PlantUML DiagramIPsec Components
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
A company has two offices connected via a business internet circuit from different ISPs. They want those offices to communicate securely over the public internet — traffic between them shouldn't be readable by ISPs or anyone else on the path. They also have 200 remote workers who need access to internal apps. Two different requirements, two different VPN types.
Site-to-site VPNs connect networks. Remote-access VPNs connect individual users. Both use encryption to protect traffic over untrusted networks, but the design and typical implementation differ significantly.
| Feature | Site-to-Site | Remote Access |
|---|---|---|
| Connects | Networks (offices, data centers) | Individual users to corporate network |
| Terminated at | VPN gateways (routers, firewalls) | VPN concentrator or firewall |
| Client software | None — transparent to hosts | Client software (AnyConnect, etc.) |
| Typical protocol | IPsec (IKE + ESP) | SSL/TLS (AnyConnect) or IPsec |
| Always on | Yes — persistent tunnel | On demand — client initiates |
| Use case | Branch to data center, cloud to on-prem | Remote workers, partners |
IPsec has two modes. Transport mode leaves the original IP header intact and encrypts only the payload — used for host-to-host. Tunnel mode encrypts the entire original packet and encapsulates it in a new IP header — used for site-to-site, because routers need to route the encrypted traffic using a different outer header.
AH is rarely used in modern deployments. It authenticates but doesn't encrypt, and it doesn't work through NAT (which modifies IP headers AH validates). Since ESP does both authentication and encryption, and works through NAT with NAT-T, ESP is what you'll see in production IPsec.
Remote-access VPNs have two main flavors. SSL/TLS-based (Cisco AnyConnect, OpenVPN, WireGuard with TLS) uses the same protocol as HTTPS, works through any firewall, and usually needs client software but no special network configuration. IPsec remote-access uses the same IPsec framework as site-to-site, and works through NAT with NAT-T, but is harder to configure and often blocked by restrictive networks.
Modern remote access is dominated by SSL/TLS VPNs. They're easier to deploy, work from anywhere (including hotels, airports, and restricted corporate networks), and integrate cleanly with identity providers for MFA and SSO. IPsec remote access still exists, but it's mostly a legacy option.
You're deploying remote access for 500 employees who work from home, airports, hotels, and customer sites (some with restrictive firewalls). Which VPN technology is best?
Select the safest next action.
Finish the lesson once you have worked through the material. This awards ★ 35 XP.