IPsec network traffic is always encrypted.

• A. True
• B. False
• C. Not sure
• D. It depends

Answer: (B)

IPsec can provide several security services, not just encryption. It has two main mechanisms: AH (Authentication Header) and ESP (Encapsulating Security Payload). AH offers data integrity and authentication but does not encrypt the payload. ESP, on the other hand, provides confidentiality by encrypting the traffic and can also provide integrity. Because IPsec can be configured to use AH (no encryption) or ESP (encryption), the traffic protected by IPsec is not always encrypted. In many deployments ESP is used to get encryption, but it’s not guaranteed in every configuration.